General
- Target HG284-2021_03_31.pdf.exe
- Size 760KB
- Sample210331-957t5q4kp2
- SHA256 bc0cc9f45e5a3b9f2f1815c4787849ebd8ab71d72aca809b687bc462ec9b5899
- MD5 80c5213f5555c29dbb724e71d7087b1d
- SHA1 ad22369d1295cc01fe02fdcef6262167ee405b1e
- SHA512 e5631a98e170cab949df77ae32d5cb64ee99c467625fca8bd9825d954f748a652110eacad20227d45f8066a747e84abc15e7a5cbc3cc83e156ef4c6aad7781fb
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
HG284-2021_03_31.pdf.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.profit-maximisation.com/g7b/
-
conectadocr.com
-
traumatic-arrest.com
-
financialfitnessspa.com
-
tinnitusofficial.club
-
upward-holdings.com
-
instagramhelp-me.com
-
annabelsasia.com
-
bbwtrip.com
-
coloradodomain.com
-
coachparapadres.com
-
tootandscoot.com
-
homemstreet.com
-
nmresortproperty.com
-
towerskyresort.com
-
touchofclasspropertiesllc.com
-
intilook.com
-
mrd-photography.com
-
thesalesarcade.com
-
reddirect.net
-
j-hn.com
-
exoticevolutionstudio.com
-
look-production.com
-
cstoremarket.com
-
elabrarrr.com
-
forty9.club
-
hypergiant5.xyz
-
ceylonjobs.com
-
leosquad.world
-
lownak.com
-
jaypottsdrummer.com
-
tollisenschool.com
-
daipol.com
-
integritydeficit.com
-
cvintekids.com
-
bakoroast.coffee
-
mejorplas.com
-
wlkjfz.com
-
freegift4life.com
-
klsc008.com
-
mp3-musica-free.com
-
3ruechateauroyal.com
-
trident-cnc.com
-
ellarosebeauty.com
-
circusse.com
-
ipremierb.com
-
mud.coffee
-
massagetherapygatesville.com
-
hotelpaintinstallers.com
-
0b1b.com
-
oswegosurfsup.com
-
osceolacountyfl.com
-
overlandrs.net
-
bdalg.com
-
11ceohabits.com
-
northsidehealthsystem.com
-
mindpoints.pro
-
steamthink.com
-
allstateshome.com
-
rheinlandpfalzurlaub.com
-
collegekingsgame.com
-
simplyfabevents.com
-
bucketseverywhere.com
-
softwarepals.com
-
edenevergreenhomes.com
Targets
-
- Target HG284-2021_03_31.pdf.exe
- Size 760KB
- SHA256 bc0cc9f45e5a3b9f2f1815c4787849ebd8ab71d72aca809b687bc462ec9b5899
- MD5 80c5213f5555c29dbb724e71d7087b1d
- SHA1 ad22369d1295cc01fe02fdcef6262167ee405b1e
- SHA512 e5631a98e170cab949df77ae32d5cb64ee99c467625fca8bd9825d954f748a652110eacad20227d45f8066a747e84abc15e7a5cbc3cc83e156ef4c6aad7781fb
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext