General
-
Target
SHIPPING INVOICE DOCUMENTS.exe
-
Size
853KB
-
Sample
210421-46japcfyha
-
MD5
04baf056bf4494fe6036d5be3a89c8f1
-
SHA1
a8bc3fa679c03f5889719f083c9f6e03d6b7eba1
-
SHA256
cf9638dcb0bcb52595ec1c4b79240f69536124fd85c9a07395dc563d19677a68
-
SHA512
1f228fe6f66ede703f764bfab3f28fd27610cd2c6a33f9509fa0d87384a101b7ed4fd3c8fe4b365cabd0486454b3bdd82631b49115679216d8686f49c185c747
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING INVOICE DOCUMENTS.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.onlytwod.xyz/htl/
bankeveyone.com
dumbmask.info
otrazhenie.space
pindd2.com
176whalebeachroad.com
onebook.world
mymuslimlawyer.com
xkhfw.com
bensbbq5931.com
pirateequitypatrick.com
medwebconsult.com
dungeonrunarena.com
friendlyukes.club
17pk.world
srtravails.com
kai-arts.com
fyuvpn.com
floryi.com
festesni.com
assroyalty.club
shalomconstructioncompany.com
jpmorganchasebank-germany.com
peakhomeimprovements1.com
abundentlifemarket.com
zpgzh.com
spasbody.com
qaatsv.com
kcgertfarm.com
kenteauthentic.com
ellendegenerates.com
mccolganimports.com
amrdiabcafe.com
401ne19thstapt51.com
europeaircrew.online
quapropertygroup.com
indetheheeler.com
pacifichealth1.com
q8ah.net
top10p.com
ichineselife.com
telegraphnews24.com
twochickswithapickup.com
jieliangcaifu.com
treeiam.com
solidrockrv.com
emirateshotelug.com
capahomeistanbul.com
shekhawatipgcollege.com
dasili588.com
bestnewcars2022.com
myperxe.com
visityourself.store
reimaginedhomedecor.com
reynoldshome.site
pcsourcebd.com
bakeoclockcakes.com
goodsandvibes.com
linusandco.com
artaria.net
timothykamil.com
tucre.com
urara-sedori.com
formationplusmature.com
aperocart.com
Targets
-
-
Target
SHIPPING INVOICE DOCUMENTS.exe
-
Size
853KB
-
MD5
04baf056bf4494fe6036d5be3a89c8f1
-
SHA1
a8bc3fa679c03f5889719f083c9f6e03d6b7eba1
-
SHA256
cf9638dcb0bcb52595ec1c4b79240f69536124fd85c9a07395dc563d19677a68
-
SHA512
1f228fe6f66ede703f764bfab3f28fd27610cd2c6a33f9509fa0d87384a101b7ed4fd3c8fe4b365cabd0486454b3bdd82631b49115679216d8686f49c185c747
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-