General
-
Target
LPO PRECISION MESHES 2352104321QQ.pdf.exe
-
Size
926KB
-
Sample
210421-hwhgm5zrm6
-
MD5
23420e3ded198412f33ffa460e601764
-
SHA1
326f1bb9ea091b0e8d58852512ee08bed517c64b
-
SHA256
dd2e58b3398ea6d274ba7f993a66cd67fbb2654f73012763f50b309c8b56df38
-
SHA512
d7d4ba9b58142d75eba44533d0218eb179d4b9492f2c49ab8a5bad23e96330766cf59ed4394fb7f59d1f20385adb0e949015406f40f4677ef06f5d882a59668b
Malware Config
Extracted
formbook
4.1
http://www.magnumopuspro.com/nyr/
anemone-vintage.com
ironcitytools.com
joshandmatthew.com
breathtakingscenery.photos
karabakh-terror.com
micahelgall.com
entretiendesterrasses.com
mhgholdings.com
blewm.com
sidewalknotary.com
ytrs-elec.com
danhpham.com
ma21cle2henz.xyz
lotusforlease.com
shipleyphotoandfilm.com
bulktool.xyz
ouedzmala.com
yichengvpr.com
connectmygames.com
chjcsc.com
Targets
-
-
Target
LPO PRECISION MESHES 2352104321QQ.pdf.exe
-
Size
926KB
-
MD5
23420e3ded198412f33ffa460e601764
-
SHA1
326f1bb9ea091b0e8d58852512ee08bed517c64b
-
SHA256
dd2e58b3398ea6d274ba7f993a66cd67fbb2654f73012763f50b309c8b56df38
-
SHA512
d7d4ba9b58142d75eba44533d0218eb179d4b9492f2c49ab8a5bad23e96330766cf59ed4394fb7f59d1f20385adb0e949015406f40f4677ef06f5d882a59668b
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-