General
-
Target
NEW ORDER INQUIRY_B3003H24 .pdf.exe
-
Size
847KB
-
Sample
210422-zxh16kyewn
-
MD5
bb19727805e0a324459821b815ceedc0
-
SHA1
1523af27204e8b74622bd02ecf31ee263b3509ce
-
SHA256
e8a3b52e9b54740b4d20b01aac7d1e77576ae6c23754c775bef7ab48bb494e8a
-
SHA512
96b294414154fb355df68e26e7bc1ea973062fdd6dcd87a577bba3b1620c6cd03e65108ed6adcd5ae722103c8a70f121ec08890cd17901991d06691a431450ba
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER INQUIRY_B3003H24 .pdf.exe
Resource
win7v20210410
Malware Config
Extracted
xloader
2.3
http://www.huamxvcyq.icu/aepn/
noesos.com
partsus.xyz
manageordercentersupp.com
wickedwallart.com
hike4cash.com
theviragocircle.com
followthesharks.com
paradisevalleywines.com
unmetrolimpio.com
eurocarsnj.com
alvaroeliseo.com
bfc8.xyz
oldcourts.com
bkpef.info
mammately.com
agentcharles.com
wwwmichiganbulb.com
pensolid.info
hibiscushealthcare.com
mwanakbk.com
theafashions.com
fundolagosecreto.com
callusesremover.com
hyprepolymer.com
ferguson-home.com
greenfixfuel.com
nationalseniorsdeerpark.com
laurinwithhoney.com
asiancajundesign.com
ethereumaudit.com
danisco.sucks
avtobluz72.net
maymodel.net
heisenbrew.wine
wirebendersportfishing.com
syncblow.site
littleslumberparties.com
progmao.com
sarl-renov-bat.com
ngoclacntv.com
fand-sodan.com
parkourtrading.com
ladywhitecompany.com
theislamoscope.com
amarresdemas.com
playgymnastics.com
last-information-app-secure.com
myglowskins.com
chain-dynamics.net
mildinfra.com
wwwxilu.com
hunhu.net
inconel800.com
thumuavaigiacao.com
katsworlds.com
jewelsfleet.com
organichighqualitytwig.com
ocheapvrwdmall.com
alsiha2020.com
renttoownhomearizona.com
digitaldustbowl.net
xn----7sbbixkkqgmzjfi.xn--p1acf
downsizeandupsizeyourlife.info
senmec23.com
Targets
-
-
Target
NEW ORDER INQUIRY_B3003H24 .pdf.exe
-
Size
847KB
-
MD5
bb19727805e0a324459821b815ceedc0
-
SHA1
1523af27204e8b74622bd02ecf31ee263b3509ce
-
SHA256
e8a3b52e9b54740b4d20b01aac7d1e77576ae6c23754c775bef7ab48bb494e8a
-
SHA512
96b294414154fb355df68e26e7bc1ea973062fdd6dcd87a577bba3b1620c6cd03e65108ed6adcd5ae722103c8a70f121ec08890cd17901991d06691a431450ba
-
Xloader Payload
-
Suspicious use of SetThreadContext
-