General
-
Target
_PAYMENT COPY PDF.7Z
-
Size
685KB
-
Sample
210423-1bw8bxl94j
-
MD5
9e7f2dd645524d5e85544210ebaccac7
-
SHA1
a221b4d9a680c487d31936d5a19f058d37a301b6
-
SHA256
62496f422fef86419768d4ef36a3a8849eb043f20ebd9a750a694509d76da4f6
-
SHA512
8814f99193aeaf8fac9b68f96a42def178feece53b37606355ae3941a59337883cc78df5930f2a36b70c08904059d2942e320ed227c3eb6615e9fae0a48aa881
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY PDF.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.the-techs.info/chue/
wowmovies.today
magentos6.com
bi-nav.com
atlantahawks.sucks
wluabjy.icu
kevableinsights.com
lavidaenaustralia.com
stonermadeapparel.net
sondein.com
cirquedusoleilartist.com
kanjitem.com
tomofalltrades.site
mecanico.guru
tech2020s.com
amesoneco.com
theawfulliar.com
californiaadugurus.com
rentalservicesolutions.com
fsxbhd.club
casino-seo.com
asknesto.com
get-rangextd.com
gkwill.com
juliegiles.net
pagosafreedom.com
wbpossiblellc.com
fhjfyutotyhfse.com
sexshopsatelite.com
shellykraftlaw.com
motherhenscoop.com
mboklanjar.com
redwoodcityswing.com
haier-mz.com
metalinjectionltd.asia
franquiaoriginal.com
mcronaldfood.com
mobilegymconcierge.com
haifu168.com
apeiro.life
thejosephnashvilletn.com
bensbrickstore.com
sanctumwell.com
beanexthomie.com
stylazhaircare.com
jordanvanvleet.com
jdwx400.com
francescoricco.com
gameshowsatschool.com
alqymist-monaco.com
infinitysportsmassage.com
algorithmrecruitment.com
tanyasubatang.com
impressivebackyard.com
wwwgocashwire.com
visual-pioneers.net
thememo-mobilebar.com
wagner-fahrschulegmbh.com
minterfortexas.com
codelopers.com
inyarsb.icu
ravenlightproductions.com
germiblock.com
coutinhoefelipeadv.com
diegobr1307.life
Targets
-
-
Target
PAYMENT COPY PDF.exe
-
Size
886KB
-
MD5
5fc2fc6fc06699743437326861f6f6f5
-
SHA1
66466f85133f488d1caf2cda0bd337d7b5c3521a
-
SHA256
4bb03ac06147c50ff9a8248d92e97dabb2cc58c6ffc70448018f3138dcc652b7
-
SHA512
97db9fca3a99dbfd82fb1b81de4e5213aef785ec7334347d45e97d834b00437593a248b0b52fd78ae804220c08e8cbb61cb10233471da1f6499c13df22759041
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-