General
-
Target
shipping document pdf.exe
-
Size
589KB
-
Sample
210430-h9gpvk395s
-
MD5
a944814a7834420e867e3aef8a6648e9
-
SHA1
bfb53e20b81e77a33934b48ea66f92b70c319c5c
-
SHA256
c1213a12b0b441fb0eb8b74740b243a3ac24b3685c02a62897761e78381f6141
-
SHA512
e842415ae625de9ab49fa514425964030e4ff2a2033843b496c7d6f15f907c89aaf82fb8f72f279cebd7e8173228b3ac56077dd46ed85314ea750ffd5070c62f
Static task
static1
Behavioral task
behavioral1
Sample
shipping document pdf.exe
Resource
win7v20210408
Malware Config
Extracted
formbook
4.1
http://www.onlytwod.xyz/htl/
bankeveyone.com
dumbmask.info
otrazhenie.space
pindd2.com
176whalebeachroad.com
onebook.world
mymuslimlawyer.com
xkhfw.com
bensbbq5931.com
pirateequitypatrick.com
medwebconsult.com
dungeonrunarena.com
friendlyukes.club
17pk.world
srtravails.com
kai-arts.com
fyuvpn.com
floryi.com
festesni.com
assroyalty.club
shalomconstructioncompany.com
jpmorganchasebank-germany.com
peakhomeimprovements1.com
abundentlifemarket.com
zpgzh.com
spasbody.com
qaatsv.com
kcgertfarm.com
kenteauthentic.com
ellendegenerates.com
mccolganimports.com
amrdiabcafe.com
401ne19thstapt51.com
europeaircrew.online
quapropertygroup.com
indetheheeler.com
pacifichealth1.com
q8ah.net
top10p.com
ichineselife.com
telegraphnews24.com
twochickswithapickup.com
jieliangcaifu.com
treeiam.com
solidrockrv.com
emirateshotelug.com
capahomeistanbul.com
shekhawatipgcollege.com
dasili588.com
bestnewcars2022.com
myperxe.com
visityourself.store
reimaginedhomedecor.com
reynoldshome.site
pcsourcebd.com
bakeoclockcakes.com
goodsandvibes.com
linusandco.com
artaria.net
timothykamil.com
tucre.com
urara-sedori.com
formationplusmature.com
aperocart.com
Targets
-
-
Target
shipping document pdf.exe
-
Size
589KB
-
MD5
a944814a7834420e867e3aef8a6648e9
-
SHA1
bfb53e20b81e77a33934b48ea66f92b70c319c5c
-
SHA256
c1213a12b0b441fb0eb8b74740b243a3ac24b3685c02a62897761e78381f6141
-
SHA512
e842415ae625de9ab49fa514425964030e4ff2a2033843b496c7d6f15f907c89aaf82fb8f72f279cebd7e8173228b3ac56077dd46ed85314ea750ffd5070c62f
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-