General
-
Target
Quotation_23642828687267892387.xls.exe
-
Size
710KB
-
Sample
210510-hfdxvkemmx
-
MD5
f0e2e2dbb34dbdecb3ce6a3a885e89d5
-
SHA1
f52c0691574ac454d5bbd50cfe470218b6ad906f
-
SHA256
ee913da4f5fe43bc6f2457ce36d9364d4b9f7a79adb71dab617ca1dfde879377
-
SHA512
c3c7e4ba5006551649fd9c18ea8ba6464917746546054205b2839c5ae2f31070d7e27682d7ce90aaf84063fe1fb6f1c756967e755b7d5f8fac54f86605e4f2c4
Static task
static1
Behavioral task
behavioral1
Sample
Quotation_23642828687267892387.xls.exe
Resource
win7v20210410
Malware Config
Extracted
formbook
4.1
http://www.angelgirlm.com/c7jh/
melangearte.com
nuaphraka.com
sharongold.net
seriouslysimpledesigns.com
17mpacc.com
customwareperu.com
styleofbliss.com
myvardenafilok.com
anwarnews.net
therecruiterroute.net
wxgdds.com
bmgblve.com
hotel-montmartre.com
ujasiriisihawu.com
childs.farm
landscapesofcapital.com
carolecares.com
wesarzamin.com
yinleba.com
partnershrsolutions.com
blog-tele.com
limitlessunicorn.com
thichcode24h.com
riftmead.com
gj-watch.com
xn--x-y06a956cx4erz0b.space
hubeautify.com
juice-salad.com
lyviamendes.com
sseifutures.com
glamourareeiroshop.com
abctruckrepair.com
cescperu.com
apedirdebodawp.com
adfdkm5imless.xyz
jumtix.xyz
arcadedatabase.science
uuoouu-58.store
applicateone.com
culturenails.com
kuccioli.com
synths.world
inmarle.com
geexitstrategies.com
whatbeeswant.com
globalblackyacht.com
northgatelp.com
onewithluke.com
jacencons.com
resilkorlace.com
hotelencancun.com
kaviancosmetics.com
offerandgrab.com
flikrsupport.com
drawpop.com
properhumandesign.com
poretrait.com
tkrbeautyinstitut.com
blinorie.com
668xxb.com
hd115322.com
paloaltodev.com
almashopmadrid.com
loanexpress-ptop.com
Targets
-
-
Target
Quotation_23642828687267892387.xls.exe
-
Size
710KB
-
MD5
f0e2e2dbb34dbdecb3ce6a3a885e89d5
-
SHA1
f52c0691574ac454d5bbd50cfe470218b6ad906f
-
SHA256
ee913da4f5fe43bc6f2457ce36d9364d4b9f7a79adb71dab617ca1dfde879377
-
SHA512
c3c7e4ba5006551649fd9c18ea8ba6464917746546054205b2839c5ae2f31070d7e27682d7ce90aaf84063fe1fb6f1c756967e755b7d5f8fac54f86605e4f2c4
-
Formbook Payload
-
Suspicious use of SetThreadContext
-