General
- Target ORDER LIST.pdf.exe
- Size 708KB
- Sample210527-b4xchehdcs
- SHA256 58b7fa527ab5cff6d5465f2e751854e6708ef4d0070587883ca1fd8739359d6d
- MD5 60479648110ffc8b5e4d0aa32855a289
- SHA1 d7afa17e39cb605fd19c61b2cbface58706b884b
- SHA512 b13ed37240fb489139c0a120ae3d1cdc54bc41097a5aabae22be107fb47d80f911f841b11153cbf5da4db86cdd42ead5352bd5a1c44b855302758ab87aeb4b02
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
ORDER LIST.pdf.exe
Resource
win7v20210408
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.kalptarucentrino.com/owws/
-
asahizushi.info
-
691jxy.com
-
richelitesingles.com
-
traditionalmehandi.com
-
germinatebio.com
-
568215.com
-
yds-inc.com
-
whirlpool-repair.site
-
alwaysincerely.com
-
themallvideo.com
-
hzzamy.com
-
merchasylum.net
-
weknownorthgower.com
-
zseasyfishin.com
-
corporaterecruitertraining.com
-
pheki.com
-
kaqitoy.com
-
pbzb94.com
-
cortopepperfest.com
-
texas956.com
-
yangpaair.com
-
jamaicanrestate.com
-
alizamcandrew.com
-
highspnhxm.trade
-
recreationanddevelopment.com
-
machinerycomfortable.com
-
cunerier.com
-
doratemizlikurunleri.com
-
dinemuch.com
-
ihsangazisiyez.com
-
securenetflixapp.com
-
heartoflofall.com
-
laurabarstowart.com
-
stallionsilver.com
-
macusix.com
-
desertcamelhq.com
-
electrumsystem.network
-
leetranscreations.com
-
sdyuancang.com
-
lcpcap.com
-
67657780.com
-
shipbuildersforgolden.com
-
bermudefcrasettlement.com
-
koladintechnologies.com
-
tennisopenit.com
-
chrispricellc.com
-
x-izm.net
-
theopendata.exchange
-
copinginfula.trade
-
gksfhzuhi.icu
-
radansaisortagim.com
-
fsjcfrozenfood.com
-
cdpp.net
-
xn--anibalderedao-7eb3d.com
-
ycshop.net
-
mescopro.com
-
gp4458.com
-
xn--2z1bq6efxj2gp2o9xd.com
-
sagesse-courtage-credit.com
-
ligaeuropea.com
-
kieler-hof.com
-
lessismorebeautiful.com
-
fundwise.pro
-
mymathstest.com
Targets
-
- Target ORDER LIST.pdf.exe
- Size 708KB
- SHA256 58b7fa527ab5cff6d5465f2e751854e6708ef4d0070587883ca1fd8739359d6d
- MD5 60479648110ffc8b5e4d0aa32855a289
- SHA1 d7afa17e39cb605fd19c61b2cbface58706b884b
- SHA512 b13ed37240fb489139c0a120ae3d1cdc54bc41097a5aabae22be107fb47d80f911f841b11153cbf5da4db86cdd42ead5352bd5a1c44b855302758ab87aeb4b02
- MD5 SHA1 SHA512
Xloader Payload
Deletes itself
Suspicious use of SetThreadContext