General
- Target Halkbank_Ekstre_20210708_0709789_405251-PDF.exe
- Size 743KB
- Sample210708-2xys5tlpza
- SHA256 d457980cebdbfd785a77b0d09249f5bc8cca708f5b5e7fe607f1b538faf977c4
- MD5 f064e90e3c0ffeec3e7a4a2e22b8d19b
- SHA1 49e494f2d9bce256422c295196046e1d30daf571
- SHA512 fafd9bbfe2d309fa3e0df7d9ec88ee3c0feb33db0b2042c8140f23dff7a3fa1b700382a7f12ad4fd701f313d3a7330e9b66893924f751a9aef36bcaa3843cf1d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank_Ekstre_20210708_0709789_405251-PDF.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.setuseny.site/wz6a/
-
commonebisu.com
-
onlinedatingforyou.com
-
nomoreink.com
-
directcare.doctor
-
protego1.com
-
buvettechamonix.com
-
dissertationshelp.net
-
theawakenedmother.life
-
leonwickham.com
-
renaultstoreiran.com
-
lsxwsj.com
-
uniontattoosupply.com
-
herfitnessandbeauty.com
-
jesselynleephotography.com
-
imaginebyccp.com
-
athomeproductive.com
-
laratome.com
-
smoothsailingexpress.com
-
freedrumlessons4u.com
-
easylivego.com
-
peekypetshop.com
-
suachuanha123.com
-
hamdiistanbullutv.com
-
economicsfortoddlers.com
-
donaldbichonfrise.com
-
ahhazu.com
-
fallincoffee.com
-
ospfenetres.com
-
mybusinessdoor.com
-
unfreecitizens.com
-
sofahaven.com
-
angelicmichele.com
-
boroda.codes
-
creationsbyba.com
-
324518.com
-
adventuresindiy3dprinting.com
-
onehitwonderthemusical.com
-
valsinvoguenails.com
-
inclusionpractitioner.com
-
downbytheriverside.online
-
pengpengcooking.com
-
tricket24.com
-
hanyajadi.com
-
iinntenna.com
-
basicallyindia.com
-
qfjg.net
-
lawartcultureweekly.com
-
whjmglj.com
-
mijnwebaanvraag.info
-
biancacannavoslp.com
-
brurodrigues.com
-
zebratrainer.info
-
8146confluencept.com
-
inshaabytdh.com
-
ossierugs.com
-
smacey.com
-
performancehut.com
-
fostermarketing.energy
-
rama.fans
-
spotonspecialed.com
-
krushiaadhaar.com
-
betgobar8.com
-
lkstau.com
-
thaikeittio.com
Targets
-
- Target Halkbank_Ekstre_20210708_0709789_405251-PDF.exe
- Size 743KB
- SHA256 d457980cebdbfd785a77b0d09249f5bc8cca708f5b5e7fe607f1b538faf977c4
- MD5 f064e90e3c0ffeec3e7a4a2e22b8d19b
- SHA1 49e494f2d9bce256422c295196046e1d30daf571
- SHA512 fafd9bbfe2d309fa3e0df7d9ec88ee3c0feb33db0b2042c8140f23dff7a3fa1b700382a7f12ad4fd701f313d3a7330e9b66893924f751a9aef36bcaa3843cf1d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext