General
- Target обÑ_азцы пÑ_одукции заказать pdf.exe.xz
- Size 506KB
- Sample210831-22ck469twa
- SHA256 260efa00c07e74c629b2284ee64bbc42df7c4bb55d43a4988b72ccd05beae0f0
- MD5 a4e1f1b0d1faeb17dea3f830a64b917d
- SHA1 1001ef2f46a1d6612820417e91c9529f160b072f
- SHA512 aaa98be59d178fbbc556b34b6e354e91d1baaecadc72eeece91861248da88d7528bfb80fd0516f3c33ad34bbb80fabe9da1ad2488697076182ffe6629584050c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
обÑ_азцы пÑ_одукции заказать pdf.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
n7ak
-
http://www.kmresults.com/n7ak/
-
modischoolcbse.com
-
theneverwinter.com
-
rszkjx-vps-hosting.website
-
fnihil.com
-
1pbet.com
-
nnowzscorrez.com
-
uaotgvjl.icu
-
starmapsqatar.com
-
ekisilani.com
-
extradeepsheets.com
-
jam-nins.com
-
buranly.com
-
orixentertainment.com
-
rawtech.energy
-
myol.guru
-
utex.club
-
jiapie.com
-
wowig.store
-
wweidlyyl.com
-
systaskautomation.com
-
citromudas3a.com
-
plasticstone.icu
-
pawchamamapet.com
-
beautybybby.com
-
mor-n-mor.com
-
getoffyourhighhorses.com
-
chieucaochoban9.xyz
-
grahamevansmp.com
-
amplaassessoria.net
-
nutricookindia.com
-
wazymbex.icu
-
joansironing.com
-
hallforless.com
-
mycourseprofits.com
-
precps.com
-
cookislandstourismpodcast.com
-
bestonlinedealslive.com
-
bug.chat
-
ptjbtoqonjtrwpvkfgmjvwp.com
-
tortniespodzianka.store
-
qxkbjgj.icu
-
aurashape.com
-
guinealive.com
-
mondialeresources.com
-
offthebreak.site
-
maxamproductivity.com
-
thebiztip.com
-
thelocalrea.com
-
laeducacionadistancia.com
-
inpakgroup.com
-
lvgang360.com
-
allvegangoods.com
-
tymudanzaramos.com
-
simpleframeswork.com
-
thehappycars.com
-
directfenetres.net
-
norskatferdsterapi.com
-
hostingcnx.com
-
ksmh5x.com
-
thespiritworldinvitational.com
-
jetsetwilly3.com
-
gameflexdev.com
-
tryhuge.com
-
vaporvspaper.com
Targets
-
- Target обÑ_азцы пÑ_одукции заказать pdf.exe
- Size 559KB
- SHA256 de73d97fc56e19954fbec37b94bc65014305cc288b71ae6889bf37ac193c0333
- MD5 f750108de86e79c14390ac0661a67b87
- SHA1 d83e517431a18b4fbe0d477ec980e08b3d57bf1c
- SHA512 f0b2a919ae68a1aab25901662d5a240620030093f87c3e7e3262822c5b085b88d9039cb594ff7c94e38072c4803b0b3beff5f15e651cd92824752df27820d761
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext