General
- Target PO. 2100002_pdf____________________________________.exe
- Size 612KB
- Sample210914-v11kdagaf4
- SHA256 c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef
- MD5 a8d20a8d6a2995da3c3c1976589df06a
- SHA1 6479838c581f60945250cd25786f43b19e2dc14c
- SHA512 b2afe6db537d683e0a09b2cdc073f0c39c480cc95ddd3cff2fec5ae25d05a2fdd199f1a28023dc5e2bf56340514dc226e8cb4526f66b24b9e8c1b4361bca846d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO. 2100002_pdf____________________________________.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
ajki
-
http://www.midwestamericanwoman.com/ajki/
-
elborivegano.com
-
jacksbookbuddies.com
-
gentciu.com
-
lovetattoonorteguadalix.com
-
dahlkar.com
-
hjobjiihna.club
-
narccar.com
-
noexcuseadventure.com
-
mortongroverealestateinfo.com
-
pursuegoodtimes.com
-
becomearepresentativetoday.com
-
20bagger.com
-
lowestprices.space
-
qzgay.com
-
thegoenkapost.com
-
glassdooronline.com
-
quantizesoftware.com
-
bayleighmphotography.com
-
hzmm97.com
-
theexoticbox.com
-
verishop.site
-
meusyouunlimited.com
-
hvtnywveba.club
-
yffuture.com
-
bandsignsandgraphics.com
-
rhealending.com
-
studentlegalforms.com
-
fubonbank.xyz
-
themuslim101.com
-
gigwindow.com
-
thevillaflora.com
-
fontankarecords.com
-
liaofeng2008.com
-
emerging.global
-
rutasecretas.com
-
imtheonlyperson.global
-
bestforcrypto.com
-
adasnspa.com
-
abilityhomehealthservices.com
-
travelfever-reiseblog.com
-
redtail.football
-
teatrodomorcego.com
-
myfunkyshirt.com
-
volanch.com
-
ophelia.company
-
learniapp.com
-
inspiredsoulgifts.com
-
citestasdsadasdwebzai.com
-
wwwrijra.com
-
esensites.com
-
projetmaison64.com
-
dailytipsones.com
-
opticseurasia.com
-
muslimsinsport.com
-
kissbeauties.com
-
aminarzhang.com
-
empirepanada.com
-
nilalvesfotografia.com
-
eswensai.com
-
espaciomeig.com
-
pos010000.com
-
qireys.com
-
shethrivesvirtual.com
-
nailch.com
Targets
-
- Target PO. 2100002_pdf____________________________________.exe
- Size 612KB
- SHA256 c8b5ad6ec571b93bce7b6ae25501d622eb7fda462b02455ff7bd9aaaace29aef
- MD5 a8d20a8d6a2995da3c3c1976589df06a
- SHA1 6479838c581f60945250cd25786f43b19e2dc14c
- SHA512 b2afe6db537d683e0a09b2cdc073f0c39c480cc95ddd3cff2fec5ae25d05a2fdd199f1a28023dc5e2bf56340514dc226e8cb4526f66b24b9e8c1b4361bca846d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext