General
-
Target
Doc images.rar
-
Size
203KB
-
Sample
210923-pdkbzsede8
-
MD5
ef06e7d99b1be86367545943a0fae08e
-
SHA1
12cb85be7cffa0cbaef5de65ced8b9ee2e6c81aa
-
SHA256
853854d113bd8e305cbf145e114e71ed216547050119432bd2433f821b569cd4
-
SHA512
3afe46fe7118adc1c91cb7e1a4b03b1fddeef454218fdc69dfa1c132f04a42cb3750fdf43483d438af74e553fba7415b7f5076663e630a546c68d1130303f02a
Malware Config
Extracted
formbook
4.1
dn7r
http://www.yourherogarden.net/dn7r/
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Targets
-
-
Target
doc012_jpeg.scr
-
Size
263KB
-
MD5
4c261f9e162e1d86be1b7106ff5fcba7
-
SHA1
77901cea8e050bcd11dc413cce5174346e698819
-
SHA256
240ed2d2ad13186c06123612befe2a592cb2484a7bc6454f84be7f8bee850ebe
-
SHA512
a1af6755f90f192939be79ed48e87d647ac71a2a42f5716b7c41c930d1d23db908aaab999b141a0531cdd5685393e841e7a80748507aec6f01097e20307c625f
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Formbook Payload
-