General
-
Target
INVPRF2100114_pdf.exe
-
Size
412KB
-
Sample
211007-efmvsabge7
-
MD5
08be9eb13ce48889a767c1faf80fc855
-
SHA1
4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9
-
SHA256
7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737
-
SHA512
5ccbdf445507b85c5b4595b430e26b5306d30abfe60047f5d2438a3294013a93cbf8d1136ab009b1cda87a5f662fb8ca5683a11ecb60a9636a0c2155c6d9d3b4
Static task
static1
Behavioral task
behavioral1
Sample
INVPRF2100114_pdf.exe
Resource
win7v20210408
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Targets
-
-
Target
INVPRF2100114_pdf.exe
-
Size
412KB
-
MD5
08be9eb13ce48889a767c1faf80fc855
-
SHA1
4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9
-
SHA256
7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737
-
SHA512
5ccbdf445507b85c5b4595b430e26b5306d30abfe60047f5d2438a3294013a93cbf8d1136ab009b1cda87a5f662fb8ca5683a11ecb60a9636a0c2155c6d9d3b4
-
Xloader Payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-