General
-
Target
PENDING QUOTATION.xlsx
-
Size
343KB
-
Sample
211018-m19jaaddf4
-
MD5
9bcd3b345d6eff5fbf800c35330a0bde
-
SHA1
7e92e7af29e8cb16c927d7d0fa0255b69a44ce44
-
SHA256
154e8841faee60e1f21fca5eb5b8db213d12e0a4ff89cb411326a30348c5807d
-
SHA512
defd4feb460063a6ffae0f5d98ded97e5ba5b15d2244c43113b55396ec34621bf82e2013ee666e1b4d53c578431bfd9848a7540e7c3ac3cf2f1a45b2cdc6de14
Static task
static1
Behavioral task
behavioral1
Sample
PENDING QUOTATION.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
PENDING QUOTATION.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
formbook
4.1
s6tn
http://www.majordomus-gliwice.com/s6tn/
ya-volna.com
nakimura.online
buildtheyamato.com
carecard.xyz
orthozayn.com
sitd.xyz
garu.club
alfainfocom.com
floridalacrossecamps.com
banytus.xyz
dogodipiskot.quest
ljlsaf.com
shaheenricemills.com
cuevieujni.info
chrisandkcollection.com
sunadokei.website
hoidotsbirky.quest
creditassociatesllc.com
amazonhrjobs.com
the-luggage-dropp-off.com
kwwmarket.com
twdesignacreation.com
siaralntl.com
iacompetitionsasia.com
seeker-l.xyz
bytesandvotes.com
newbotong.com
dbelnlogoro.quest
isleptwell.com
effektivpeople.com
rosariopabst.com
holdvfind.store
fishhunter99.com
11km.net
cryptobloombergs.com
suppershop.store
lu2h4vasat.com
siberiancrystal.com
laxmanblog.com
ret-services.com
epm-brandsshop.com
rainbowlampro.com
mastermart.net
pintseeker.com
kioskpass.com
mpu-spezialist.com
debthlp.com
westafricaschools.com
guojiannoodlemachine.com
readingroomtnpasumo5.xyz
liferooz.com
farmavidacanarias.com
voconunve.xyz
sekshikayelerimiz.info
paybro.online
condensus.com
zaratwo2.com
zcfxwl.com
sephorapets.com
arabatalmustahlik.com
poojas.xyz
verbenalifestyle.com
gabinettomedico.com
khazis.com
Targets
-
-
Target
PENDING QUOTATION.xlsx
-
Size
343KB
-
MD5
9bcd3b345d6eff5fbf800c35330a0bde
-
SHA1
7e92e7af29e8cb16c927d7d0fa0255b69a44ce44
-
SHA256
154e8841faee60e1f21fca5eb5b8db213d12e0a4ff89cb411326a30348c5807d
-
SHA512
defd4feb460063a6ffae0f5d98ded97e5ba5b15d2244c43113b55396ec34621bf82e2013ee666e1b4d53c578431bfd9848a7540e7c3ac3cf2f1a45b2cdc6de14
-
Formbook Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-