General
- Target PO21120008.PDF.exe
- Size 1.0MB
- Sample211209-j81dssbba3
- SHA256 bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b
- MD5 d7122cdaeccec52ebf5e5a2606a6e407
- SHA1 a6df9888a58bf5bf2c222279b1ba324e0e821029
- SHA512 2b0a429279aadba5b4d76d492b8eda37940bc097ab50187a80dbe4ee1b8d28835588a35cea16b8064d896e2e2bd5c174e367c5af9fa6296eaec91ac3ab820454
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO21120008.PDF.exe
Resource
win7-en-20211208
Malware Config
Extracted
-
formbook
-
4.1
-
gr1c
-
http://www.illusiontrick.com/gr1c/
-
soakyourgrains.com
-
duwego.com
-
aenkdesign.com
-
bikabbziu.xyz
-
thesawyerlegacy.com
-
koreanmodelbj.xyz
-
exceed-standards.com
-
syirsve.com
-
sachisushimontreal.com
-
thegalwaykitchen.com
-
accarwash-hub.com
-
connectwithmentor.com
-
luftfundament.online
-
ibrahimkaracan.com
-
biggersinsurance.com
-
desellon.com
-
tvnewscloset.com
-
digital-dre.com
-
ingocg.com
-
fernanda-ortiz.com
-
globallbazar.com
-
goldballoons.com
-
save-insta.net
-
jr-cons.com
-
ahyaqing.com
-
dawoodkhalil.com
-
paris-moi.com
-
pitchnft.net
-
shopdivastore.com
-
clarksclumpiesforkids.com
-
boutiquedulinge.com
-
tephineproperties.com
-
536484.com
-
testbegetregainfo.info
-
descontazzo.com
-
complioso.com
-
cashvax.xyz
-
bezeqimt.net
-
niqi666.com
-
daqishoes.com
-
uichin.info
-
boostarassa.quest
-
tarrings.info
-
caringhearts.one
-
untouchableinnovations.com
-
raymondcase.com
-
trippyhippieinc.com
-
fischernude.top
-
mazurschool.com
-
fswde.online
-
boldlarentals.com
-
welmovs.xyz
-
bandardunia.xyz
-
9594851.com
-
jioi.top
-
brequity.com
-
krakennewhour.com
-
polyteq.net
-
033xj.com
-
066ss.xyz
-
aluthgossip.xyz
-
grandezapura.com
-
kenneth-p.online
-
dadsaman.com
Targets
-
- Target PO21120008.PDF.exe
- Size 1.0MB
- SHA256 bf4e018e1442fb7815901e53bccc699ee5634e2fcc3ba73327e123ae3d89a65b
- MD5 d7122cdaeccec52ebf5e5a2606a6e407
- SHA1 a6df9888a58bf5bf2c222279b1ba324e0e821029
- SHA512 2b0a429279aadba5b4d76d492b8eda37940bc097ab50187a80dbe4ee1b8d28835588a35cea16b8064d896e2e2bd5c174e367c5af9fa6296eaec91ac3ab820454
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext