General
-
Target
FACTURA DE PROFORMA PDF.exe
-
Size
712KB
-
Sample
220104-tkjfgshca8
-
MD5
5827a80cfb204906f2ca19ef835c0b0f
-
SHA1
e8334cb029d265899092e56d76373f6e021d7622
-
SHA256
6ceb475f1ce2d253425aa3eab01c7dc18a205ab5eac8c2b5830d72f1795f3723
-
SHA512
b5d65381ba3e22b3b957ba7addfa60da28effd608295dfc222875464943ca555483ecfbec7588c9917b177926491bd26c1e89ab8bcc0a662f2970f4d332eafd9
Malware Config
Extracted
formbook
4.1
n7ak
modischoolcbse.com
theneverwinter.com
rszkjx-vps-hosting.website
fnihil.com
1pbet.com
nnowzscorrez.com
uaotgvjl.icu
starmapsqatar.com
ekisilani.com
extradeepsheets.com
jam-nins.com
buranly.com
orixentertainment.com
rawtech.energy
myol.guru
utex.club
jiapie.com
wowig.store
wweidlyyl.com
systaskautomation.com
Targets
-
-
Target
FACTURA DE PROFORMA PDF.exe
-
Size
712KB
-
MD5
5827a80cfb204906f2ca19ef835c0b0f
-
SHA1
e8334cb029d265899092e56d76373f6e021d7622
-
SHA256
6ceb475f1ce2d253425aa3eab01c7dc18a205ab5eac8c2b5830d72f1795f3723
-
SHA512
b5d65381ba3e22b3b957ba7addfa60da28effd608295dfc222875464943ca555483ecfbec7588c9917b177926491bd26c1e89ab8bcc0a662f2970f4d332eafd9
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-