General
- Target ORDER INQUIRY_pdf.exe
- Size 1005KB
- Sample220320-lzhthabhgr
- SHA256 321ae247ce6d6539af41e802f8ad398dc2bcc56f81664bb46114d177caa896cf
- MD5 1fcd446593ad12cccf4768ac2a737f14
- SHA1 dd81201638ffc855d728bc7d3059c0b5609e11e6
- SHA512 a71a48e2a41bed68b44049fc9ffd1d1695b2d5ad5515342d5f9398767d95964dc9a9abee4eb6a96a650bcdf164f21a5599ce20bfb90b2bc410cef480b0dc3784
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY_pdf.exe
Resource
win7-20220310-en
Malware Config
Extracted
-
formbook
-
4.1
-
e0l9
-
packingfairturkiye.com
-
khenonline.com
-
mydactil.online
-
coriliechty.com
-
canadazk.com
-
freeloanseva.com
-
successvideo.today
-
infinitelifetransformations.com
-
unicryptdoge.com
-
ecolifeco.com
-
luxefashionaire.com
-
lqctqtal.xyz
-
liveexim.com
-
happyhempbakery.com
-
paypalverifie.com
-
wingonvacations.com
-
flawdogs.com
-
shalomsingapore.com
-
ruscc.xyz
-
yaxi868.com
-
hizika.com
-
joansbestshop.xyz
-
xfcad20.icu
-
kosaz.online
-
noticejcb.xyz
-
njpropertyrecors.com
-
positionme.site
-
rommyarf.com
-
vacumeet.xyz
-
societalsystemic.com
-
securitenovo.com
-
kingstreetlife.com
-
ridgwayracing.com
-
ndcqchc.com
-
rever-age.com
-
green-stone.solutions
-
idyijr28j.xyz
-
dailyjointhealth.com
-
computevault.com
-
thetimewheel.com
-
hilutv.xyz
-
shanaesbeauty.com
-
cryptwo.xyz
-
andro.finance
-
steady.store
-
gangsha2001.com
-
wodev.biz
-
affinitybuzz.com
-
nfhotel.net
-
westfieldswetlands.com
-
fatflorida.com
-
room4rent.net
-
madamebet.com
-
ceonsolutions.info
-
non-transferabletokens.com
-
rsvip13cvx.xyz
-
sveshtivosak.com
-
budunkafunk.com
-
nginspection.com
-
newdealny.com
-
uc-usa.com
-
tuvanvaytien24h.site
-
5okx.com
-
menzelengineering.com
-
unityassetstock.com
Targets
-
- Target ORDER INQUIRY_pdf.exe
- Size 1005KB
- SHA256 321ae247ce6d6539af41e802f8ad398dc2bcc56f81664bb46114d177caa896cf
- MD5 1fcd446593ad12cccf4768ac2a737f14
- SHA1 dd81201638ffc855d728bc7d3059c0b5609e11e6
- SHA512 a71a48e2a41bed68b44049fc9ffd1d1695b2d5ad5515342d5f9398767d95964dc9a9abee4eb6a96a650bcdf164f21a5599ce20bfb90b2bc410cef480b0dc3784
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext