General
- Target PO.21322.pdf.exe
- Size 1013KB
- Sample220321-xvx86sdeg4
- SHA256 def9b0d4675814fa8872b848059fcc239915fe71bb363685d495ebf799c9bfc4
- MD5 a88257c684704ac5a44ca7d5761033d9
- SHA1 e00e7129ecf5687d8a56c57615872e7263982733
- SHA512 d5c83ee85089f9573cca57f0efbf7d19dc92c1d92eca7b96e4cb6824cc6dd69a87ce36a622b793e7aa2509af59f8ddc5e2888bb26ce9e2c822989ccd3b73dd1d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
PO.21322.pdf.exe
Resource
win7-20220311-en
Malware Config
Extracted
-
formbook
-
4.1
-
a30t
-
nietru.icu
-
saudiafc.com
-
8120567.com
-
grundrow.site
-
tsinversiones.com
-
sytgzx.com
-
hannoschoeck.online
-
cerdacapital.com
-
mastercard-tz.com
-
asupermarkt.store
-
carmobility.online
-
estudiocontablegrados.com
-
downtis.online
-
kingdomdefensesystems.net
-
mw.sbs
-
aiotrip.com
-
decentralcase.com
-
intentionallivingwithmeb.com
-
administratorlope.site
-
uc-un.com
-
ihdigitel.club
-
toshitoushi.net
-
feednewers.com
-
jameswaynejohnson.com
-
mondeumspdr.com
-
sundaeswapo.finance
-
geosmartcities.com
-
onesystemcareutil.com
-
filmintaos.com
-
8ballindustries.com
-
wautomagymnastics.com
-
nalmefeneforhcps.com
-
yumchinaholdings.com
-
guanmaiyouxuan.net
-
thinhnguyendinh.com
-
edelsteinco.com
-
popunews.com
-
vipreasonableservice.online
-
hvzxix.icu
-
decodiseno.net
-
mystewardconnect.net
-
stkents.com
-
activeframe.site
-
adventreflection.com
-
techswipes.com
-
crclaxmiwadi.com
-
mscworldwidenulakir.info
-
ultimatemusiccity.com
-
nayapal.com
-
infinity4g.net
-
xn--dck9cn3g6f.com
-
themom.show
-
ddqhig.icu
-
kledge.space
-
y9vf6kmqcuui5.com
-
course-fabulous.sbs
-
suleyrostro.com
-
riskomatics.com
-
fixfz.com
-
ecids.network
-
truetickets.sucks
-
ochajapones.site
-
puellaline.com
-
angel-makers.com
-
ino92vationproject.tech
Targets
-
- Target PO.21322.pdf.exe
- Size 1013KB
- SHA256 def9b0d4675814fa8872b848059fcc239915fe71bb363685d495ebf799c9bfc4
- MD5 a88257c684704ac5a44ca7d5761033d9
- SHA1 e00e7129ecf5687d8a56c57615872e7263982733
- SHA512 d5c83ee85089f9573cca57f0efbf7d19dc92c1d92eca7b96e4cb6824cc6dd69a87ce36a622b793e7aa2509af59f8ddc5e2888bb26ce9e2c822989ccd3b73dd1d
- MD5 SHA1 SHA512
-
Formbook Payload
-
Suspicious use of SetThreadContext