General
-
Target
payment proof.exe
-
Size
493KB
-
Sample
220731-cvpxksddg6
-
MD5
5761413bffd820c6eada5b1e818260c8
-
SHA1
0c5f8e8c6de6a21c2e1659af85437bad13ca5f4d
-
SHA256
63937c9c934258896ea48860dca52f4e3b3838221798a688d3b7b5b4dfe0e2be
-
SHA512
c859769c25f0027e48a18260addab4b58aea319a652d49eac5dccd9ae515ad877f115f257aa5208e1742260eb328236f3ed7f726e933779a383e8b14b3ab34b7
Static task
static1
Behavioral task
behavioral1
Sample
payment proof.exe
Resource
win7-20220715-en
Malware Config
Extracted
formbook
4.1
d27e
yourfitplan.online
the-arches.wales
shesashemale.com
genesisairsystemsltd.com
superpanoramas.com
kaixinzx.com
blockchainfacil.com
migstrip.online
fightfentanyl.net
triviabritannica.site
eineetnocni.xyz
danibrito.com
ghostmacro.com
livechat-online.site
adriftontonka.com
iloveuae.mobi
miaescorts.com
taxrulings.com
aobo123.top
nostosmma.com
2203.site
taihen.tech
tennistimecroftschool.com
coalmarket.solutions
tropicalbankonline.com
ttbook.site
gobaturguide.com
cy.codes
frinnect.com
capricongroup.com
howtodown.top
backtoschool.store
messagetraining.com
aristocrathomewares.com
tt-track5.xyz
angbaixun.com
elixiragency.net
bioguesser.com
artisanwelshfood.cymru
yourweekendsback.com
africansolarfund.com
gebboo.com
findikajans.com
fbasaglia.online
izmittekstil.com
paullholmetower.org.uk
pacinottis.co.uk
himapersis.id
storpinekrc.xyz
fundamarkets.com
rapidhacks.online
d4tx.com
manuakhariya.world
graduationcardstore.com
lkslippers.top
diseek.com
badassblankie.com
bnttc.com
ray-ee.com
newsgeinou.com
nimsso19.online
vibingwithdjs.net
xubiyc2wupps.site
payment4632669.xyz
afinix.uk
Targets
-
-
Target
payment proof.exe
-
Size
493KB
-
MD5
5761413bffd820c6eada5b1e818260c8
-
SHA1
0c5f8e8c6de6a21c2e1659af85437bad13ca5f4d
-
SHA256
63937c9c934258896ea48860dca52f4e3b3838221798a688d3b7b5b4dfe0e2be
-
SHA512
c859769c25f0027e48a18260addab4b58aea319a652d49eac5dccd9ae515ad877f115f257aa5208e1742260eb328236f3ed7f726e933779a383e8b14b3ab34b7
-
Formbook payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-