General
-
Target
Urgent quote request -pdf-.exe
-
Size
812KB
-
Sample
221128-pmq6wsha4v
-
MD5
ce411b2f7dfd407c1a546e160193b55d
-
SHA1
c061262cf1a7999d7ee59694dd0c8bb570987e02
-
SHA256
8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef
-
SHA512
af96c79b2af92840691a777a72e650c0763f0bc20ecd8d1970ac97cdd5048768fbe413dbd7d673f03f53bcace92d517eeb17b9a791c4c29fa4463b6a8c9c51ba
-
SSDEEP
12288:h2D2DHPXsU51ZM0W52nCrgxRzrzbH3sgGJy3i9zxihIg95lvTHRyoY:Q2DPugfrzbHcFJwIohIgvpjRpY
Malware Config
Extracted
formbook
4.1
a24e
flormarine.co.uk
theglazingsquad.uk
konarkpharma.com
maxpropertyfinanceuk.co.uk
jackson-ifc.com
yvonneazevedoimoveis.net
baystella.com
arexbaba.online
trihgd.xyz
filth520571.com
cikpkg.cfd
jakesupport.com
8863365.com
duniaslot777.online
lop3a.com
berkut-clan.ru
lernnavigator.com
elenaisaprincess.co.uk
daimadaquan.xyz
mychirocart.net
Targets
-
-
Target
Urgent quote request -pdf-.exe
-
Size
812KB
-
MD5
ce411b2f7dfd407c1a546e160193b55d
-
SHA1
c061262cf1a7999d7ee59694dd0c8bb570987e02
-
SHA256
8cfdcbcbb0b67c66ebb1c3a4cfb995424a9dc791c13d8df53cea06bcd8c2afef
-
SHA512
af96c79b2af92840691a777a72e650c0763f0bc20ecd8d1970ac97cdd5048768fbe413dbd7d673f03f53bcace92d517eeb17b9a791c4c29fa4463b6a8c9c51ba
-
SSDEEP
12288:h2D2DHPXsU51ZM0W52nCrgxRzrzbH3sgGJy3i9zxihIg95lvTHRyoY:Q2DPugfrzbHcFJwIohIgvpjRpY
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-