General
-
Target
DHL Notification_pdf.exe
-
Size
552KB
-
Sample
221201-q8rvzshd8s
-
MD5
460e1ef118f702b193363c520b492e92
-
SHA1
8050b0486439c773c4bab659bcb00b0a8791d534
-
SHA256
59d3d0d82273ee3a78483d3508a8247593a06826f8531de8ca072718e6609598
-
SHA512
f1283ec160231a5ae402a2718a5c0474e2a114d26f13443330a13d468bec408e52643c44c7046d0ae7c4740bb0385bcd94d169562b6443491fa0b97556c50113
-
SSDEEP
6144:GoxvvklriDeObYNny/B4uIr8r9I3ZYhFo6tTExJZmcUUCTO/z45Oq1FqiK0PF0ey:Z9Ynu4zZYhFHKZ+UxzU39jq
Malware Config
Extracted
formbook
4.1
j17j
playphf.live
solarthinfilmtec.com
gdhaoshan.com
posh-designs.com
369andrewst.com
doverupblications.com
hengshangmei.com
decungo.com
checksinthemaiil.com
4localde.com
wetakeoveryourhousepayments.com
overcharge-center.com
mmmmmboulder.com
almaszarrin.net
enterpriseturkey.com
lanierfurniture.com
lhzb726-gw021.vip
onuiol.com
dmitrytodosyev.com
117uuu.com
Targets
-
-
Target
DHL Notification_pdf.exe
-
Size
552KB
-
MD5
460e1ef118f702b193363c520b492e92
-
SHA1
8050b0486439c773c4bab659bcb00b0a8791d534
-
SHA256
59d3d0d82273ee3a78483d3508a8247593a06826f8531de8ca072718e6609598
-
SHA512
f1283ec160231a5ae402a2718a5c0474e2a114d26f13443330a13d468bec408e52643c44c7046d0ae7c4740bb0385bcd94d169562b6443491fa0b97556c50113
-
SSDEEP
6144:GoxvvklriDeObYNny/B4uIr8r9I3ZYhFo6tTExJZmcUUCTO/z45Oq1FqiK0PF0ey:Z9Ynu4zZYhFHKZ+UxzU39jq
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-