General
-
Target
DHL Notification_pdf.exe
-
Size
836KB
-
Sample
221206-hs93magg5w
-
MD5
235408aa1ab6134b378246f863f0b305
-
SHA1
79683e71665009f608176c5dda986cf5fe79313c
-
SHA256
f740610774f6f97c82a45cdb50f0bec8f98e4e7dc7d26d9ab097c35b3a92bee6
-
SHA512
d22e0eb36032d26e1ea42f51669c6db24355b91ba2d543488b28de5359915378e726a8ab991db76230f54f719b420629063324db39136b74ac77c7648d3f3ba0
-
SSDEEP
12288:UcVxepxE+ZhbKodRLRkW2LkKQmndPN7jmaxgKZ/nXt7virmWhlGLaQYI:vvcbXbbLRkWSv1
Malware Config
Extracted
formbook
4.1
j17j
playphf.live
solarthinfilmtec.com
gdhaoshan.com
posh-designs.com
369andrewst.com
doverupblications.com
hengshangmei.com
decungo.com
checksinthemaiil.com
4localde.com
wetakeoveryourhousepayments.com
overcharge-center.com
mmmmmboulder.com
almaszarrin.net
enterpriseturkey.com
lanierfurniture.com
lhzb726-gw021.vip
onuiol.com
dmitrytodosyev.com
117uuu.com
Targets
-
-
Target
DHL Notification_pdf.exe
-
Size
836KB
-
MD5
235408aa1ab6134b378246f863f0b305
-
SHA1
79683e71665009f608176c5dda986cf5fe79313c
-
SHA256
f740610774f6f97c82a45cdb50f0bec8f98e4e7dc7d26d9ab097c35b3a92bee6
-
SHA512
d22e0eb36032d26e1ea42f51669c6db24355b91ba2d543488b28de5359915378e726a8ab991db76230f54f719b420629063324db39136b74ac77c7648d3f3ba0
-
SSDEEP
12288:UcVxepxE+ZhbKodRLRkW2LkKQmndPN7jmaxgKZ/nXt7virmWhlGLaQYI:vvcbXbbLRkWSv1
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext
-