General
-
Target
AWB 9899691012 Clearance Doc_pdf.exe
-
Size
868KB
-
Sample
221207-h28wxseg94
-
MD5
a37e262817ae3d053fc1687173ecb232
-
SHA1
815fa3fd46df27605ba8b20798b97fb1bb6aa022
-
SHA256
ea2ae64afb2fe6c21176ec595cc4036a184e16c700c312aa8efa4280ab27c2c3
-
SHA512
50cb991d722c5c026d4bbd1e1b6efe3b4c70dc84cf64b451dc396a9c5962acf25c2a6a0f47b941395177ce8578156e5a759bb9a0edc4288de7f8e068eb7e8507
-
SSDEEP
12288:9oQgKZ/nXt7virmWhlGLaQYIHB2XzVqX/EwHVZuGkwDGnvPeYEVbW3wFV/T6oBt3:BeVqsit8nOlS3wFFOoBtbl
Malware Config
Extracted
formbook
4.1
j17j
playphf.live
solarthinfilmtec.com
gdhaoshan.com
posh-designs.com
369andrewst.com
doverupblications.com
hengshangmei.com
decungo.com
checksinthemaiil.com
4localde.com
wetakeoveryourhousepayments.com
overcharge-center.com
mmmmmboulder.com
almaszarrin.net
enterpriseturkey.com
lanierfurniture.com
lhzb726-gw021.vip
onuiol.com
dmitrytodosyev.com
117uuu.com
Targets
-
-
Target
AWB 9899691012 Clearance Doc_pdf.exe
-
Size
868KB
-
MD5
a37e262817ae3d053fc1687173ecb232
-
SHA1
815fa3fd46df27605ba8b20798b97fb1bb6aa022
-
SHA256
ea2ae64afb2fe6c21176ec595cc4036a184e16c700c312aa8efa4280ab27c2c3
-
SHA512
50cb991d722c5c026d4bbd1e1b6efe3b4c70dc84cf64b451dc396a9c5962acf25c2a6a0f47b941395177ce8578156e5a759bb9a0edc4288de7f8e068eb7e8507
-
SSDEEP
12288:9oQgKZ/nXt7virmWhlGLaQYIHB2XzVqX/EwHVZuGkwDGnvPeYEVbW3wFV/T6oBt3:BeVqsit8nOlS3wFFOoBtbl
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-