General
-
Target
PO986543.doc
-
Size
11KB
-
Sample
221210-krldzsfb99
-
MD5
d670e2d6cb29811a91e7c0e656e29331
-
SHA1
724794cccc05a58c8efe9bca12fb7a9967656dc3
-
SHA256
7349af6dc60588fa3864a72060bd2cb1899e8957c9dc04fd855f7c9a409429d1
-
SHA512
370c147e865abcf944c6e88071d6cd95603af6dd2697dbc6562d46e1ed5839d5f0f3de84ba3309f7ee69195c03c0194ab5d7d23e8087a036a7bd9484cd327dea
-
SSDEEP
192:wPh1sJxeKVr9ZYnoZYFizhXKMqwYwu7tiXjvdqAz7mIzq00sGejbfORR/DzCLe:0oVrcoZeizxKMZf6kBmIzq00habORBOK
Malware Config
Extracted
formbook
4.1
wh23
ow9vyvfee.com
alvis.one
mutantgobz.claims
plynofon.com
southofkingst.store
nuvidamedspa.com
coffeeforyou56.com
opaletechevents.com
momobar.life
abcmousu.com
learnicd-11.com
tipokin.xyz
kahvezevki.com
suratdimond.com
oldartists.best
infoepic.info
mattresslabo.com
skarlmotors.com
cl9319x.xyz
med49app.net
Targets
-
-
Target
PO986543.doc
-
Size
11KB
-
MD5
d670e2d6cb29811a91e7c0e656e29331
-
SHA1
724794cccc05a58c8efe9bca12fb7a9967656dc3
-
SHA256
7349af6dc60588fa3864a72060bd2cb1899e8957c9dc04fd855f7c9a409429d1
-
SHA512
370c147e865abcf944c6e88071d6cd95603af6dd2697dbc6562d46e1ed5839d5f0f3de84ba3309f7ee69195c03c0194ab5d7d23e8087a036a7bd9484cd327dea
-
SSDEEP
192:wPh1sJxeKVr9ZYnoZYFizhXKMqwYwu7tiXjvdqAz7mIzq00sGejbfORR/DzCLe:0oVrcoZeizxKMZf6kBmIzq00habORBOK
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-