General
-
Target
proforma fatura pdf.exe.xz
-
Size
592KB
-
Sample
230404-q1mlasfd24
-
MD5
0c7ad0070d9de8a1c0439d77210ee72b
-
SHA1
f5065008cc57b286234af885fcbf3c27364fbe6a
-
SHA256
439961c2b322e7e848b165ec3b11fb4a32ce07de28269aa1c7fbec4833e6a115
-
SHA512
fa30338174a186d40631928584228eae11b9db7904249769af6b48a624e7333a0c2ecd16e51a4802c93165f720958ee0bcd926e1ecc0090cc1dbe47c70bb920f
-
SSDEEP
12288:i0x8jbin/yIMa+ZqoyqctCt2bqLFAeTcNU/p5:izw/y7avqcQt+qLyQcu/
Static task
static1
Behavioral task
behavioral1
Sample
proforma fatura pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
proforma fatura pdf.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
formbook
4.1
ges9
lolofestival.store
amzin.info
pulsahokii.xyz
bahiszirve.com
animekoe.com
kansastaxaccountant.net
howgoodisgod.online
medakaravan.xyz
pesmagazine.net
americanpopulist.info
nepalihandicraft.com
mariabakermodeling.com
cavify.top
onlinewoonboulevard.com
furniture-22830.com
ophthalmicpersonneltraining.us
yz1204.com
extrawhite.site
tomo.store
martfind.online
united-bc.com
hethonglikesub.site
goldenstategeneralstore.com
amazdea.com
emiliahernandez.com
weeklyrhino.buzz
erjcbtwg.work
16321.xyz
crainbramp.games
studiochiodi.info
km97.xyz
synertel.site
ankerbios.expert
chipetaresort.com
gakuj.xyz
simmonsguitars.com
povsearcher.com
salesatomizer.app
loopmart.shop
easyonionringrecipe.site
icss.studio
ksamayaiu.xyz
xn--recomindame-gbb.com
bepillow.com
homesinowensboro.com
abrashina.com
dplck.com
michellentherapy.com
voyance.health
zwcl365.com
akroglobal.com
endlessillumination.store
florediemgardens.com
lis-journal.com
justinrichert.net
baschung.swiss
thesexyviking.com
abickofconsulting.com
vivacious713833.com
dental-implants-52958.com
tigaberlian.net
trxtr.xyz
offficebanking-cl.top
huslnfts.xyz
viralcx.com
Targets
-
-
Target
proforma fatura pdf.exe
-
Size
1.0MB
-
MD5
b79748b74930901980f5cbf1153304e4
-
SHA1
5d4f6480d2ef2c4d6b58b2a9d07ca18fd79fcd8a
-
SHA256
bd617c26f17ec917ea38dfcee33c65601efaafe0f13769c6929599505f481ec7
-
SHA512
13704b1f54c5e0d73d6dccda221711e8a8b9d5ae7f4c002377db3d3096076dbde167713a9422e90742f7adf79be1a05d7dc3f1354e16c216ef958c92fdc73a1f
-
SSDEEP
24576:v6R9yfVUXwTEfF59XADz3OjaZQQJ0nhUGfApzLM:v6mO0MF59XADzejakuGfA9M
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-