General
- Target Product Inquiry - PFIZER 05.22.2023.exe
- Size 685KB
- Sample230522-kpv6eahh61
- SHA256 6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
- MD5 d63cfdc43ab25f47b84b2bc2e4002ff1
- SHA1 ee87801c70a1db156cedeb31738a5da39cff1dad
- SHA512 1b9fe4d3ed53ddf14f7e927bf1d6fcae58565e23bcc6c3b840f67e848961e8ce63388e01489a98c865ce7615747ab568cad1ab7d0ca79b5b29d892af1179e1ff
- SSDEEP 12288:GtYx0YPX/NqPsZ0wF9Os3QBtFcqNbttGnQaemdbhIoQC1BmEnq+m:GtPHPs+wKsqbtTaTJrBvx
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
Product Inquiry - PFIZER 05.22.2023.exe
Resource
win7-20230220-en
Malware Config
Extracted
-
formbook
-
4.1
-
ca82
-
joins-israel.com
-
suffolksheep.net
-
audiservisi.online
-
lomasleisuregas.co.uk
-
bbyuanzhi.com
-
asapmotohub.com
-
witneshambarleymow.co.uk
-
krmediaagency.com
-
alfonsoscuottosrl.net
-
cabsforrental.com
-
drx72.com
-
allegories-bunk.click
-
aladdinhouseofkabobgyros.com
-
glhbsy.com
-
mummytwinzsolutions.africa
-
bwin455.com
-
7fea.site
-
czwjjgcbearing.com
-
giwamfbank.africa
-
iweb4logmt.com
-
prostitutkikostromyfine.com
-
crpons.xyz
-
publibague.com
-
dirtyalternatives.co.uk
-
dularideias.com
-
jhallenterprise.com
-
asia-fuhui.com
-
hitznaija.africa
-
kingcudzy.com
-
boxparrtners.com
-
laptops-95442.com
-
quadracrypto.com
-
2024medicarbenefits.com
-
lakotathreads.com
-
905c.site
-
hanningtonlogs.co.uk
-
aotogps.com
-
pure-shine.co.uk
-
eaglesecuref.support
-
mrembo-oil.com
-
four-vhg.cfd
-
cabinetbuildersinbatonrouge.com
-
logisticsdhltimeca.info
-
ebusinesshost.biz
-
eldosre.store
-
ky10088.com
-
wysesustainability.uk
-
hayanatalim.com
-
getsaleskit.biz
-
ahemr.com
-
couplerckk.com
-
fzjinyebz.com
-
bigosai.com
-
khatibi.co.uk
-
carolineguihaire.com
-
benkavilla.com
-
kevinaccorinti.com
-
atamanaphoto.com
-
emprenderconglobos.com
-
houseofwellnesstherapies.com
-
healthusinsurance.com
-
decadeshits.com
-
cleanlightksa.com
-
davidterron.co.uk
-
bangaloreescortscity.com
Targets
-
- Target Product Inquiry - PFIZER 05.22.2023.exe
- Size 685KB
- SHA256 6ea7ca3a65d2621c8a9c7502eb9a7f914d5a155a3791e551cc3308f638ea307c
- MD5 d63cfdc43ab25f47b84b2bc2e4002ff1
- SHA1 ee87801c70a1db156cedeb31738a5da39cff1dad
- SHA512 1b9fe4d3ed53ddf14f7e927bf1d6fcae58565e23bcc6c3b840f67e848961e8ce63388e01489a98c865ce7615747ab568cad1ab7d0ca79b5b29d892af1179e1ff
- SSDEEP 12288:GtYx0YPX/NqPsZ0wF9Os3QBtFcqNbttGnQaemdbhIoQC1BmEnq+m:GtPHPs+wKsqbtTaTJrBvx
- MD5 SHA1 SHA512 SSDEEP
-
Formbook payload
-
Deletes itself
-
Suspicious use of SetThreadContext