General
-
Target
ncopia_della_richiesta_PDF_exe.xz
-
Size
294KB
-
Sample
230619-wxk6ysgf51
-
MD5
f08796344aab6d080197de73a089e441
-
SHA1
8249b39e3b3a68ed43a26453390e62ea89a3b15c
-
SHA256
ff484f716796a61f6448c1f060de1129c063777c5370053aef71eb0f0c84b396
-
SHA512
cf39e5334907a4c0b3ad0a9662485e42021a67d10afb613944a2459d88b426985751aa9f5bb7e53d2877411881f4bbc5a924afaaaaa70e533fc836faa474de2f
-
SSDEEP
6144:Oy6s42F812J1aGQY6EdQyS/dWxCnvRhQZ8w3YK0QugYYpWHGmpqG1e:EsBG1yV0dWxCnvRmIK0QNYLgGI
Static task
static1
Behavioral task
behavioral1
Sample
ncopia_della_richiesta_PDF_exe.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ncopia_della_richiesta_PDF_exe.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
formbook
4.1
t3c9
shadeshmarriagemedia.com
e-russ.com
sofiashome.com
theworriedwell.com
americantechfront.com
seasonssparkling.com
maximuscanada.net
tifin-private-markets.com
amecc2.net
xuexi22.icu
injectiontek.com
enrrocastoneimports.com
marvelouslightcandleco.com
eaamedia.com
pmediaerp.com
tikivips111.com
chesterfieldcleaningcare.com
thecrowdedtablemusic.com
duncanvillepanthers.com
floriculturajoinville.xyz
bestcleaningagent.com
blackpartyplanners.online
atlanticphotovideo.com
welfarewith.com
vsesvezhie.online
kingballyeg.com
onanshop.com
navarathnatemple.com
tajcostore.com
bittoastergames.com
brasswork.info
92luoli.top
neuroimagingai.com
travisheightspartners.com
securelifestyles21.net
toydrumhosting.com
a-2-zwholesale.com
mnehbr.cloud
hot51.one
3g10v4jwti2tur96.digital
barbosasilvaadv.com
addidas.me
onpu.sa.com
pienso-mascotas.com
brinkmicro.com
mari4731.com
redtocsin.com
tarponspringshandyman.com
shknote.com
jacksonholekush.com
thephilosophyacademy.com
gsolartech.com
oferstar.com
earlyrepeal.online
medi-vacations.net
bigredsellshomes.com
bonitageeks.icu
bossingh.xyz
shanghaizang.com
maisonlectio.com
monktech.xyz
hsmm999.com
bateful.com
billiondollar.company
millesimevintage.com
Targets
-
-
Target
ncopia_della_richiesta_PDF_exe
-
Size
765KB
-
MD5
6e8e90bf7aca0f8dfe34677650241d38
-
SHA1
b70843655e29c3da8818ef3559bd4266da1bde3d
-
SHA256
21e7cb5b28421ec52257e62cbecffb48edf4c8fe2e187cf9459aa18bc965ce20
-
SHA512
b88af3aaaafb50911da236d68b6bdd575032dafd009aba8ebb2d53a340c5362163ee65a0ceaf044ce9de25eacf0bdb68af2dd56fc77d4e1543edbb8742faa039
-
SSDEEP
12288:NEdx8epMpDHeLp0ewAKOXCYfPHEl20/WAN9PuCCJQppO70an:NIdytHe1hFXfPHAxPa7b
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-