Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Sipariş formu 07.14.exe
-
Size
263KB
-
Sample
230714-pgmlhsed9x
-
MD5
719c522aec409b51c6868a77f80b6fa8
-
SHA1
416357c9f7ecc7e9a6e70e3703075f53846f176f
-
SHA256
7bf47a92fadd875caa70db94a8ef153f7e63296357619e23a27b2d4e0a6a2bde
-
SHA512
3bd2455092e7ed61838737f68c83e7f4e555dcd92a0a975eb4acff6dd9a08f3986d48afe82d563d8c3db0d1068801b370ad20b3ed517547ed74845a2f1249046
-
SSDEEP
6144:vYa6ZSSel/J61D4l7EMPHf6G+MDtSSfS606DHTtw7mkNlVxv4ODw:vYrvoJg6diG+MDG60OHTtw7mkZxvu
Static task
static1
Behavioral task
behavioral1
Sample
Sipariş formu 07.14.exe
Resource
win7-20230712-en
Malware Config
Extracted
formbook
4.1
b0y4
cayocabana.com
handbholidaylighting.com
bombastickmast.com
engageandexceltutoring.com
acdaiucdac.com
alfahifurniture.com
ageingxx.com
app-fintoch.com
quintanaatverde.com
theimperfectangel.com
usvisa-infu.com
774495.com
betjogue.com
jil-fashion.com
luxury-developments.com
tonestarconsulting.com
betonlineaustralia.com
oldglorywineandwhiskey.com
pemimmobiliare.com
carefourexpress.com
jx2grenier.com
myhealthsmartmove.com
jumpstartagent.com
pmstaffingllc.com
truetailed.com
1lhd.com
healthymedication.com
mop-in-motion.com
apps4parking.com
talkthepod.com
weixinrobots.com
dydolphinhof.com
korumetal.com
sywlsw.com
antriansalamun.com
5778777.com
5dp5dt.com
okhydrwhcqdyz.com
lacosyte.com
tiny-frames.com
jcrewct.com
mission-drone.com
toddsnymagazineder.com
hikuiaroe.com
one-john.com
wesleyhutchins.com
zilaso.xyz
alphataxfiler.com
growthackbay.com
satoo-blog.com
johnwilsoncontracting.com
qiandaoyuan.com
stotalav.com
kwycivzmr.com
wemeowz.com
amityequity.com
michaeldemskojr.com
tororancho.com
5069xcc.com
maygolfcartstag.com
undawn-wiki.com
turningauthority.com
docto360.com
waterdropfnilter.com
polybreadphx.com
Targets
-
-
Target
Sipariş formu 07.14.exe
-
Size
263KB
-
MD5
719c522aec409b51c6868a77f80b6fa8
-
SHA1
416357c9f7ecc7e9a6e70e3703075f53846f176f
-
SHA256
7bf47a92fadd875caa70db94a8ef153f7e63296357619e23a27b2d4e0a6a2bde
-
SHA512
3bd2455092e7ed61838737f68c83e7f4e555dcd92a0a975eb4acff6dd9a08f3986d48afe82d563d8c3db0d1068801b370ad20b3ed517547ed74845a2f1249046
-
SSDEEP
6144:vYa6ZSSel/J61D4l7EMPHf6G+MDtSSfS606DHTtw7mkNlVxv4ODw:vYrvoJg6diG+MDG60OHTtw7mkZxvu
-
Formbook payload
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-