Overview

overview

10

Static

static

3

Ordern de ...df.exe

windows7-x64

10

Ordern de ...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15012025_0809_Ordern de Compra 1662240.pdf.exe.iso

  • Size

    1.2MB

  • Sample

    250115-j2czxsykck

  • MD5

    9258970423958bd4a0e18f9644288771

  • SHA1

    7c82c8b8323ac8f9d519e618b874993fd33b461a

  • SHA256

    d8b790f9e5f3be484cb7efb10189977b9cda851c45a0c9b481f75bf080d164b8

  • SHA512

    ecb48f073de523573f970cfa52f855633aa2a6e61240084a5054b4c29a0ad0d286e07c0d003b74ed90a889c684b956d061834f5c54e57f0838befa8202c47b48

  • SSDEEP

    12288:xC5kuL5sl1uUpltxHyWh28aiiyCDQxK/3CdrTxCpjawHgXY0cvuH+xmj40:xo6l1uUXtxSWXaiXLd4r+YQH40

Score
10/10
formbooks94pdiscoveryratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

s94p

Decoy

akeimpact.xyz

obsters.online

lsnmarketing.info

mm789.xyz

lack-loan-1232998.fyi

aaafsaneh1.info

nsurance-59975.bond

itricboost.cloud

0011997.xyz

st3jr71.world

winkletown3.store

imhell.cyou

nfluencer-marketing-72763.bond

etirement-plans-42889.bond

ugar-test-lab-near-me.today

llseasoncleaning.net

ksoftware.info

lientfirst.xyz

aatahmineh-inter5.rest

lsolutions.xyz

Targets

    • Target

      Ordern de Compra 1662240.pdf.exe

    • Size

      647KB

    • MD5

      7ee3a5a28cdfddd13f881bfa0721608f

    • SHA1

      8b6c176824206b8c821281a6c9fab76b07f444eb

    • SHA256

      9b5e8c99db5b9a25c51d190a34c764dae1573ff0231e294cccbd74a708b1d0dc

    • SHA512

      5e9468dd64167e308e2744d4e43accd84bf3b0ffb71b5c1fa9c93b7413978a591a167bbdc6441baa42faccc3c187fe57d662fc686059807b2703d1ecc2d8817a

    • SSDEEP

      12288:CC5kuL5sl1uUpltxHyWh28aiiyCDQxK/3CdrTxCpjawHgXY0cvuH+xmj40:Co6l1uUXtxSWXaiXLd4r+YQH40

    Score
    10/10
    formbooks94pdiscoveryratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook family

      formbook

    • Formbook payload

      rat

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks