General
-
Target
RFQ PC25-1301 Product Specifications_PDF.7z
-
Size
907KB
-
Sample
250122-nqm3zavjat
-
MD5
f21647a476af0f9466128731728981d8
-
SHA1
b32f1ed4f76f6f22639eafef0d5f69ad1a0df7c0
-
SHA256
464542b95e9bff226a82674f3ca757a9ab87389b7f3a02810b9c510872445e72
-
SHA512
4e3b19ad1e7af1d8d4b9ea5900955490e9f8d1d641fc78b864e911298ff28485b338805faebbcb3dcfbfa5e9a10df741658abd7690edc2fc16b3d42b8456627b
-
SSDEEP
12288:bfNkEF94HpCjZK6JzLfSdx4G4vrtrfI30QkNo2tm0e91RGk09wNu1Hm1OwFigGUQ:xkCZKWfSxsvrJI3GoYe3R8gCg7EvVRzP
Malware Config
Extracted
formbook
4.1
hwu6
lf758.vip
locerin-hair.shop
vytech.net
pet-insurance-intl-7990489.live
thepolithat.buzz
d66dr114gl.bond
suv-deals-49508.bond
job-offer-53922.bond
drstone1.click
lebahsemesta57.click
olmanihousel.shop
piedmontcsb.info
trisula888x.top
66sodovna.net
dental-implants-83810.bond
imxtld.club
frozenpines.net
ffgzgbl.xyz
tlc7z.rest
alexismuller.design
Targets
-
-
Target
RFQ PC25-1301 Product Specifications_PDF.7z
-
Size
907KB
-
MD5
f21647a476af0f9466128731728981d8
-
SHA1
b32f1ed4f76f6f22639eafef0d5f69ad1a0df7c0
-
SHA256
464542b95e9bff226a82674f3ca757a9ab87389b7f3a02810b9c510872445e72
-
SHA512
4e3b19ad1e7af1d8d4b9ea5900955490e9f8d1d641fc78b864e911298ff28485b338805faebbcb3dcfbfa5e9a10df741658abd7690edc2fc16b3d42b8456627b
-
SSDEEP
12288:bfNkEF94HpCjZK6JzLfSdx4G4vrtrfI30QkNo2tm0e91RGk09wNu1Hm1OwFigGUQ:xkCZKWfSxsvrJI3GoYe3R8gCg7EvVRzP
Score1/10 -
-
-
Target
RFQ PC25-1301 Product Specifications_PDF.exe
-
Size
1.7MB
-
MD5
da15d5729ee365d537292b7b3bcebfbc
-
SHA1
5ab6062a1f2baf4b9785b08975ccdf4c52ee730d
-
SHA256
c7a1dff9b1cc12833d92df185e2e52fb3d5da32078bb8cf4ea65ae9fb53a00c3
-
SHA512
d3c0bfba6150e878dab25a29c4d88569b82757e6bb85e06c98d436e1ba1a6f76ba4c4aa2837aed03c66414af22d36963a29173a5b852c5082d6183df151c154f
-
SSDEEP
24576:ctb20pkaCqT5TBWgNQ7aPVOpJ2rLAjghtte6RLgbc7HfG6A:FVg5tQ7atOpDkhHe6gbQ+5
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook family
-
Formbook payload
-
Suspicious use of SetThreadContext
-