General
- Target MEDIFORM S.A COMPANY PROFILE DETAILS.xls.exe
- Size 756KB
- Sample201014-jz9nlat63e
- SHA256 754b53cd03dcc7c3d854a9628e5d01447fd778aae73f7890b5f7527ad4bd76ea
- MD5 ed553d96a277cd4d08995f78d2605f0b
- SHA1 e40657ad4033aeae76b75fd9654b73b4ee0ca068
- SHA512 fc75bb069b326dcf4fae9a858693f058b6dda83b4604f5a590942e0b2ffc263e5b198b6537a39c7e607f7963643edece40080d5940eccb9d0c3d93cae3083ae3
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
MEDIFORM S.A COMPANY PROFILE DETAILS.xls.exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.tripleacafe.com/aqu2/
-
chinashoesbag.com
-
spook.info
-
phoenixenergy.solar
-
upgreen.net
-
bmrshop.com
-
peterbiltredovalcertified.com
-
bookiedestination.com
-
cancermancan.com
-
xn--fckbar-wxa.com
-
leapsdistribution.net
-
browstify.com
-
thepodscars.com
-
doctertweack.com
-
shxhkx.com
-
managersascent.com
-
smithcoulsondesign.com
-
400wg.com
-
vogue-attire.com
-
lemondedebelle.com
-
priyanku.com
-
mhscdnv5.club
-
ladsereuyrlsp-online.com
-
serv-re-attamptlogin.net
-
thegrumpynerd.com
-
missphil.com
-
ijebusconnect.com
-
almaty.life
-
blingsunglasses.com
-
felicidadeautonoma.com
-
spiritualgroundscoffee.com
-
bettinaceramica.com
-
zz2scmm.com
-
metroeastinjury.com
-
antilogy.site
-
caribbanreflections.com
-
realtyworldpc.com
-
bcpdrinc.com
-
3927199.com
-
elevated.productions
-
jmconcretepros.com
-
magentnew.com
-
chinaballoonmall.com
-
electric-car-for-kids.com
-
todayonly9.info
-
gg-hosted.com
-
2329967.com
-
sociomex.com
-
epicjetskis.net
-
butikevankara.com
-
superhappyfuntimes.net
-
experileap.com
-
globalnewsacademy.com
-
csraknives.com
-
acrylicmadeeasy.com
-
topheadlinestowitnesstoday.info
-
staymix.net
-
cannavation.care
-
cornerstonehealthcenter.net
-
e-zapptraincontrol.com
-
territory3.academy
-
piattellibreakout.com
-
dennishorseradish.net
-
bcd-jeux.com
-
blemishedaquabots.com
Targets
-
- Target MEDIFORM S.A COMPANY PROFILE DETAILS.xls.exe
- Size 756KB
- SHA256 754b53cd03dcc7c3d854a9628e5d01447fd778aae73f7890b5f7527ad4bd76ea
- MD5 ed553d96a277cd4d08995f78d2605f0b
- SHA1 e40657ad4033aeae76b75fd9654b73b4ee0ca068
- SHA512 fc75bb069b326dcf4fae9a858693f058b6dda83b4604f5a590942e0b2ffc263e5b198b6537a39c7e607f7963643edece40080d5940eccb9d0c3d93cae3083ae3
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext