General
- Target Mediform S.A Order Specification Requirement.xls.exe
- Size 717KB
- Sample201014-rel5za659a
- SHA256 0040dd5bbff90801dacfa809df431ebbf40ea1008eebe95fbeb718433bfe71cc
- MD5 291bd6d7a655d6b096922115199965af
- SHA1 64630352ea7e53fc93a0f5ecea9d7697b0e7d146
- SHA512 e81d04a59183763f79b3af3ec489a0dccff0c1d9aa1a5140554de36aa022aa9b3701e5752ab7c534b890973810faac4f42bc176aaa4ea4680b4fe10574f94089
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Mediform S.A Order Specification Requirement.xls.exe
Resource
win7
Malware Config
Extracted
-
formbook
-
http://www.tripleacafe.com/aqu2/
-
chinashoesbag.com
-
spook.info
-
phoenixenergy.solar
-
upgreen.net
-
bmrshop.com
-
peterbiltredovalcertified.com
-
bookiedestination.com
-
cancermancan.com
-
xn--fckbar-wxa.com
-
leapsdistribution.net
-
browstify.com
-
thepodscars.com
-
doctertweack.com
-
shxhkx.com
-
managersascent.com
-
smithcoulsondesign.com
-
400wg.com
-
vogue-attire.com
-
lemondedebelle.com
-
priyanku.com
-
mhscdnv5.club
-
ladsereuyrlsp-online.com
-
serv-re-attamptlogin.net
-
thegrumpynerd.com
-
missphil.com
-
ijebusconnect.com
-
almaty.life
-
blingsunglasses.com
-
felicidadeautonoma.com
-
spiritualgroundscoffee.com
-
bettinaceramica.com
-
zz2scmm.com
-
metroeastinjury.com
-
antilogy.site
-
caribbanreflections.com
-
realtyworldpc.com
-
bcpdrinc.com
-
3927199.com
-
elevated.productions
-
jmconcretepros.com
-
magentnew.com
-
chinaballoonmall.com
-
electric-car-for-kids.com
-
todayonly9.info
-
gg-hosted.com
-
2329967.com
-
sociomex.com
-
epicjetskis.net
-
butikevankara.com
-
superhappyfuntimes.net
-
experileap.com
-
globalnewsacademy.com
-
csraknives.com
-
acrylicmadeeasy.com
-
topheadlinestowitnesstoday.info
-
staymix.net
-
cannavation.care
-
cornerstonehealthcenter.net
-
e-zapptraincontrol.com
-
territory3.academy
-
piattellibreakout.com
-
dennishorseradish.net
-
bcd-jeux.com
-
blemishedaquabots.com
Targets
-
- Target Mediform S.A Order Specification Requirement.xls.exe
- Size 717KB
- SHA256 0040dd5bbff90801dacfa809df431ebbf40ea1008eebe95fbeb718433bfe71cc
- MD5 291bd6d7a655d6b096922115199965af
- SHA1 64630352ea7e53fc93a0f5ecea9d7697b0e7d146
- SHA512 e81d04a59183763f79b3af3ec489a0dccff0c1d9aa1a5140554de36aa022aa9b3701e5752ab7c534b890973810faac4f42bc176aaa4ea4680b4fe10574f94089
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext