General
- Target Swift001622.Scan.pdf..exe
- Size 586KB
- Sample201016-bsemtbn74x
- SHA256 aa7140aa9e404fcab5e45ba552de89669da4446c6a3474f307def1a75a3d37e0
- MD5 60ece7983b52efb4afcda75e1c7577b3
- SHA1 120db235d27b25f14d63a5100300cd09ec87e0c0
- SHA512 bb2f378cf52afdb4682ba3f97f146b4c444d378278963ed1e614228c618ccdfecaf1bff6958dcd8fb9e60b5386900cbaa708db332986efb5474c06075115598b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Swift001622.Scan.pdf..exe
Resource
win7v200722
Malware Config
Extracted
-
formbook
-
http://www.darkatnightgame.com/fgn/
-
kynguyendongho.com
-
seedtoskinnc.com
-
islaplants.com
-
bobbyfarris.com
-
xn--mgbuhw0d7a.com
-
sitestart.site
-
blendedprintz.com
-
honestwholesale.com
-
shuttandco.com
-
iangroupfunnels.com
-
ohanavendors.com
-
matreejewels.com
-
paras.ltd
-
1005cy.com
-
birdiecrane.com
-
dauntlessdigitalmanagement.com
-
wownewtech.net
-
instantpeindia.com
-
toshimaen-uosen.com
-
tlctrueloveconnection.com
-
jfabulousblingz.com
-
bporg.com
-
midifitcamp.com
-
sag-tropez.com
-
funciona-mesmo.men
-
quizcrypto.com
-
efx999.com
-
zmcafa.com
-
tastyhandycandies.com
-
centric-d.com
-
spiritualitywithvee.com
-
satnhomtuandung.com
-
thatdentguy.com
-
progress-party.com
-
login-center-online.network
-
istys.com
-
finance04.com
-
aarthiramamurthy.com
-
tracemypreps.com
-
tamtrangthuocnam.info
-
mshldyx.com
-
paradenge.xyz
-
about-sexy.com
-
windowsthreatcenter.info
-
watchfulelephant.com
-
ysch5.com
-
arthritismobilityexercise.com
-
facemunch.com
-
samex-kv.com
-
vaultequestrian.com
-
minnano-leader-board.com
-
kenanxin.com
-
chengbo.online
-
mingzejiudian.club
-
alpha-roc.net
-
trungtamsuachuanguyenkimvn.com
-
polyrove.com
-
omidtebbi.com
-
qkvah.xyz
-
feetfet.net
-
travel-runway.com
-
6njjuyut.com
-
njcourierpost.com
-
viaholding.com
Targets
-
- Target Swift001622.Scan.pdf..exe
- Size 586KB
- SHA256 aa7140aa9e404fcab5e45ba552de89669da4446c6a3474f307def1a75a3d37e0
- MD5 60ece7983b52efb4afcda75e1c7577b3
- SHA1 120db235d27b25f14d63a5100300cd09ec87e0c0
- SHA512 bb2f378cf52afdb4682ba3f97f146b4c444d378278963ed1e614228c618ccdfecaf1bff6958dcd8fb9e60b5386900cbaa708db332986efb5474c06075115598b
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext