General
- Target Proforma Fatura INV98767894.PDF.exe
- Size 810KB
- Sample210426-d2rdqmc2ys
- SHA256 738ab100dc0c1db979bc68b02da95d90f59b0da83a5f4fb89d6c140ffac1517b
- MD5 5b1814c64162e0f7c74dd26d40f1e455
- SHA1 961ab178f34ac8ae6f83e91b3b2a8066a2242ff5
- SHA512 3cdfa3300ec550648f360145132e23e5a2bc9eb8928cb8ac6418c93a510a604ef10cf5617e542ad78402f235d9bcd101c870efa1e11c0df5d5b11ef94a6a59bd
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Fatura INV98767894.PDF.exe
Resource
win7v20210408
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.supinapp.com/grv/
-
morganofatlanta.com
-
vz473.com
-
hengetelt.com
-
bailcally.com
-
virtuosoonline.com
-
tenthousandli.com
-
ohanamascota.com
-
digi-plates.com
-
prismagtech.com
-
we-cinema.com
-
372680.com
-
smartautoexpert.xyz
-
mrxzg.com
-
apartment-brussels.com
-
reverseincubator.com
-
linkasean.com
-
yummicrabva.com
-
diguchaye.com
-
reaktorfatura.com
-
thecatsaysno.com
-
mpgcommunications.net
-
lindustrieetleca.com
-
seosansar.com
-
alohalily.com
-
novergi.com
-
universityincanada.info
-
atrocity.xyz
-
johnsonballoonblessings.com
-
laurelmcintosh.com
-
nubedepalabras.com
-
ycmath.com
-
daveysdestinations.com
-
yourgutterguru.com
-
mayas.website
-
bessgarments.com
-
xhegu.com
-
mybusinessdoor.com
-
vivaceactivewear.com
-
nongyan.net
-
tgi-mail.net
-
j999a.com
-
slteka.com
-
pikipikiit.com
-
as0594.com
-
insuremydriverslicense.com
-
kclundsblades.com
-
haircleanerpro.com
-
charlesnwahiwe.com
-
ervoth.com
-
authentiekinnovations.com
-
molvmg.icu
-
xn--k1abtc6be.xn--p1acf
-
arm-srl.com
-
hood2healer.com
-
austinchapter7.com
-
clarityentct.com
-
bryllaw.com
-
twinworksllc.com
-
top-trend.website
-
rueschlink.com
-
oogilab.com
-
thewritersbookshelf.com
-
jademarkproducts.com
-
400city.com
Targets
-
- Target Proforma Fatura INV98767894.PDF.exe
- Size 810KB
- SHA256 738ab100dc0c1db979bc68b02da95d90f59b0da83a5f4fb89d6c140ffac1517b
- MD5 5b1814c64162e0f7c74dd26d40f1e455
- SHA1 961ab178f34ac8ae6f83e91b3b2a8066a2242ff5
- SHA512 3cdfa3300ec550648f360145132e23e5a2bc9eb8928cb8ac6418c93a510a604ef10cf5617e542ad78402f235d9bcd101c870efa1e11c0df5d5b11ef94a6a59bd
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext