General
-
Target
LMZ302589545։2024_0613․PDF.exe
-
Size
749KB
-
Sample
240613-ndeaaszhjq
-
MD5
d039548253b116d4f94f0925df4ed528
-
SHA1
768a9ca8dee8c5159a3fc73835fb3c0b39d02b54
-
SHA256
29e0c211687e215278459854735e3712f4095a33c5499b23643357faa8fc3d31
-
SHA512
f09ac66e888147df4145b156030f629d1628e5438ce29f601799c57a28988a6f35ae9d6cc6110218b2862cccd6fd2bc6036b6fc8cc1ffb715f496b1bad82fa55
-
SSDEEP
12288:KlykMyCK2xrOoZFWYOiblMRwkHUK/4S3soZ7CxE9i+ChEpdSdYpzltAOUhM2Gyrt:kMyC5XWYO9wC/HXZ7DWSSD
Static task
static1
Behavioral task
behavioral1
Sample
LMZ302589545։2024_0613․PDF.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
LMZ302589545։2024_0613․PDF.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
formbook
4.1
dn03
almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
bakuusa.online
sabong-web.com
52cg2.club
jasonnutter.golf
odbet555.app
vipmotoryatkiralama.com
auravibeslighting.com
pulsesautos.com
imdcaam.com
vivaness.club
bovverbadges.com
giaydonghai.online
aditi-jobs.com
numericalsemantics.com
shoprazorlaser.com
lovedacademy.com
gets-lnds.io
teyo293.xyz
banditsolana.com
delivery-jobs-76134.bond
ppp5716.buzz
zjmeterial.com
de-ponqk.top
bntyr76rhg.top
servicepmgtl.world
nailtimelocust.top
paperappa.com
80sos.com
daysofbetting.com
slaytheday.fun
travauxdefou.com
bx2zyg.com
thecoxnews.com
qriskaq.com
top-dao.com
krstockly1.shop
roiwholesale.com
pajero777ads.click
twistedrubytx.com
thesovreignkingdomofmaui.info
cataclysmicgamingapparel.com
verxop.xyz
xn--kwra1023b.com
winterclairee.com
sukhiclothing.com
Targets
-
-
Target
LMZ302589545։2024_0613․PDF.exe
-
Size
749KB
-
MD5
d039548253b116d4f94f0925df4ed528
-
SHA1
768a9ca8dee8c5159a3fc73835fb3c0b39d02b54
-
SHA256
29e0c211687e215278459854735e3712f4095a33c5499b23643357faa8fc3d31
-
SHA512
f09ac66e888147df4145b156030f629d1628e5438ce29f601799c57a28988a6f35ae9d6cc6110218b2862cccd6fd2bc6036b6fc8cc1ffb715f496b1bad82fa55
-
SSDEEP
12288:KlykMyCK2xrOoZFWYOiblMRwkHUK/4S3soZ7CxE9i+ChEpdSdYpzltAOUhM2Gyrt:kMyC5XWYO9wC/HXZ7DWSSD
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-