General
-
Target
PO_02.07.2024.PDF.cmd
-
Size
698KB
-
Sample
240702-hqjgwsverk
-
MD5
1cf4467c5f7b2d7b5f01a4b13ccc8764
-
SHA1
3d706295d65cc724c855b94c12ee1b92dcfdd3a2
-
SHA256
ea8e50c8d03fa31169ac6b28528ab73411e2d1a649c1b7ab48b42040d46f2045
-
SHA512
6180048fc1507d349b372cd991150046e83c78cc226a83d9299407b5f342e530f0e084de90d266b23ddcd248cd321bb2851d3c30f8e3c831e83e1291ae56df18
-
SSDEEP
12288:Ou2jSANT3ukfGBZRtJFy82apNn+PudHEpERRgYIAatIksjBfuVtGYhEA3dVkR:0jFT3ukeBZ9Q8H1+uIAaST
Static task
static1
Behavioral task
behavioral1
Sample
PO_02.07.2024.PDF.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
PO_02.07.2024.PDF.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
formbook
4.1
dn03
almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
bakuusa.online
sabong-web.com
52cg2.club
jasonnutter.golf
odbet555.app
vipmotoryatkiralama.com
auravibeslighting.com
pulsesautos.com
imdcaam.com
vivaness.club
bovverbadges.com
giaydonghai.online
aditi-jobs.com
numericalsemantics.com
shoprazorlaser.com
lovedacademy.com
gets-lnds.io
teyo293.xyz
banditsolana.com
delivery-jobs-76134.bond
ppp5716.buzz
zjmeterial.com
de-ponqk.top
bntyr76rhg.top
servicepmgtl.world
nailtimelocust.top
paperappa.com
80sos.com
daysofbetting.com
slaytheday.fun
travauxdefou.com
bx2zyg.com
thecoxnews.com
qriskaq.com
top-dao.com
krstockly1.shop
roiwholesale.com
pajero777ads.click
twistedrubytx.com
thesovreignkingdomofmaui.info
cataclysmicgamingapparel.com
verxop.xyz
xn--kwra1023b.com
winterclairee.com
sukhiclothing.com
Targets
-
-
Target
PO_02.07.2024.PDF.cmd
-
Size
698KB
-
MD5
1cf4467c5f7b2d7b5f01a4b13ccc8764
-
SHA1
3d706295d65cc724c855b94c12ee1b92dcfdd3a2
-
SHA256
ea8e50c8d03fa31169ac6b28528ab73411e2d1a649c1b7ab48b42040d46f2045
-
SHA512
6180048fc1507d349b372cd991150046e83c78cc226a83d9299407b5f342e530f0e084de90d266b23ddcd248cd321bb2851d3c30f8e3c831e83e1291ae56df18
-
SSDEEP
12288:Ou2jSANT3ukfGBZRtJFy82apNn+PudHEpERRgYIAatIksjBfuVtGYhEA3dVkR:0jFT3ukeBZ9Q8H1+uIAaST
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-