Formbook Oct 23

https://www.hybrid-analysis.com/sample/66d32f481e1ef8afe97a23b25e1bc805ef11a32ceeb6e2151294f3a11c44e1d5?environmentId=100

c2's:
www.bridgebiosciences.com
www.sunjoeuk.com
www.customhands.net
www.shsanti.com
www.wimzibot.com
www.allstarrepairtn.com

https://www.threatcrowd.org/ip.php?ip=208.91.197.39
https://www.threatcrowd.org/ip.php?ip=66.96.147.117

email:
Received: from [162.251.20.80] (HELO cityoffarrell.com)
  by jhost (CommuniGate Pro SMTP 6.1.7)
  with ESMTP id 64536595 for user@domain; Mon, 23 Oct 2017 12:40:47 -0400
Reply-To: [email protected]
From: "City of Farrell"<[email protected]>
To: user@domain
Subject: STNB_Bank Payment Confirmation
Date: 24 Oct 2017 00:41:01 +0800
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0012_5CA5A497.1BB68BD7"


This is a multi-part message in MIME format.

------=_NextPart_000_0012_5CA5A497.1BB68BD7
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Good day,

I called your office number, but no responds. A copy of the=20
transfer slip has been attached to this email for ur persual .=20
Kindly go through the slip and verify that the transfer has been=20
made to the right account provided and get back to me, as it is=20
important we take this as a matter of urgency.


Regards
Michael Greeves
------=_NextPart_000_0012_5CA5A497.1BB68BD7
Content-Type: application/octet-stream; name="Quotation_offer585774.pdf.iso"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Quotation_offer585774.pdf.iso"

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA