Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Analysis ID:	755946
MD5:	7b6dcd6fcd1c26b9abdba167929f4c82
SHA1:	04f11f07ef4a51b16383b5dde94f1af405893b45
SHA256:	e38f6fab27253171688423b0792d38be81e4c01cceb35c7bca05d2ebfc011ae9
Tags:	exe
Infos:

Detection

FormBook

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe (PID: 5448 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe MD5: 7B6DCD6FCD1C26B9ABDBA167929F4C82)

SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe (PID: 5572 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe MD5: 7B6DCD6FCD1C26B9ABDBA167929F4C82)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.imperiumtowns.xyz/b3es/"], "decoy": ["sweets.wtf", "apextama.com", "tygbs.com", "kumaoedu.com", "bestbathroomremodeling.club", "lnshykj.com", "nelsonanddima.com", "falunap.info", "codyhinrichs.com", "2797vip.com", "danutka.com", "3o2t307a.com", "kellymariewest.com", "profilelonn.online", "procan.website", "sopjimmy.com", "xn--skdarkae-55ac80i.net", "entitymanaged.com", "melitadahl.art", "joineguru.net", "good-meme.com", "creditconepts.com", "narafconstruction.com", "paspsichologa.com", "rancho365.com", "rimplefeel.com", "kingsub.online", "cnsrdns.com", "billythepainter.com", "clientevirtualpdf.net", "marycruzruiz.com", "renaultcikmaparca.xyz", "1600156.com", "paymallmart.info", "garafe.com", "fredrikk.net", "gogo-tunisia.space", "center-me.com", "xiaohuayhq.com", "xn--h49a60xt7azzcm91a.com", "unidiliobobo.info", "libertypolestore.com", "20111210.net", "atraofix.online", "furniron.com", "mingyun58.com", "shfesmua.com", "rdougdigital.life", "safsip.com", "melon.town", "sagihigaibengo.net", "ethnicsbyak.com", "designoffaitheventsllc.com", "dpmforensics.com", "ripple-us.net", "fuyouhin-happiness.com", "conceptweb.online", "l453.net", "zenars.com", "mepcoonlinebill.com", "oonn99.xyz", "dackus.energy", "articvas.com", "yayuanlin.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x65d1:$a1: 3C 30 50 4F 53 54 74 09 40 0x349f1:$a1: 3C 30 50 4F 53 54 74 09 40 0x61e11:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cf10:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x4b330:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x78750:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xad4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x3916f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x6658f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x15c37:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x44057:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 0x71477:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9c88:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9f02:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x380a8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x38322:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x654c8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x65742:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15a35:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x43e55:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x71275:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15521:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x43941:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x70d61:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15b37:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x43f57:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x71377:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15caf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x440cf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x714ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa91a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x38d3a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x6615a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18b99:$sqlite3step: 68 34 1C 7B E1 0x18cac:$sqlite3step: 68 34 1C 7B E1 0x46fb9:$sqlite3step: 68 34 1C 7B E1 0x470cc:$sqlite3step: 68 34 1C 7B E1 0x743d9:$sqlite3step: 68 34 1C 7B E1 0x744ec:$sqlite3step: 68 34 1C 7B E1 0x18bc8:$sqlite3text: 68 38 2A 90 C5 0x18ced:$sqlite3text: 68 38 2A 90 C5 0x46fe8:$sqlite3text: 68 38 2A 90 C5 0x4710d:$sqlite3text: 68 38 2A 90 C5 0x74408:$sqlite3text: 68 38 2A 90 C5 0x7452d:$sqlite3text: 68 38 2A 90 C5 0x18bdb:$sqlite3blob: 68 53 D8 7F 8C 0x18d03:$sqlite3blob: 68 53 D8 7F 8C 0x46ffb:$sqlite3blob: 68 53 D8 7F 8C 0x47123:$sqlite3blob: 68 53 D8 7F 8C 0x7441b:$sqlite3blob: 68 53 D8 7F 8C 0x74543:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bb90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x99cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x148b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x959a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a8f7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b8fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17819:$sqlite3step: 68 34 1C 7B E1 0x1792c:$sqlite3step: 68 34 1C 7B E1 0x17848:$sqlite3text: 68 38 2A 90 C5 0x1796d:$sqlite3text: 68 38 2A 90 C5 0x1785b:$sqlite3blob: 68 53 D8 7F 8C 0x17983:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x638e0:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xc753a:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bd90:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aaf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bafa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a19:$sqlite3step: 68 34 1C 7B E1 0x17b2c:$sqlite3step: 68 34 1C 7B E1 0x17a48:$sqlite3text: 68 38 2A 90 C5 0x17b6d:$sqlite3text: 68 38 2A 90 C5 0x17a5b:$sqlite3blob: 68 53 D8 7F 8C 0x17b83:$sqlite3blob: 68 53 D8 7F 8C

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	ReversingLabs: Detection: 41%
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Virustotal: Detection: 45%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Joe Sandbox ML: detected

Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.imperiumtowns.xyz/b3es/"], "decoy": ["sweets.wtf", "apextama.com", "tygbs.com", "kumaoedu.com", "bestbathroomremodeling.club", "lnshykj.com", "nelsonanddima.com", "falunap.info", "codyhinrichs.com", "2797vip.com", "danutka.com", "3o2t307a.com", "kellymariewest.com", "profilelonn.online", "procan.website", "sopjimmy.com", "xn--skdarkae-55ac80i.net", "entitymanaged.com", "melitadahl.art", "joineguru.net", "good-meme.com", "creditconepts.com", "narafconstruction.com", "paspsichologa.com", "rancho365.com", "rimplefeel.com", "kingsub.online", "cnsrdns.com", "billythepainter.com", "clientevirtualpdf.net", "marycruzruiz.com", "renaultcikmaparca.xyz", "1600156.com", "paymallmart.info", "garafe.com", "fredrikk.net", "gogo-tunisia.space", "center-me.com", "xiaohuayhq.com", "xn--h49a60xt7azzcm91a.com", "unidiliobobo.info", "libertypolestore.com", "20111210.net", "atraofix.online", "furniron.com", "mingyun58.com", "shfesmua.com", "rdougdigital.life", "safsip.com", "melon.town", "sagihigaibengo.net", "ethnicsbyak.com", "designoffaitheventsllc.com", "dpmforensics.com", "ripple-us.net", "fuyouhin-happiness.com", "conceptweb.online", "l453.net", "zenars.com", "mepcoonlinebill.com", "oonn99.xyz", "dackus.energy", "articvas.com", "yayuanlin.com"]}

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.imperiumtowns.xyz/b3es/

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248951472.0000000006016000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249535557.0000000006017000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249659691.000000000601C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249765760.000000000601C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comB.TTF1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comce
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comi
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comicom
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comitue
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comt
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247878242.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.cm
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247400149.000000000602B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/-e
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250848136.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmX
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Kal1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/M
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/i
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/or1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/siv
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/vno
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 0_2_015FC334	0_2_015FC334
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 0_2_015FE790	0_2_015FE790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 0_2_015FE78A	0_2_015FE78A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0102F900	1_2_0102F900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01042990	1_2_01042990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010499BF	1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0103C1C0	1_2_0103C1C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01026800	1_2_01026800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E1002	1_2_010E1002
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105701D	1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010FE824	1_2_010FE824
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104A830	1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0103B090	1_2_0103B090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010520A0	1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F20A8	1_2_010F20A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F28EC	1_2_010F28EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E60F5	1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104A309	1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E231B	1_2_010E231B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F2B28	1_2_010F2B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010CCB4F	1_2_010CCB4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104AB40	1_2_0104AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01043360	1_2_01043360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010CEB8A	1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105138B	1_2_0105138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104EB9A	1_2_0104EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105EBB0	1_2_0105EBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E03DA	1_2_010E03DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010EDBD2	1_2_010EDBD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105ABD8	1_2_0105ABD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010D23E3	1_2_010D23E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01078BE8	1_2_01078BE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010DFA2B	1_2_010DFA2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104B236	1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E5A4F	1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F22AE	1_2_010F22AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F32A9	1_2_010F32A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010EE2C5	1_2_010EE2C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E4AEF	1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F2D07	1_2_010F2D07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01020D20	1_2_01020D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01042D50	1_2_01042D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F1D55	1_2_010F1D55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01052581	1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E2D82	1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010565A0	1_2_010565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F25DD	1_2_010F25DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0103D5E0	1_2_0103D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0103841F	1_2_0103841F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01042430	1_2_01042430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010ED466	1_2_010ED466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104B477	1_2_0104B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010ECC77	1_2_010ECC77
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E4496	1_2_010E4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01054CD4	1_2_01054CD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010FDFCE	1_2_010FDFCE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010E67E2	1_2_010E67E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F1FF1	1_2_010F1FF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01045600	1_2_01045600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010ED616	1_2_010ED616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01046E30	1_2_01046E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010AAE60	1_2_010AAE60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010D1EB6	1_2_010D1EB6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010506C0	1_2_010506C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010F2EF7	1_2_010F2EF7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: String function: 0102B150 appears 177 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: String function: 010B5720 appears 85 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: String function: 0107D08C appears 48 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_01069860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_01069660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010696E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_010696E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069910 NtAdjustPrivilegesToken,	1_2_01069910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069950 NtQueueApcThread,	1_2_01069950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010699A0 NtCreateSection,	1_2_010699A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010699D0 NtCreateProcessEx,	1_2_010699D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069820 NtEnumerateKey,	1_2_01069820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069840 NtDelayExecution,	1_2_01069840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0106B040 NtSuspendThread,	1_2_0106B040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010698A0 NtWriteVirtualMemory,	1_2_010698A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010698F0 NtReadVirtualMemory,	1_2_010698F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069B00 NtSetValueKey,	1_2_01069B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0106A3B0 NtGetContextThread,	1_2_0106A3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069A00 NtProtectVirtualMemory,	1_2_01069A00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069A10 NtQuerySection,	1_2_01069A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069A20 NtResumeThread,	1_2_01069A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069A50 NtCreateFile,	1_2_01069A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069A80 NtOpenDirectoryObject,	1_2_01069A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069520 NtWaitForSingleObject,	1_2_01069520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0106AD30 NtSetContextThread,	1_2_0106AD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069540 NtReadFile,	1_2_01069540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069560 NtWriteFile,	1_2_01069560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010695D0 NtClose,	1_2_010695D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010695F0 NtQueryInformationFile,	1_2_010695F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0106A710 NtOpenProcessToken,	1_2_0106A710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069710 NtQueryInformationToken,	1_2_01069710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069730 NtQueryVirtualMemory,	1_2_01069730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069760 NtOpenProcess,	1_2_01069760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0106A770 NtOpenThread,	1_2_0106A770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069770 NtSetInformationFile,	1_2_01069770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069780 NtMapViewOfSection,	1_2_01069780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010697A0 NtUnmapViewOfSection,	1_2_010697A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069FE0 NtCreateMutant,	1_2_01069FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069610 NtEnumerateValueKey,	1_2_01069610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069650 NtQueryValueKey,	1_2_01069650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01069670 NtQueryInformationProcess,	1_2_01069670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_010696D0 NtCreateKey,	1_2_010696D0

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.267730037.00000000078D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrecision.dll6 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInspector.dllN vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.264250960.000000000111F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.261495799.0000000000F7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.259043934.0000000000DD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Binary or memory string: OriginalFilenamefzynaa.exe< vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	ReversingLabs: Detection: 41%
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Virustotal: Detection: 45%

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.log

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/1@0/0

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Mutant created: \Sessions\1\BaseNamedObjects\wGtrYQj

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Code function: 1_2_0107D0D1 push ecx; ret

1_2_0107D0E4

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Static PE information: 0xBF0A3116 [Sun Jul 26 06:03:02 2071 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.830178117653337

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5464	Thread sleep time: -38122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Code function: 1_2_01056B90 rdtsc

1_2_01056B90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

API coverage: 0.5 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Thread delayed: delay time: 38122	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Code function: 1_2_01056B90 rdtsc

1_2_01056B90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]	1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]	1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h]	1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]	1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]	1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h]	1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h]	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01044120 mov ecx, dword ptr fs:[00000030h]	1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_01023138 mov ecx, dword ptr fs:[00000030h]	1_2_01023138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105513A mov eax, dword ptr fs:[00000030h]	1_2_0105513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0105513A mov eax, dword ptr fs:[00000030h]	1_2_0105513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h]	1_2_0104B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h]	1_2_0104B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0102395E mov eax, dword ptr fs:[00000030h]	1_2_0102395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe	Code function: 1_2_0102395E mov eax, dword ptr fs:[00000030h]	1_2_0102395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe