File name: | BL-Shipping Document.z |
Full analysis: | https://app.any.run/tasks/68c6d268-e0c7-4cdf-85e9-41308e75a155 |
Verdict: | Malicious activity |
Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
Analysis date: | April 15, 2019, 14:14:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 7F661B3BCB97F60BF0A2E14A1E0250BD |
SHA1: | 534D39327BF46B9610A2C37BCA8358521E2BD329 |
SHA256: | 379D004FDAEC6621395A116D8204EDEDC39DE34EE304788BE6A722F0C0C3740A |
SSDEEP: | 6144:bay3UP6ry+qzjd8pRv+2YtSA7bTpKhA1qyRGIrk7frlRoQjUPoJfGsRG9QL:bay3k62+cGpN+Tssbt9TrkDsI2oJfG0L |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2580 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BL-Shipping Document.z" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
1712 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.21486\BL-Shipping Document.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.21486\BL-Shipping Document.exe | WinRAR.exe | |
User: admin Company: ukojovacosocahoqozomusew Integrity Level: MEDIUM Description: imolowuv Exit code: 0 Version: 7.10.14.17 | ||||
3092 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.23542\BL-Shipping Document.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.23542\BL-Shipping Document.exe | WinRAR.exe | |
User: admin Company: ukojovacosocahoqozomusew Integrity Level: MEDIUM Description: imolowuv Exit code: 0 Version: 7.10.14.17 | ||||
2556 | "C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.21486\BL-Shipping Document.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Windows\System32\cmd.exe | BL-Shipping Document.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3772 | "C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Windows\System32\cmd.exe | — | BL-Shipping Document.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1976 | "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | cmd.exe | |
User: admin Company: ukojovacosocahoqozomusew Integrity Level: MEDIUM Description: imolowuv Exit code: 0 Version: 7.10.14.17 | ||||
1724 | "C:\Users\admin\Desktop\BL-Shipping Document.exe" | C:\Users\admin\Desktop\BL-Shipping Document.exe | explorer.exe | |
User: admin Company: ukojovacosocahoqozomusew Integrity Level: MEDIUM Description: imolowuv Exit code: 0 Version: 7.10.14.17 | ||||
4036 | "C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.23542\BL-Shipping Document.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Windows\System32\cmd.exe | BL-Shipping Document.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3196 | "C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Windows\System32\cmd.exe | — | BL-Shipping Document.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3932 | "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe" | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | cmd.exe | |
User: admin Company: ukojovacosocahoqozomusew Integrity Level: MEDIUM Description: imolowuv Exit code: 0 Version: 7.10.14.17 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2580 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2580.24295\BL-Shipping Document.exe | — | |
MD5:— | SHA256:— | |||
3808 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | — | |
MD5:— | SHA256:— | |||
3424 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | — | |
MD5:— | SHA256:— | |||
2556 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
332 | DllHost.exe | C:\Program Files\Rmnvd\mfcnvch.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
2172 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
116 | explorer.exe | C:\Users\admin\AppData\Local\Temp\Rmnvd\mfcnvch.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
2580 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2580.21486\BL-Shipping Document.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
116 | explorer.exe | C:\Users\admin\Desktop\BL-Shipping Document.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B | |||
4036 | cmd.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\app.exe | executable | |
MD5:BC8787CE0212B9306C503301C72407E1 | SHA256:53C88F93E26CFA364E823EDBB6C1E3F4A9AEF63B12591A16939C10FA9314562B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
116 | explorer.exe | GET | — | 35.246.6.109:80 | http://www.juchheimcosmetic.com/ro/?kJ_hzl=hjG4RSAFHz+4InyBNYj4hFQuhT7AQs3Ek6ZK6i/WXe5652yoLuLBGbQxkdV988dkBZmJGA==&KtcDu=LXyLw0&sql=1 | US | — | — | malicious |
116 | explorer.exe | GET | — | 104.217.167.211:80 | http://www.lerensex.com/ro/?kJ_hzl=U9/ZL7INqJZ/2nesCTFamQWiI1PZGifHda6tk+ddgfZEowSvbKqG9FnFAE67q4bK4joB0A==&KtcDu=LXyLw0&sql=1 | US | — | — | malicious |
116 | explorer.exe | POST | — | 104.217.167.211:80 | http://www.lerensex.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.juchheimcosmetic.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 104.217.167.211:80 | http://www.lerensex.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.juchheimcosmetic.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 192.0.78.203:80 | http://www.globalartistdigitall.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 35.246.6.109:80 | http://www.juchheimcosmetic.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 192.0.78.203:80 | http://www.globalartistdigitall.com/ro/ | US | — | — | malicious |
116 | explorer.exe | POST | — | 104.217.167.211:80 | http://www.lerensex.com/ro/ | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
116 | explorer.exe | 192.0.78.203:80 | www.globalartistdigitall.com | Automattic, Inc | US | malicious |
— | — | 23.227.38.64:80 | www.ootdinsider.com | Shopify, Inc. | CA | malicious |
116 | explorer.exe | 35.246.6.109:80 | www.juchheimcosmetic.com | — | US | malicious |
116 | explorer.exe | 5.133.220.154:80 | www.newcasinouk.com | Obenetwork AB | SE | malicious |
116 | explorer.exe | 104.217.167.211:80 | www.lerensex.com | Psychz Networks | US | malicious |
116 | explorer.exe | 94.136.40.82:80 | www.havenfundingplc.com | Host Europe GmbH | GB | malicious |
— | — | 94.136.40.82:80 | www.havenfundingplc.com | Host Europe GmbH | GB | malicious |
Domain | IP | Reputation |
---|---|---|
www.ootdinsider.com |
| malicious |
www.lerensex.com |
| malicious |
www.workrowser.net |
| unknown |
www.globalartistdigitall.com |
| malicious |
www.juchheimcosmetic.com |
| malicious |
www.newcasinouk.com |
| malicious |
www.havenfundingplc.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:FormBook CnC Checkin (POST) |
116 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] FormBook CnC Checkin (GET) |
Process | Message |
---|---|
BL-Shipping Document.exe |
*** Status originated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\id_parser.cpp, line 590
|
BL-Shipping Document.exe |
*** Status propagated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 147
|
BL-Shipping Document.exe |
*** Status originated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\id_parser.cpp, line 590
|
BL-Shipping Document.exe |
*** Status propagated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 147
|
app.exe |
*** Status originated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\id_parser.cpp, line 590
|
app.exe |
*** Status propagated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 147
|
BL-Shipping Document.exe |
*** Status originated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\id_parser.cpp, line 590
|
BL-Shipping Document.exe |
*** Status propagated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 147
|
app.exe |
*** Status originated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\id_parser.cpp, line 590
|
app.exe |
*** Status propagated: -1072365543
*** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 147
|