File name:

Proforma Invoice P101092292891 TT slip pdf.rar.zip

Full analysis: https://app.any.run/tasks/ba4076b2-08e1-43bc-abcd-7347b097bfb7
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: February 02, 2024, 23:53:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
formbook
xloader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

4132A73C448CD2B5813DC2D34868ABA9

SHA1:

52C4CC2B87BCF41C6ACB800F9803BF3F26918614

SHA256:

435BFC4C3A3C887FD39C058E8C11863D5DD1F05E0C7A86E232C93D0E979FDB28

SSDEEP:

6144:3cI5EiPa/s7Kn8ILGtO3FB6z0vZil3bs:LHmoKBN10UiC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1632)

    • FORMBOOK has been detected (YARA)

      • lsm.exe (PID: 2088)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • lsm.exe (PID: 2088)

    • Application launched itself

      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2736)
      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 1172)

  • INFO

    • Checks supported languages

      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 4092)
      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 1172)
      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2736)
      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2448)

    • Reads the computer name

      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 2448)
      • Proforma Invoice P101092292891 TT slip pdf.rar.exe (PID: 4092)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1632)

    • Manual execution by a user

      • lsm.exe (PID: 2088)
      • cmstp.exe (PID: 3244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2088) lsm.exe
C2www.ellentscm.info/ob/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)maneresidenties.com
daylighttheatre.foundation
xn--jjq193ajmav75c.com
gatinhas.net
cerebrumfriend.info
gikyokudan.net
sosssou.com
texowipu14.win
askserene.com
lookbooks.net
salomst.reisen
hotsexchatwithmilfs.com
marcelaeerico.com
school79.info
zhongguowuzixu.com
b106879210.win
bishermarket.com
coincaucus.com
incomecan.net
alldayexchange.com
107hamiltonroad.com
claireaumatcha.com
xn--fiqs8spwb006g.com
jufa123.com
kowollik.email
sparkyoursukha.com
www8458v.com
jvfilmmakers.com
yifch.info
yunshangcms.com
seorowipe.com
gotrkx.com
xiangxiangbi.com
youxinyidai.com
turizmbelgesi.online
nolahmattresscoupon.com
goaskincancerhelpok.live
amiratu.com
dapsic.men
b2bcopybyjane.com
prozactruth.net
06mm9dj84r.com
heapto.com
xn--trivioonline-ehb.com
weddingpetattendant.com
4legs1heart.com
privacyguide.net
theitblogs.com
lukshan.com
juhanzaitu.com
100placesbandb.com
studioa93.com
canamultimedia.com
preprod.football
behrimen.com
hylexus.com
iangng.com
harrisrobertslimited.com
b3s669u-fzy.com
templatediprova.info
incoalth.com
adcecija.com
pleredberseka.com
refuright.com
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2017:12:14 21:58:38
ZipCRC: 0x2f3a30d2
ZipCompressedSize: 228260
ZipUncompressedSize: 471040
ZipFileName: Proforma Invoice P101092292891 TT slip pdf.rar.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe proforma invoice p101092292891 tt slip pdf.rar.exe no specs proforma invoice p101092292891 tt slip pdf.rar.exe no specs proforma invoice p101092292891 tt slip pdf.rar.exe no specs proforma invoice p101092292891 tt slip pdf.rar.exe no specs #FORMBOOK lsm.exe no specs cmd.exe no specs cmstp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1172"C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exe—WinRAR.exe
User:
admin
Company:
lexus
Integrity Level:
MEDIUM
Description:
lexus
Exit code:
0
Version:
8.05
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1632.3547\proforma invoice p101092292891 tt slip pdf.rar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1632"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Proforma Invoice P101092292891 TT slip pdf.rar.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2088"C:\Windows\System32\lsm.exe"C:\Windows\System32\lsm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Local Session Manager Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\lsm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sysntfy.dll
c:\windows\system32\wmsgapi.dll
c:\windows\system32\advapi32.dll
Formbook
(PID) Process(2088) lsm.exe
C2www.ellentscm.info/ob/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)maneresidenties.com
daylighttheatre.foundation
xn--jjq193ajmav75c.com
gatinhas.net
cerebrumfriend.info
gikyokudan.net
sosssou.com
texowipu14.win
askserene.com
lookbooks.net
salomst.reisen
hotsexchatwithmilfs.com
marcelaeerico.com
school79.info
zhongguowuzixu.com
b106879210.win
bishermarket.com
coincaucus.com
incomecan.net
alldayexchange.com
107hamiltonroad.com
claireaumatcha.com
xn--fiqs8spwb006g.com
jufa123.com
kowollik.email
sparkyoursukha.com
www8458v.com
jvfilmmakers.com
yifch.info
yunshangcms.com
seorowipe.com
gotrkx.com
xiangxiangbi.com
youxinyidai.com
turizmbelgesi.online
nolahmattresscoupon.com
goaskincancerhelpok.live
amiratu.com
dapsic.men
b2bcopybyjane.com
prozactruth.net
06mm9dj84r.com
heapto.com
xn--trivioonline-ehb.com
weddingpetattendant.com
4legs1heart.com
privacyguide.net
theitblogs.com
lukshan.com
juhanzaitu.com
100placesbandb.com
studioa93.com
canamultimedia.com
preprod.football
behrimen.com
hylexus.com
iangng.com
harrisrobertslimited.com
b3s669u-fzy.com
templatediprova.info
incoalth.com
adcecija.com
pleredberseka.com
refuright.com
2380/c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exe"C:\Windows\System32\cmd.exe—lsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2448"C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3105\Proforma Invoice P101092292891 TT slip pdf.rar.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3105\Proforma Invoice P101092292891 TT slip pdf.rar.exe—Proforma Invoice P101092292891 TT slip pdf.rar.exe
User:
admin
Company:
lexus
Integrity Level:
MEDIUM
Description:
lexus
Exit code:
0
Version:
8.05
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1632.3105\proforma invoice p101092292891 tt slip pdf.rar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2736"C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3105\Proforma Invoice P101092292891 TT slip pdf.rar.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3105\Proforma Invoice P101092292891 TT slip pdf.rar.exe—WinRAR.exe
User:
admin
Company:
lexus
Integrity Level:
MEDIUM
Description:
lexus
Exit code:
0
Version:
8.05
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1632.3105\proforma invoice p101092292891 tt slip pdf.rar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3244"C:\Windows\System32\cmstp.exe"C:\Windows\System32\cmstp.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile Installer
Exit code:
0
Version:
7.02.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4092"C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exe—Proforma Invoice P101092292891 TT slip pdf.rar.exe
User:
admin
Company:
lexus
Integrity Level:
MEDIUM
Description:
lexus
Exit code:
0
Version:
8.05
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1632.3547\proforma invoice p101092292891 tt slip pdf.rar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 055
Read events
1 038
Write events
17
Delete events
0

Modification events

(PID) Process:(1632) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1632) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
2
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2736Proforma Invoice P101092292891 TT slip pdf.rar.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\win.inibinary
MD5:8EDAFF5D62EBB44896409C7DFD0206FD
SHA256:5223143F452B50114EE78B8E845E5B5265B8CA624391A2DC18D91CB37B166FBB
1632WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3547\Proforma Invoice P101092292891 TT slip pdf.rar.exeexecutable
MD5:04FEC8BA993E5F1F1B6D1120A2EA9613
SHA256:9A9D7A41C404B9044A82727996D53222D996F03D71E4839245DBEEAF4C685F77
1632WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1632.3105\Proforma Invoice P101092292891 TT slip pdf.rar.exeexecutable
MD5:04FEC8BA993E5F1F1B6D1120A2EA9613
SHA256:9A9D7A41C404B9044A82727996D53222D996F03D71E4839245DBEEAF4C685F77
2736Proforma Invoice P101092292891 TT slip pdf.rar.exeC:\Windows\win.inibinary
MD5:8EDAFF5D62EBB44896409C7DFD0206FD
SHA256:5223143F452B50114EE78B8E845E5B5265B8CA624391A2DC18D91CB37B166FBB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Proforma Invoice P101092292891 TT slip pdf.rar.zip