analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

thisisformbook_00400000.bin

Full analysis: https://app.any.run/tasks/88bdc871-9f50-452c-b7ca-a118f193e578
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: October 05, 2022, 05:03:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
formbook
trojan
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B04F27359E900F9D5B27FBED01BD34BF

SHA1:

9B71336614D061AE6B960D16DF3211766B1FA871

SHA256:

461CB71FFB7FABAEC49906891179AC90434FDD95ED255F0F45738A624D3045B0

SSDEEP:

3072:twJNtKkd7XQYdCMWwDgAFGsukONMFbgxQej+sy6s8Hk6fMg+65VZn20:ktKi7AcCogAYcON5xQefnMgPZn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • FORMBOOK detected by memory dumps

      • audiodg.exe (PID: 3296)
    • FORMBOOK was detected

      • Explorer.EXE (PID: 1344)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2005-Dec-30 07:31:02

DOS Header

e_magic: MZ
e_cblp: 21061
e_cp: 232
e_crlc: -
e_cparhdr: 22528
e_minalloc: 59523
e_maxalloc: 35593
e_ss: 33736
e_sp: 15552
e_csum: 139
e_ip: 49411
e_cs: 49283
e_ovno: 65288
e_oemid: -
e_oeminfo: -
e_lfanew: 200

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 1
TimeDateStamp: 2005-Dec-30 07:31:02
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
171560
172032
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.32226
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start thisisformbook_00400000.bin.exe no specs #FORMBOOK audiodg.exe #FORMBOOK explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3076"C:\Users\admin\Desktop\thisisformbook_00400000.bin.exe" C:\Users\admin\Desktop\thisisformbook_00400000.bin.exeExplorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\thisisformbook_00400000.bin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3296"C:\Windows\System32\audiodg.exe"C:\Windows\System32\audiodg.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Audio Device Graph Isolation
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\audiodg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1344C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3116"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exeaudiodg.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
2 592
Read events
2 572
Write events
20
Delete events
0

Modification events

(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3296) audiodg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
8
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3296
audiodg.exe
GET
404
45.33.6.223:80
http://www.sqlite.org/2014/sqlite-dll-win32-x86-3080600.zip
US
whitelisted
1344
Explorer.EXE
GET
200
188.114.97.3:80
http://www.uniquegiftlab.com/tdet/?YPRxRz4x=f/uqFmIzO3+aJeAOQDOR3WsXs9dLDbmI4+Yjf0IU5IAoVYc8qaxVV7AGFpWTC8MtnsSgSD6GYw+n3RsnIE5xpLfqGEwAUInXCNgKd48=&Fdj8-=xNuhZlkhY
US
html
1.36 Kb
malicious
1344
Explorer.EXE
GET
200
64.190.63.111:80
http://www.caraudiohub-au.site/tdet/?YPRxRz4x=7xDtZY43xQIYbKxn4DD7D53EZ+AfS6ECxaTlMevFq9VPN5WtFC4gEC1HoXOKGgU/hyx/WIPpWdYCYdQ02PK+FDTuuLGk5cS5vg8O6i4=&Fdj8-=xNuhZlkhY
US
html
21.0 Kb
malicious
1344
Explorer.EXE
POST
23.202.231.167:80
http://www.dumptruckersonly.com/tdet/
US
malicious
1344
Explorer.EXE
POST
403
64.190.63.111:80
http://www.caraudiohub-au.site/tdet/
US
compressed
110 b
malicious
1344
Explorer.EXE
POST
403
64.190.63.111:80
http://www.caraudiohub-au.site/tdet/
US
compressed
110 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
188.114.97.3:80
www.uniquegiftlab.com
CLOUDFLARENET
NL
malicious
3296
audiodg.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
suspicious
1344
Explorer.EXE
23.202.231.167:80
www.dumptruckersonly.com
Akamai International B.V.
US
malicious
1344
Explorer.EXE
64.190.63.111:80
www.caraudiohub-au.site
SEDO GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
www.uniquegiftlab.com
  • 188.114.97.3
  • 188.114.96.3
malicious
www.sqlite.org
  • 45.33.6.223
whitelisted
www.amisens.com
malicious
www.caraudiohub-au.site
  • 64.190.63.111
malicious
www.dumptruckersonly.com
  • 23.202.231.167
  • 23.217.138.108
malicious

Threats

PID
Process
Class
Message
1344
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1344
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1344
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1344
Explorer.EXE
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1344
Explorer.EXE
A Network Trojan was detected
ET TROJAN FormBook CnC Checkin (GET)
1 ETPRO signatures available at the full report
No debug info