analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

F077-160662-Poliza 15658272.pdf.exe

Full analysis: https://app.any.run/tasks/a96217f8-1063-4faa-84f1-60edccbb39d1
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Analysis date: October 14, 2019, 14:06:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
formbook
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4A02175408B104AB68B5473ACC6C0D8D

SHA1:

421D8C3090142B912D6D425656D25241D9764E06

SHA256:

5184EA8428A1C70FE8480031CEA2D77C9400E3D0FF8FDA3708E2A63492324208

SSDEEP:

6144:bX1CuiiCzJ2k75Xd5bshF+ucEsgz1fIzJaDRGxoAaklUF/NQKcyyJTYjf5PL7WeI:bIuOlXohFAEFz1GJaDox4Ie5PL6CX5+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • FORMBOOK was detected

      • explorer.exe (PID: 352)
      • Firefox.exe (PID: 3748)
      • wlanext.exe (PID: 2812)
    • Connects to CnC server

      • explorer.exe (PID: 352)
    • Changes the autorun value in the registry

      • wlanext.exe (PID: 2812)
    • Actions looks like stealing of personal data

      • wlanext.exe (PID: 2812)
    • Stealing of credential data

      • wlanext.exe (PID: 2812)
  • SUSPICIOUS

    • Application launched itself

      • F077-160662-Poliza 15658272.pdf.exe (PID: 2588)
    • Starts CMD.EXE for commands execution

      • wlanext.exe (PID: 2812)
    • Loads DLL from Mozilla Firefox

      • wlanext.exe (PID: 2812)
    • Creates files in the user directory

      • wlanext.exe (PID: 2812)
  • INFO

    • Reads the hosts file

      • wlanext.exe (PID: 2812)
    • Manual execution by user

      • wlanext.exe (PID: 2812)
    • Creates files in the user directory

      • Firefox.exe (PID: 3748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (90.6)
.exe | Win32 Executable (generic) (4.9)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2002:03:26 08:28:31+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 585728
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x1328
OSVersion: 4
ImageVersion: 1.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.0.2
ProductVersionNumber: 1.5.0.2
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Malko2Torights
CompanyName: Malko2haemangioma2
ProductName: Malko2Epimyth
FileVersion: 1.05.0002
ProductVersion: 1.05.0002
InternalName: zasaS
OriginalFileName: zasaS.exe

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Mar-2002 07:28:31
Detected languages:
  • English - United States
Comments: Malko2Torights
CompanyName: Malko2haemangioma2
ProductName: Malko2Epimyth
FileVersion: 1.05.0002
ProductVersion: 1.05.0002
InternalName: zasaS
OriginalFilename: zasaS.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000B8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 26-Mar-2002 07:28:31
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0008E298
0x0008F000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64895
.data
0x00090000
0x0000116C
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00092000
0x00001C24
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.19557

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.32024
620
Unicode (UTF 16LE)
English - United States
RT_VERSION
30001
4.03574
744
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30002
4.51603
2216
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30003
4.65517
3240
Unicode (UTF 16LE)
UNKNOWN
RT_ICON

Imports

MSVBVM60.DLL
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start f077-160662-poliza 15658272.pdf.exe no specs f077-160662-poliza 15658272.pdf.exe no specs #FORMBOOK wlanext.exe cmd.exe no specs #FORMBOOK explorer.exe #FORMBOOK firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2588"C:\Users\admin\AppData\Local\Temp\F077-160662-Poliza 15658272.pdf.exe" C:\Users\admin\AppData\Local\Temp\F077-160662-Poliza 15658272.pdf.exeexplorer.exe
User:
admin
Company:
Malko2haemangioma2
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.05.0002
896"C:\Users\admin\AppData\Local\Temp\F077-160662-Poliza 15658272.pdf.exe" C:\Users\admin\AppData\Local\Temp\F077-160662-Poliza 15658272.pdf.exeF077-160662-Poliza 15658272.pdf.exe
User:
admin
Company:
Malko2haemangioma2
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.05.0002
2812"C:\Windows\System32\wlanext.exe"C:\Windows\System32\wlanext.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wireless LAN 802.11 Extensibility Framework
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3956/c del "C:\Users\admin\AppData\Local\Temp\F077-160662-Poliza 15658272.pdf.exe"C:\Windows\System32\cmd.exewlanext.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3748"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe
wlanext.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Total events
21
Read events
20
Write events
1
Delete events
0

Modification events

(PID) Process:(2812) wlanext.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:I4EDC2EPFFTP
Value:
C:\Program Files\Jalu\Cookiesh6ed2jt.exe
Executable files
0
Suspicious files
77
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2812wlanext.exeC:\Users\admin\AppData\Roaming\-M479700\-M4logrc.inibinary
MD5:6A2D8FD600948CEFEA9C615AF9607BD5
SHA256:8A8A84891ECB2032320D1C0DE99FDCD94100DF10F352D9F96FD1B2433CD4D45B
2812wlanext.exeC:\Users\admin\AppData\Roaming\-M479700\-M4logim.jpegimage
MD5:46A77057864EEF5152A40C4A19210E8B
SHA256:BBF353D3CE9B381683E7F4CEA461A7AB4A7D308CE30C7872FE54206AE7F58923
2812wlanext.exeC:\Users\admin\AppData\Roaming\-M479700\-M4logri.inibinary
MD5:D63A82E5D81E02E399090AF26DB0B9CB
SHA256:EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
2812wlanext.exeC:\Users\admin\AppData\Roaming\-M479700\-M4logrv.inibinary
MD5:BA3B6BC807D4F76794C4B81B09BB9BA5
SHA256:6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
3748Firefox.exeC:\Users\admin\AppData\Roaming\-M479700\-M4logrf.inibinary
MD5:2F245469795B865BDD1B956C23D7893D
SHA256:1662D01A2D47B875A34FC7A8CD92E78CB2BA7F34023C7FD2639CBB10B8D94361
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
352
explorer.exe
GET
302
23.20.239.12:80
http://www.biokillz.com/h339/?cb=XOmsFqp83q9zc8JKFiFBSyFFZ8JhJ3mLnVnyvHrXCVpyzb4Mpb3X79Ys5LiaBFsdsVyP1Q==&EFi8M=7nxdkl2PUBMTa4J
US
html
184 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
352
explorer.exe
23.20.239.12:80
www.biokillz.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
www.biokillz.com
  • 23.20.239.12
shared

Threats

PID
Process
Class
Message
352
explorer.exe
A Network Trojan was detected
MALWARE [PTsecurity] FormBook CnC Checkin (GET)
1 ETPRO signatures available at the full report
No debug info