File name:

e-dekont.pdf.exe

Full analysis: https://app.any.run/tasks/cdb2f39c-371d-4eec-884c-3939f10ffdff
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: September 04, 2023, 16:20:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
spyware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

68E81732F7B3B06BE645EF5BCCD8E419

SHA1:

AAAC23729120D0515F11E57E9A1C0BB52FF517DE

SHA256:

837FC8D2A3E348E96EA2DB94ABBE3319B380496B7329CDE30519B26F51C1DE88

SSDEEP:

6144:/Ya67Z+/XILeburh5lX8sH/DWwYMY/o+ztDGZr6JF/yMJ/q2cEjczf863Z58tKJC:/YpOOpN5pp6wYMY3xDymnaMJCaM863Zg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • fdvazbckgj.exe (PID: 2504)
      • fdvazbckgj.exe (PID: 4072)

    • FORMBOOK detected by memory dumps

      • cscript.exe (PID: 2888)

    • Connects to the CnC server

      • explorer.exe (PID: 1924)

    • FORMBOOK was detected

      • explorer.exe (PID: 1924)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • e-dekont.pdf.exe (PID: 3016)

    • Application launched itself

      • fdvazbckgj.exe (PID: 4072)

    • Starts CMD.EXE for commands execution

      • cscript.exe (PID: 2888)

  • INFO

    • Checks supported languages

      • e-dekont.pdf.exe (PID: 3016)
      • fdvazbckgj.exe (PID: 4072)
      • fdvazbckgj.exe (PID: 2504)

    • Reads the computer name

      • e-dekont.pdf.exe (PID: 3016)
      • fdvazbckgj.exe (PID: 4072)
      • fdvazbckgj.exe (PID: 2504)

    • Create files in a temporary directory

      • e-dekont.pdf.exe (PID: 3016)

    • Manual execution by a user

      • cscript.exe (PID: 2888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(2888) cscript.exe
C2www.xpcslda.com/mh21/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)qiandaye.top
zltgw.com
getxgp.link
forest-create.site
parsefilm.com
foodstore.top
reynoldsquality.com
tripleshops.com
altuwaijrifood.com
seniorassistedlivinglocator.com
essencedelanature.com
hrwv098.xyz
olkja.xyz
10685johansen.com
ajidenhp.com
sensifiedregistration.com
timetodatings.life
bizbet-review-pt.com
zhangming.asia
xn--vhq074eeozsda.top
rygodigital.site
cellphonespoland.today
dentsfirst.com
envrliteracyprojectia.online
friendsislove.com
g1t1v5am.top
naturo-construction.com
jstzzlm.com
cukservers.net
serofix.com
afhpj.com
westnewburyopenspace.net
copperstatenotary.com
rw6dh.top
5812harold.com
zzfd.shop
webmarketingrocket.com
bcdwg.com
amotcabo.com
accountswallet.com
itechsarl.net
wakuy.app
mmacpdrm.click
2d8t36nfmh.skin
kimberlys-portfolio.com
iran-protests.com
bodhiheals.com
mkamiart.com
cuprolifestyle.com
smartpartproducts.com
7300-banking.pro
dinheirofacil.digital
fednowdigitalpayment.com
hokkoriidol.com
agapehomecleaning.com
iicaqjls.click
53dorethyrd.com
indepqueretaro.com
fsjixrkh83o.cyou
seomasteraff.net
dbwci.com
simplebly.store
calicarmovers.com
opleermandmand.com
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductName: 21.44.34.17
LegalCopyright: Copyright Boothe
FileVersion: 21.44.34.17
FileDescription: cockneyize
CompanyName: pyramidoprismatic
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 21.44.34.17
FileVersionNumber: 21.44.34.17
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3640
UninitializedDataSize: 2048
InitializedDataSize: 141824
CodeSize: 26624
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2021:09:25 21:56:47+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Sep-2021 21:56:47
Detected languages:
  • English - United States
CompanyName: pyramidoprismatic
FileDescription: cockneyize
FileVersion: 21.44.34.17
LegalCopyright: Copyright Boothe
ProductName: 21.44.34.17

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Sep-2021 21:56:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006676
0x00006800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
0x00008000
0x0000139A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
0x0000A000
0x00020378
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
0x0002B000
0x00010000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003B000
0x00000CB0
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.20063

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29934
830
UNKNOWN
English - United States
RT_MANIFEST
103
2.16096
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start e-dekont.pdf.exe fdvazbckgj.exe no specs fdvazbckgj.exe no specs #FORMBOOK cscript.exe no specs cmd.exe no specs #FORMBOOK explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1924C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2504"C:\Users\admin\AppData\Local\Temp\fdvazbckgj.exe"C:\Users\admin\AppData\Local\Temp\fdvazbckgj.exe—fdvazbckgj.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fdvazbckgj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2888"C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\syswow64\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
Formbook
(PID) Process(2888) cscript.exe
C2www.xpcslda.com/mh21/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)qiandaye.top
zltgw.com
getxgp.link
forest-create.site
parsefilm.com
foodstore.top
reynoldsquality.com
tripleshops.com
altuwaijrifood.com
seniorassistedlivinglocator.com
essencedelanature.com
hrwv098.xyz
olkja.xyz
10685johansen.com
ajidenhp.com
sensifiedregistration.com
timetodatings.life
bizbet-review-pt.com
zhangming.asia
xn--vhq074eeozsda.top
rygodigital.site
cellphonespoland.today
dentsfirst.com
envrliteracyprojectia.online
friendsislove.com
g1t1v5am.top
naturo-construction.com
jstzzlm.com
cukservers.net
serofix.com
afhpj.com
westnewburyopenspace.net
copperstatenotary.com
rw6dh.top
5812harold.com
zzfd.shop
webmarketingrocket.com
bcdwg.com
amotcabo.com
accountswallet.com
itechsarl.net
wakuy.app
mmacpdrm.click
2d8t36nfmh.skin
kimberlys-portfolio.com
iran-protests.com
bodhiheals.com
mkamiart.com
cuprolifestyle.com
smartpartproducts.com
7300-banking.pro
dinheirofacil.digital
fednowdigitalpayment.com
hokkoriidol.com
agapehomecleaning.com
iicaqjls.click
53dorethyrd.com
indepqueretaro.com
fsjixrkh83o.cyou
seomasteraff.net
dbwci.com
simplebly.store
calicarmovers.com
opleermandmand.com
3016"C:\Users\admin\AppData\Local\Temp\e-dekont.pdf.exe" C:\Users\admin\AppData\Local\Temp\e-dekont.pdf.exe
explorer.exe
User:
admin
Company:
pyramidoprismatic
Integrity Level:
MEDIUM
Description:
cockneyize
Exit code:
0
Version:
21.44.34.17
Modules
Images
c:\users\admin\appdata\local\temp\e-dekont.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernelbase.dll
3564/c del "C:\Users\admin\AppData\Local\Temp\fdvazbckgj.exe"C:\Windows\SysWOW64\cmd.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\ntdll.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\cmd.exe
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
4072"C:\Users\admin\AppData\Local\Temp\fdvazbckgj.exe" C:\Users\admin\AppData\Local\Temp\fdvazbckgj.exe—e-dekont.pdf.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\fdvazbckgj.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
Total events
729
Read events
727
Write events
2
Delete events
0

Modification events

(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A00000000020000000000106600000001000020000000DE596CC00FA0CE6036B57F3745DF211B8CEDC7563B5C7C90E189DFBFE4E216FC000000000E800000000200002000000034A09CAFA8980668BD48169E708CCFDA06F4ADAD9A6D0FF324841FD89016AF6F3000000097B2B3329B62DD4C9AB1E283BD9359B999E8411B9FC15AF795BFA67D05007F5CE28F7E84193A17AFEBE2A486810ADC32400000007E5B4D515AE7EE2B367ED77D5D9A272891BC7B3019A3AA7BC4BF2CA5315073E7F321A33013E44AD95CE9A5E9CA3FF01D3584C54FECFB9C1227BA4AE46F87EAF7
(PID) Process:(1924) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B6000000F2000000C4A564001500000007000000072106007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542DADFFFE070000000000000000000068006B02000000005C00010000000000000000000000000000003D0000000000EB1A92770000000068006B020000000000000000FE0700002825B6FFFE070000A08886020000000018006B020000000000000000000000000100000000000000BF1DADFFFE07000060E1EA020000000060B888020000000000000000000000003B9462FDFE070000B00C88020000000008006B02000000005C00010000000000869A807700000000BE313C4A62B00000820200000000000000000000000000005C000100000000000000000000000000820200000000000002000000000000005C000100000000000000000000000000820200000000000080A6E0FF00000000C812D2FF00000000B00C88020000000001000000000000000F0000C000000000B000060000000000820200000000000001000000000000008202000000000000DB9B8077000000005C00010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000060000002400000067510B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000000000000000000000000000000008202000000000000010000000000000001000000000000008202000000000000D46905FCFE07000010E2EA020000000016798077000000000000000000000000869A807700000000000000000000000030E14A0000000000010000000000000010E2EA02000000000000000000000000CF41394A62B00000FFFFFFFFFFFFFFFF010000000000000000FF490000000000A0000500000000000000000000000000586705FCFE0700000000000000000000A0000500000000002B10000000000000807580770000000000000000000000000000000000000000000000000000000001000000000000001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000C86719007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E00650078006500000041003900440043003700300042004200420034007D000000280000000000340000C000000000D48028000000000080BE28000000000000000000000000003E0040000000000060E3EA0200000000E0A4C30700000000350100C000000000C8037C770000000000000000000000007010000000000000A07D28000000000000000000000000001480280000000000D03B2B000000000048DD6F7700000000360038000000000020EBEA0200000000F8DCEA0200000000E905707700000000F1DCEA0200000000E0A4C30700000000140000000600000098E705007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E00650078006500000067FEFE0700000000000000000000F012FD020000000000000000000000000000000000000000F012FD020000000012C266FEFE070000010000000000000000000000000000000000000000000000F012FD02000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3016e-dekont.pdf.exeC:\Users\admin\AppData\Local\Temp\nskB6B.tmpbinary
MD5:96335AD9C238CC94568EB6834C65E3E2
SHA256:61EF7F0BCB80EE7E86F8E3B31B1EBBD4E8C7AE47271A5FC710FC84A67C736202
3016e-dekont.pdf.exeC:\Users\admin\AppData\Local\Temp\lqyrcrcd.aorbinary
MD5:64F8723A95E5B3012F77BD684D2F757E
SHA256:C206BFD5494FA7EBC8D65000A538365D081A2F6E0E0CDDA7CB46E63F55CF2E8B
3016e-dekont.pdf.exeC:\Users\admin\AppData\Local\Temp\fdvazbckgj.exeexecutable
MD5:765FD0073777FA17C2E48904593C31D9
SHA256:D261B4241C77E9D362B0876C9DCEF509E4C23EA2DD88BB3052F76155A30DC646
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
4
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
explorer.exe
GET
200
156.234.201.239:80
http://www.rw6dh.top/mh21/?vTax-=y3w155G+DCRs2eXKpnvLkoLPf6n8CkVT1oHOLXnRIRunUvabZMzIq/niQPZJeDI11UaZuQ==&S0GhCH=RRHlpvnHLv_L
unknown
text
60 b
suspicious
1924
explorer.exe
GET
301
172.67.177.114:80
http://www.bizbet-review-pt.com/mh21/?vTax-=elCaaRPQK3+RZ7lLuSQxdnmkSwv9KKoAqvuAqj9IgzyxJKbCPAvvd2UcayLko/IfhHkZDQ==&S0GhCH=RRHlpvnHLv_L
unknown
html
178 b
malicious
1924
explorer.exe
GET
301
185.252.29.160:80
http://www.parsefilm.com/mh21/?vTax-=XiJTF7j/F/vXjVRlqLMIt0ZEGJeVfRJ3myaY1WjAyS7/851g+QRaO5/c2z9yAaXyCRoipg==&S0GhCH=RRHlpvnHLv_L
unknown
html
707 b
unknown
1924
explorer.exe
GET
404
185.104.28.238:80
http://www.opleermandmand.com/mh21/?vTax-=VFkF7QA8/Ks4YjJ/dNSXC2LKrArBYVzvkfR1DicGJYSAxqdE9QJdsY7FzORd5JOWusrKUQ==&S0GhCH=RRHlpvnHLv_L
unknown
html
203 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
332
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1924
explorer.exe
172.67.177.114:80
www.bizbet-review-pt.com
CLOUDFLARENET
US
malicious
1924
explorer.exe
185.104.28.238:80
www.opleermandmand.com
Stichting DIGI NL
NL
unknown
1924
explorer.exe
156.234.201.239:80
www.rw6dh.top
MOACK.Co.LTD
HK
suspicious
1924
explorer.exe
185.252.29.160:80
www.parsefilm.com
Shabakeh Ertebatat Artak Towseeh LTD
IR
unknown

DNS requests

Domain
IP
Reputation
www.bizbet-review-pt.com
  • 172.67.177.114
  • 104.21.83.146
malicious
www.opleermandmand.com
  • 185.104.28.238
unknown
www.rw6dh.top
  • 156.234.201.239
suspicious
www.parsefilm.com
  • 185.252.29.160
unknown

Threats

PID
Process
Class
Message
1924
explorer.exe
Malware Command and Control Activity Detected
ET MALWARE FormBook CnC Checkin (GET)
332
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
1924
explorer.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e-dekont.pdf.exe