File name:

Purchase Order-P54477890.exe

Full analysis: https://app.any.run/tasks/0f5bc14d-69a9-4389-a53c-8c5a148bc15b
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 09:29:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netreactor
formbook
xloader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

5AC076044272CB7878A22D6F5581FC4C

SHA1:

9055AB9DCA9FA390733C23A4DE4EC9F15F59AAA5

SHA256:

A90BCA8C1F6A63CC34A896EB3883428FAB6FB6B4ACA385AC917FDAFCDBF9E774

SSDEEP:

24576:quuy4apoDrZeiTY+iomXUDBQ/eQa03m6hxcRZC1cRBFXQEY7C9cS1BGo:quuy4apoHZZTY+iomXUDBQ/eQa03m6ho

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Purchase Order-P54477890.exe (PID: 7368)

    • Uses Task Scheduler to run other applications

      • Purchase Order-P54477890.exe (PID: 7368)

    • FORMBOOK has been detected (YARA)

      • control.exe (PID: 6808)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Purchase Order-P54477890.exe (PID: 7368)

    • Reads security settings of Internet Explorer

      • Purchase Order-P54477890.exe (PID: 7368)

    • The process executes VB scripts

      • Purchase Order-P54477890.exe (PID: 7368)

    • Starts CMD.EXE for commands execution

      • control.exe (PID: 6808)

    • Deletes system .NET executable

      • cmd.exe (PID: 2384)

  • INFO

    • Reads the computer name

      • Purchase Order-P54477890.exe (PID: 7368)
      • vbc.exe (PID: 1852)

    • .NET Reactor protector has been detected

      • Purchase Order-P54477890.exe (PID: 7368)

    • Checks supported languages

      • Purchase Order-P54477890.exe (PID: 7368)
      • vbc.exe (PID: 1852)

    • Reads the machine GUID from the registry

      • Purchase Order-P54477890.exe (PID: 7368)

    • Creates files or folders in the user directory

      • Purchase Order-P54477890.exe (PID: 7368)

    • Process checks computer location settings

      • Purchase Order-P54477890.exe (PID: 7368)

    • Create files in a temporary directory

      • Purchase Order-P54477890.exe (PID: 7368)

    • Manual execution by a user

      • control.exe (PID: 6808)
      • autoconv.exe (PID: 7212)

    • Reads the software policy settings

      • slui.exe (PID: 7448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Formbook

(PID) Process(6808) control.exe
C2www.cav154.vip/bi14/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ilansocials.online
rishticodiegfortyseven.online
ostase-ba.cfd
cinema.tech
omprasyacol.store
esir.shop
umhyal3gvbpl.xyz
lurv.wtf
aospin-sms.xyz
itness-apps-workout1.sbs
reshcarluxury.shop
3xq3.cyou
erraceheatpassion.lifestyle
octurasys.net
ilyrug.net
yj889.xyz
railertof.net
4270766.xyz
sduoduo11.sbs
oeboom.net
27.social
onceiveremarknumber.lifestyle
lectric-cars-topics.sbs
helondonsculptureprize.net
odkinpodcast.online
uori-usa-store.shop
e-s.net
yk8.xyz
4khm.top
inrars.net
angshopbb25l.top
efrigerators-71721.bond
rdiamond.shop
etpass.info
tuber.vip
xtoolbox-report.net
enkyo.fun
qih.tech
8hng.top
luearcmanufacturing.net
xiyfc.info
ertad.xyz
89wins.world
takefish.run
rendzystore.net
3212.art
owerzone188.shop
etforge.tech
onbaliilezzetustalari.xyz
reativ-server.net
o-smartphones-cc82f689.bond
igocorporation.online
xjxp.town
loot.tel
2hmyznrex.xyz
nivy.shop
202.loan
tv5pp.top
elehot.info
zieply.xyz
60vf6.cfd
rg-hctgic.vip
andweg.shop
8295.locker
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:16 02:34:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 676352
InitializedDataSize: 6144
UninitializedDataSize: -
EntryPoint: 0xa706e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.4193
ProductVersionNumber: 2.0.0.4193
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Alexander_Unit4
CompanyName: Alexander_Unit4
FileDescription: -
FileVersion: 2.0.0.4193
InternalName: VFbu.exe
LegalCopyright: Alexander_Unit4 2025
LegalTrademarks: -
OriginalFileName: VFbu.exe
ProductName: CinemaCaseProblem
ProductVersion: 2.0.0.4193
AssemblyVersion: 2.0.0.4193
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start purchase order-p54477890.exe sppextcomobj.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs autoconv.exe no specs #FORMBOOK control.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1852"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe—Purchase Order-P54477890.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
14.8.9037.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2384/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\SysWOW64\cmd.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4108"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe—Purchase Order-P54477890.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
4294967295
Version:
14.8.9037.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4736"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe—Purchase Order-P54477890.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
4294967295
Version:
14.8.9037.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\vbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5508C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6808"C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\control.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Formbook
(PID) Process(6808) control.exe
C2www.cav154.vip/bi14/
Strings (79)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
systray
audiodg
certmgr
autochk
taskhost
colorcpl
services
IconCache
ThumbCache
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control: no-cache
Origin: http://
User-Agent: Mozilla Firefox/4.0
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://
Accept-Language: en-US
Accept-Encoding: gzip, deflate dat=
f-start
f-end
Decoy C2 (64)ilansocials.online
rishticodiegfortyseven.online
ostase-ba.cfd
cinema.tech
omprasyacol.store
esir.shop
umhyal3gvbpl.xyz
lurv.wtf
aospin-sms.xyz
itness-apps-workout1.sbs
reshcarluxury.shop
3xq3.cyou
erraceheatpassion.lifestyle
octurasys.net
ilyrug.net
yj889.xyz
railertof.net
4270766.xyz
sduoduo11.sbs
oeboom.net
27.social
onceiveremarknumber.lifestyle
lectric-cars-topics.sbs
helondonsculptureprize.net
odkinpodcast.online
uori-usa-store.shop
e-s.net
yk8.xyz
4khm.top
inrars.net
angshopbb25l.top
efrigerators-71721.bond
rdiamond.shop
etpass.info
tuber.vip
xtoolbox-report.net
enkyo.fun
qih.tech
8hng.top
luearcmanufacturing.net
xiyfc.info
ertad.xyz
89wins.world
takefish.run
rendzystore.net
3212.art
owerzone188.shop
etforge.tech
onbaliilezzetustalari.xyz
reativ-server.net
o-smartphones-cc82f689.bond
igocorporation.online
xjxp.town
loot.tel
2hmyznrex.xyz
nivy.shop
202.loan
tv5pp.top
elehot.info
zieply.xyz
60vf6.cfd
rg-hctgic.vip
andweg.shop
8295.locker
7212"C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Auto File System Conversion Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\autoconv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7368"C:\Users\admin\AppData\Local\Temp\Purchase Order-P54477890.exe" C:\Users\admin\AppData\Local\Temp\Purchase Order-P54477890.exe
explorer.exe
User:
admin
Company:
Alexander_Unit4
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.0.0.4193
Modules
Images
c:\users\admin\appdata\local\temp\purchase order-p54477890.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7416C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
1 078
Read events
1 078
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7368Purchase Order-P54477890.exeC:\Users\admin\AppData\Local\Temp\tmp2141.tmpxml
MD5:72781FB4F737F0DE21CA8D30D8CFAFDD
SHA256:B28BCCC3E38D6A6F3A6C8E0904170BCEFBCCCFB1A138CFA51269F16362EDFCED
7368Purchase Order-P54477890.exeC:\Users\admin\AppData\Roaming\nfERrYgNoi.exeexecutable
MD5:5AC076044272CB7878A22D6F5581FC4C
SHA256:A90BCA8C1F6A63CC34A896EB3883428FAB6FB6B4ACA385AC917FDAFCDBF9E774
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8032
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8032
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.114
  • 2.16.164.81
  • 2.16.164.9
  • 2.16.164.51
  • 2.16.164.32
  • 2.16.164.49
  • 2.16.164.72
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.3
  • 40.126.32.76
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
www.erraceheatpassion.lifestyle
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Purchase Order-P54477890.exe