File name:

Dhl Consignment details_pdf.exe

Full analysis: https://app.any.run/tasks/ba4b8e5c-90de-485f-9a6e-955dc2d5c68b
Verdict: Malicious activity
Threats:

FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus.

Malware Trends Tracker     >>>
Analysis date: November 26, 2023, 18:39:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
formbook
xloader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

00E2BB2624C734506ABE9D2C5BD89ADE

SHA1:

FE9CE13B890558A8C85C88CDDAFDC07FC943012B

SHA256:

E3446E1F5A6DE1C690CC7CB5CCE30547173164C67D9A4EBB6570545C69B34933

SSDEEP:

49152:WdA2SZueQtSNQO3TrszXQBpa0hZ8i2E87xWyhA+xZiuS60npDA+:d10ltSu2rke8889Wy97jS60npDA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • FORMBOOK has been detected (YARA)

      • iexpress.exe (PID: 2872)

    • Actions looks like stealing of personal data

      • iexpress.exe (PID: 2872)

    • Steals credentials

      • iexpress.exe (PID: 2872)

  • SUSPICIOUS

    • Reads the Internet Settings

      • iexpress.exe (PID: 2872)

    • Application launched itself

      • Dhl Consignment details_pdf.exe (PID: 1420)

    • Process drops SQLite DLL files

      • iexpress.exe (PID: 2872)

  • INFO

    • Checks supported languages

      • Dhl Consignment details_pdf.exe (PID: 1420)
      • Dhl Consignment details_pdf.exe (PID: 684)

    • Reads the computer name

      • Dhl Consignment details_pdf.exe (PID: 1420)

    • Checks proxy server information

      • iexpress.exe (PID: 2872)

    • Reads the machine GUID from the registry

      • Dhl Consignment details_pdf.exe (PID: 1420)

    • Create files in a temporary directory

      • iexpress.exe (PID: 2872)

    • Creates files or folders in the user directory

      • iexpress.exe (PID: 2872)

    • Manual execution by a user

      • iexpress.exe (PID: 2872)

    • Drops the executable file immediately after the start

      • iexpress.exe (PID: 2872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:24 10:22:39+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 960512
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xec7e2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Registry Initializer
FileVersion: 1.0.0.0
InternalName: Vje.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: Vje.exe
ProductName: Registry Initializer
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dhl consignment details_pdf.exe no specs dhl consignment details_pdf.exe no specs #FORMBOOK iexpress.exe explorer.exe firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Users\admin\AppData\Local\Temp\Dhl Consignment details_pdf.exe"C:\Users\admin\AppData\Local\Temp\Dhl Consignment details_pdf.exe—Dhl Consignment details_pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Initializer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dhl consignment details_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
984"C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—iexpress.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1420"C:\Users\admin\AppData\Local\Temp\Dhl Consignment details_pdf.exe" C:\Users\admin\AppData\Local\Temp\Dhl Consignment details_pdf.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Initializer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dhl consignment details_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2872"C:\Windows\SysWOW64\iexpress.exe"C:\Windows\SysWOW64\iexpress.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Wizard
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\syswow64\iexpress.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 430
Read events
2 413
Write events
17
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2872) iexpress.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2872iexpress.exeC:\Users\admin\AppData\Local\Temp\I5-s2200Nbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
2872iexpress.exeC:\Users\admin\AppData\Local\Temp\sqlite3.dllexecutable
MD5:F1E5F58F9EB43ECEC773ACBDB410B888
SHA256:A15FD84EE61B54C92BB099DFB78226548F43D550C67FB6ADF4CCE3D064AB1C14
2872iexpress.exeC:\Users\admin\AppData\Local\Temp\sqlite3.deftext
MD5:A199F89960429326AE36F645FFC387AF
SHA256:35C648FA355503C4B6608C4D482BF8C0AE34AF33D70F08172ECD43816AAAB733
2872iexpress.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\sqlite-dll-win32-x86-3380000[1].zipcompressed
MD5:5E2D04CB2FAE4E811CA35675C472F5FC
SHA256:DD46A298AB90CA9BA8A1F633F20ABE2DCB805596B5AA68DCB84CCE99E3A56BE1
2872iexpress.exeC:\Users\admin\AppData\Local\Temp\tnwlk.zipcompressed
MD5:5E2D04CB2FAE4E811CA35675C472F5FC
SHA256:DD46A298AB90CA9BA8A1F633F20ABE2DCB805596B5AA68DCB84CCE99E3A56BE1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
200
199.59.243.225:80
http://www.oasispoolsplus.com/b2ep/?ksDFfv=Pi5Fma2vmzgk1EQldaEiD30ANieeaBDUbdiBhfLv0UYNpRHaGh3/jgIKqJYA7HKTJtuA2AWjnJ33TkaM+skmXW1WUMuC/juHvX0Suh4=&PqbS=YXmg
unknown
html
1.36 Kb
unknown
2872
iexpress.exe
GET
200
45.33.6.223:80
http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
unknown
compressed
553 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1944
explorer.exe
199.59.243.225:80
www.oasispoolsplus.com
AMAZON-02
US
unknown
2872
iexpress.exe
45.33.6.223:80
www.sqlite.org
Linode, LLC
US
unknown
1944
explorer.exe
45.207.247.179:80
www.sucmyz.store
HONG KONG Megalayer Technology Co.,Limited
US
unknown

DNS requests

Domain
IP
Reputation
www.oasispoolsplus.com
  • 199.59.243.225
unknown
www.sqlite.org
  • 45.33.6.223
whitelisted
www.sucmyz.store
  • 45.207.247.179
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dhl Consignment details_pdf.exe