top title background image
flash

EUR_Cert_3883774784847_CMR8494849.pdf.scr.exe

Status: finished
Submission Time: 2022-05-23 19:57:16 +02:00
Malicious
Trojan
Evader
GuLoader

Comments

Tags

  • exe
  • GuLoader

Details

  • Analysis ID:
    632597
  • API (Web) ID:
    1000101
  • Analysis Started:
    2022-05-23 20:00:45 +02:00
  • Analysis Finished:
    2022-05-23 21:02:02 +02:00
  • MD5:
    f51029776cf59c102ed0e1c757484e8b
  • SHA1:
    2331eaecdd1da03fc229c8639cddc03ccc34e18f
  • SHA256:
    aac13b3f25b043fcc1baaa1481ab241a4845ff0d978fe86a455deaf28cedd352
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 80
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 88
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

malicious
Score: 17/68
malicious
Score: 9/41

IPs

IP Country Detection
166.62.28.114
United States

Domains

Name IP Detection
graphicdes.com
166.62.28.114
dual-a-0001.dc-msedge.net
131.253.33.200
e-0009.e-msedge.net
13.107.5.88

URLs

Name Detection
http://graphicdes.com/bin_MpLvP21.bin
http://graphicdes.com/
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Click to see the 11 hidden entries
http://graphicdes.com/bin_MpLvP21.binr
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
http://nsis.sf.net/NSIS_ErrorError
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
http://www.gopher.ftp://ftp.
http://graphicdes.com/bin_MpLvP21.binA
http://graphicdes.com/bin_MpLvP21.binrN
https://github.com/dotnet/runtime
https://aka.ms/dotnetquic

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Airplane_14.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
#
C:\Users\user\AppData\Local\Temp\Baglommerne127.ini
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\Colluvia.wad
data
#
Click to see the 5 hidden entries
C:\Users\user\AppData\Local\Temp\System.Net.Quic.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Undergaaedes.ini
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\euda.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
#
C:\Users\user\AppData\Local\Temp\folder-drag-accept-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\nshBA9E.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#