top title background image
flash

pago.exe

Status: finished
Submission Time: 2022-05-25 16:39:29 +02:00
Malicious
Trojan
Evader
GuLoader

Comments

Tags

Details

  • Analysis ID:
    634139
  • API (Web) ID:
    1001642
  • Analysis Started:
    2022-05-25 16:46:01 +02:00
  • Analysis Finished:
    2022-05-25 17:09:36 +02:00
  • MD5:
    41db491c763c2aa61a8f4305591e3139
  • SHA1:
    20c45ae71feccf738620764f70154f0ac5b6ac59
  • SHA256:
    904211f6f92bb8e96d8a56077c3b95ed22c746ee17caf7fb769d786821521585
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 72
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 80
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

malicious
Score: 21/66

IPs

IP Country Detection
142.250.185.78
United States

Domains

Name IP Detection
drive.google.com
142.250.185.78

URLs

Name Detection
http://repository.certum.pl/ctnca2.cer09
http://subca.ocsp-certum.com05
https://drive.google.com/
Click to see the 41 hidden entries
https://drive.google.com/V
https://drive.google.com/ertificates
https://drive.google.com/vy
http://subca.ocsp-certum.com02
http://subca.ocsp-certum.com01
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
https://drive.google.com/gN
http://crl.certum.pl/ctnca2.crl0l
https://drive.google.com/X
https://drive.google.com/tagservices-cn.com
https://drive.google.com/crosoft
https://github.com/dotnet/runtimeBSJB
https://drive.google.com/Fx
https://drive.google.com/_1
http://www.certum.pl/CPS0
https://drive.google.com/;N
https://drive.google.com/d
https://csp.wit?_
https://drive.google.com/a
https://drive.google.com/N
https://drive.google.com/Nx
http://crl.certum.pl/ctsca2021.crl0o
http://repository.certum.pl/ctnca.cer09
http://crl.certum.pl/ctnca.crl0k
https://drive.google.com/pNA
https://drive.google.com/or
https://csp.wit
https://drive.google.com/r
https://drive.google.com/&xx
https://drive.google.com/0
https://drive.google.com/EN
https://csp.wit=
http://nsis.sf.net/NSIS_ErrorError
https://drive.google.com/D
https://csp.wit;
https://drive.google.com/:O
https://csp.wit9
https://github.com/dotnet/runtime
https://csp.wit%Z
https://drive.google.com/DO
http://repository.certum.pl/ctsca2021.cer0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Adventure_15.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
#
C:\Users\user\AppData\Local\Temp\BRUGERMSSIGE.dis
data
#
C:\Users\user\AppData\Local\Temp\Lovprisendes8.omb
ASCII text, with very long lines, with no line terminators
#
Click to see the 4 hidden entries
C:\Users\user\AppData\Local\Temp\System.Runtime.CompilerServices.VisualC.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\application-exit-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\nsrF138.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\process-stop-symbolic.svg
SVG Scalable Vector Graphics image
#