top title background image
flash

pago.exe

Status: finished
Submission Time: 2022-05-25 16:57:19 +02:00
Malicious
Trojan
Evader
GuLoader

Comments

Tags

Details

  • Analysis ID:
    634161
  • API (Web) ID:
    1001656
  • Analysis Started:
    2022-05-25 17:09:36 +02:00
  • Analysis Finished:
    2022-05-25 17:18:07 +02:00
  • MD5:
    41db491c763c2aa61a8f4305591e3139
  • SHA1:
    20c45ae71feccf738620764f70154f0ac5b6ac59
  • SHA256:
    904211f6f92bb8e96d8a56077c3b95ed22c746ee17caf7fb769d786821521585
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 80
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301

Third Party Analysis Engines

malicious
Score: 21/66

IPs

IP Country Detection
216.58.212.174
United States

Domains

Name IP Detection
dual-a-0001.a-msedge.net
204.79.197.200
drive.google.com
216.58.212.174
e-0009.e-msedge.net
13.107.5.88

URLs

Name Detection
https://drive.google.com/m
http://subca.ocsp-certum.com01
https://drive.google.com/s11F
Click to see the 31 hidden entries
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
http://crl.certum.pl/ctnca2.crl0l
http://repository.certum.pl/ctnca2.cer09
https://drive.google.com/n
https://csp.wit_D
https://drive.google.com/crosoft
http://subca.ocsp-certum.com02
https://csp.witbh
https://github.com/dotnet/runtimeBSJB
https://drive.google.com/S1
https://drive.google.com/%
http://www.certum.pl/CPS0
https://drive.google.com/ificate
https://drive.google.com/a
http://nsis.sf.net/NSIS_ErrorError
http://repository.certum.pl/ctnca.cer09
https://drive.google.com/#1
https://drive.google.com/c1
http://crl.certum.pl/ctnca.crl0k
https://csp.wit
https://drive.google.com/q
https://drive.google.com/0
https://drive.google.com/GlobalSign
http://crl.certum.pl/ctsca2021.crl0o
https://drive.google.com/F
https://github.com/dotnet/runtime
https://drive.google.com/C1
http://repository.certum.pl/ctsca2021.cer0
http://subca.ocsp-certum.com05
https://drive.google.com/
https://drive.google.com/ertificates

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\Adventure_15.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
#
C:\Users\user\AppData\Local\Temp\BRUGERMSSIGE.dis
data
#
C:\Users\user\AppData\Local\Temp\Lovprisendes8.omb
ASCII text, with very long lines, with no line terminators
#
Click to see the 4 hidden entries
C:\Users\user\AppData\Local\Temp\System.Runtime.CompilerServices.VisualC.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\application-exit-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Temp\nsq24BD.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\process-stop-symbolic.svg
SVG Scalable Vector Graphics image
#