top title background image
flash

documentazione 68668.xls

Status: finished
Submission Time: 2022-08-06 09:16:27 +02:00
Malicious
Trojan
Exploiter
Evader
Hidden Macro 4.0, Emotet

Comments

Tags

Details

  • Analysis ID:
    679676
  • API (Web) ID:
    1047182
  • Analysis Started:
    2022-08-06 09:19:17 +02:00
  • Analysis Finished:
    2022-08-06 09:26:26 +02:00
  • MD5:
    a4c856aa217eab1f66dfade13f701013
  • SHA1:
    c4bd8e7e5cbb3e8038186851e7eb9ee65007c64d
  • SHA256:
    51737c16eed7b848b37b843555c7bda5ead1f418fbadb8def452d287d0817179
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

malicious
Score: 32/58
malicious
Score: 14/35
malicious
Score: 23/26
malicious
malicious

IPs

IP Country Detection
202.134.4.210
Indonesia
128.199.217.206
United Kingdom
116.124.128.206
Korea Republic of
Click to see the 42 hidden entries
103.224.241.74
India
103.71.99.57
India
210.57.209.142
Indonesia
202.28.34.99
Thailand
87.106.97.83
Germany
103.254.12.236
Viet Nam
103.85.95.4
Indonesia
54.37.228.122
France
103.126.216.86
Bangladesh
88.217.172.165
Germany
195.77.239.39
Spain
165.22.254.236
United States
78.47.204.80
Germany
118.98.72.86
Indonesia
104.244.79.94
United States
37.44.244.177
Germany
178.62.112.199
European Union
62.171.178.147
United Kingdom
64.227.55.231
United States
68.183.91.111
United States
157.230.99.206
United States
54.37.106.167
France
196.44.98.190
Ghana
59.148.253.194
Hong Kong
202.29.239.162
Thailand
103.41.204.169
Indonesia
36.67.23.59
Indonesia
165.22.254.68
United States
103.56.149.105
Indonesia
85.214.67.203
Germany
157.245.111.0
United States
85.25.120.45
Germany
198.199.70.22
United States
93.104.209.107
Germany
208.67.23.91
United States
188.225.32.231
Russian Federation
175.126.176.79
Korea Republic of
139.196.72.155
China
165.232.185.110
United States
104.248.225.227
United States
188.132.217.108
Turkey
66.96.149.19
United States

Domains

Name IP Detection
zardamarine.com
208.67.23.91
www.zardamarine.com
0.0.0.0
labfitouts.com
66.96.149.19
Click to see the 1 hidden entries
kronostr.com
188.132.217.108

URLs

Name Detection
https://198.199.70.22:8080/a
https://www.zardamarine.com/images/psQbAjrrEOXWPrS/
http://labfitouts.com/cgi-bin/Rea3Iu3wGvgAbTset0/
Click to see the 14 hidden entries
https://198.199.70.22:8080/e
https://198.199.70.22/B
https://165.22.254.68/O
http://kronostr.com/tr/68yHRhfuU7Qj/
https://198.199.70.22/080/F
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
http://crl.entrust.net/2048ca.crl0
https://165.22.254.68/
https://secure.comodo.com/CPS0
http://ocsp.entrust.net0D
http://www.diginotar.nl/cps/pkioverheid0
http://ocsp.entrust.net03
http://crl.entrust.net/server1.crl0
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
#
C:\Users\user\Desktop\documentazione 68668.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed (…)
#
C:\Users\user\wdusx2.ocx
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
#
Click to see the 10 hidden entries
C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy)
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61712 bytes, 1 file
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\Rea3Iu3wGvgAbTset0[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Temp\242.tmp
Composite Document File V2 Document, Cannot read section info
#
C:\Users\user\AppData\Local\Temp\Cab806.tmp
Microsoft Cabinet archive data, 61712 bytes, 1 file
#
C:\Users\user\AppData\Local\Temp\Tar807.tmp
data
#
C:\Users\user\AppData\Local\Temp\~DFA00266093586698C.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DFEE5B54DDC882DEE7.TMP
data
#
C:\Users\user\wdusx3.ocx
HTML document, ASCII text, with very long lines
#