We are hiring! Windows Kernel Developer (Remote), apply here!
flash

CV.bat.exe

Status: finished
Submission Time: 2022-10-03 15:45:17 +02:00
Malicious
Trojan
Spyware
Evader
FormBook

Comments

Tags

  • exe
  • Formbook

Details

  • Analysis ID:
    715070
  • API (Web) ID:
    1082509
  • Analysis Started:
    2022-10-03 15:54:25 +02:00
  • Analysis Finished:
    2022-10-03 16:05:05 +02:00
  • MD5:
    40372d67f0de4526f04fba7948f7ff02
  • SHA1:
    f1c8f97bd587125f6c48fb5e80bd191bff253a97
  • SHA256:
    8bdbc254d871d5f2ffbdc50ea20070910cfa9c1be2b114ae1077ebc7b6d245d2
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
24/69

malicious
14/42

IPs

IP Country Detection
91.195.240.94
Germany
63.141.242.46
United States

Domains

Name IP Detection
www.yaignars.site
91.195.240.94
www.miarizzuto.org
63.141.242.46
www.hipnoterapia.store
0.0.0.0

URLs

Name Detection
www.miarizzuto.org/redb/
http://www.yaignars.site/redb/?SrNH_=ZbLl4nlXWVx&WvMH=sSqPgCldjkbi0+fTeRrTo1yeRkXijBFS3eCOWeLwWqlRfT02SfRof0res+4jmsjJUPdu+dXwzSVFQdySZWLfkZF8oXotr+qwUQ==
http://www.yaignars.site/redb/
Click to see the 43 hidden entries
http://www.miarizzuto.org/redb/?SrNH_=ZbLl4nlXWVx&WvMH=ClEE/ZchhSWI9Fw4wt/3uVHiPVKnhBdsoB1lL7XTwBZGLskW0dT3J+GyfBiSRlOqjq3/13+wQlUMF9TRa7Zw+CqEhvu+ka1r7A==
http://www.fontbureau.com/designers8
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-jones.html
http://www.jiyu-kobo.co.jp/
http://www.galapagosdesign.com/DPlease
https://ac.ecosia.org/autocomplete?q=
http://www.fontbureau.comgrito
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.sakkal.com
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
http://survey-smiles.com
https://www.name.com/domain/renew/yaignars.site?utm_source=Sedo_parked_page&utm_medium=button&utm_ca
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.fontbureau.com/designersG
https://duckduckgo.com/ac/?q=
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
http://www.fontbureau.com/designers?
http://img.sedoparking.com
https://search.yahoo.com?fr=crmas_sfpf
https://search.yahoo.com?fr=crmas_sfp
http://www.tiro.com
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
http://www.carterandcone.coml
http://www.sajatypeworks.com
https://www.sedo.com/services/parking.php3
http://www.typography.netD
https://duckduckgo.com/chrome_newtab

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CV.bat.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmpE00F.tmp
XML 1.0 document, ASCII text
#
C:\Users\user\AppData\Roaming\PzKpucfDtCCmww.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 5 hidden entries
C:\Users\user\AppData\Roaming\PzKpucfDtCCmww.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m0l2oodl.mld.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rejx5zel.xcw.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\f-0386u9
SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4
#