We are hiring! Windows Kernel Developer (Remote), apply here!
flash

file.exe

Status: finished
Submission Time: 2022-11-24 19:17:05 +01:00
Malicious
Trojan
Evader
Nymaim

Comments

Tags

  • exe

Details

  • Analysis ID:
    753410
  • API (Web) ID:
    1120693
  • Analysis Started:
    2022-11-24 19:17:06 +01:00
  • Analysis Finished:
    2022-11-24 19:25:39 +01:00
  • MD5:
    7e8888d098d8af9b7f7d1a39ff7666a4
  • SHA1:
    3301535903ea09ddc389f1fc3d67fd45e8215526
  • SHA256:
    64bbb72159a4bdfd522ae703ee76a1c63e8ca6ba297cb2ee8634357909a50738
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
96/100

malicious
9/89

malicious
12/26

malicious

IPs

IP Country Detection
45.139.105.1
Italy
85.31.46.167
Germany
45.139.105.171
Italy
Click to see the 2 hidden entries
107.182.129.235
Reserved
171.22.30.106
Germany

URLs

Name Detection
http://171.22.30.106/library.phpV
http://171.22.30.106/library.php
http://171.22.30.106/library.php:
Click to see the 20 hidden entries
http://171.22.30.106/library.php~
http://171.22.30.106/library.php0
http://171.22.30.106/library.phpB
http://171.22.30.106/library.phpjN
http://171.22.30.106/library.phpH
http://171.22.30.106/library.php&
http://171.22.30.106/library.phpj
http://www.remobjects.com/?psU
http://pfolders.atopoint.com.
http://www.innosetup.comDVarFileInfo$
http://www.atopoint.com.
http://107.182.129.235/storage/ping.php
http://www.innosetup.com
http://pfolders.atopoint.com
http://www.remobjects.com/?ps
http://107.182.129.235/storage/extension.php
http://45.139.105.171/itsnotmalware/count.php?sub=NOSUB&stream=mixtwo&substream=mixinte
http://www.atopoint.com
http://pfolders.atopoint.com2
http://www.innosetup.com/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\CqxAaSZxg.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-F6DC2.tmp\is-71GCF.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\PrintFolders\PrintFolders.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
Click to see the 20 hidden entries
C:\Program Files (x86)\PrintFolders\Russian.dll (copy)
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\PrintFolders\is-6QPAJ.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\PrintFolders\is-JPR4D.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\PrintFolders\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\PrintFolders\unins000.dat
InnoSetup Log PrintFolders {73D78C7A-78F2-476F-86FF-9025EA410908}, version 0x2a, 3814 bytes, 992547\user, "C:\Program Files (x86)\PrintFolders"
#
C:\Users\user\AppData\Local\Temp\is-2LA91.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\ping[1].htm
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\library[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\library[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\count[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\fuckingdllENCR[1].dll
data
#
C:\Program Files (x86)\PrintFolders\Guide.chm (copy)
MS Windows HtmlHelp Data
#
C:\Program Files (x86)\PrintFolders\is-U4GGJ.tmp
MS Windows HtmlHelp Data
#
C:\Program Files (x86)\PrintFolders\is-D385T.tmp
ASCII text, with CRLF line terminators
#
C:\Program Files (x86)\PrintFolders\is-B2P4P.tmp
RAGE Package Format (RPF),
#
C:\Program Files (x86)\PrintFolders\is-3PESN.tmp
data
#
C:\Program Files (x86)\PrintFolders\License.txt (copy)
RAGE Package Format (RPF),
#
C:\Program Files (x86)\PrintFolders\History.txt (copy)
ASCII text, with CRLF line terminators
#