top title background image
flash

file.exe

Status: finished
Submission Time: 2023-01-25 10:01:05 +01:00
Malicious
Trojan
Evader
Nymaim

Comments

Tags

  • exe

Details

  • Analysis ID:
    791301
  • API (Web) ID:
    1158564
  • Analysis Started:
    2023-01-25 10:01:06 +01:00
  • Analysis Finished:
    2023-01-25 10:10:16 +01:00
  • MD5:
    14e09c7a5842688842f6c0bf61c17135
  • SHA1:
    4c9e1cbcd933293268c396b3c79f3836665059a8
  • SHA256:
    a5ce2c21d3f92080a06e0aa7862303848b2661181b279a2db9b72b8f31a82702
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 92
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 24/40

IPs

IP Country Detection
45.12.253.72
Germany
45.12.253.75
Germany
45.12.253.98
Germany
Click to see the 1 hidden entries
45.12.253.56
Germany

URLs

Name Detection
http://45.12.253.72/default/stuk.php
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte
http://45.12.253.72/default/puk.php
Click to see the 11 hidden entries
http://45.12.253.75/dll.php
http://www.innosetup.com/
http://www.remobjects.com/psU
http://45.12.253.75/dll.phpI
http://45.12.253.72/default/puk.phpk
http://nbafrog.com/b
http://www.finalrecovery.com/buy.htm
http://45.12.253.72/default/stuk.phpE
http://www.remobjects.com/ps
http://nbafrog.com/
http://nbafrog.com/.

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\FgasoftFR\FinalRecovery\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\6tohc1clzbcir.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-HGAMR.tmp\file.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 21 hidden entries
C:\Users\user\AppData\Local\Temp\is-EFH65.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-EFH65.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-EFH65.tmp\_isetup\_RegDLL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\Preview.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-U89TP.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-RVFGU.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\finalrecovery.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-8DPO5.tmp
data
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-587OJ.tmp
ASCII text, with CRLF line terminators
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\unins000.dat
InnoSetup Log FgasoftFR FinalRecovery, version 0x30, 4340 bytes, 585948\user, "C:\Program Files (x86)\FgasoftFR\FinalRecovery"
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-05LH6.tmp
MS Windows HtmlHelp Data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fuckingdllENCR[1].dll
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\stuk[1].htm
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dll[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dll[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\plus[1].htm
very short file (no magic)
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\finalrecovery.chm (copy)
MS Windows HtmlHelp Data
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\data\is-K2TAS.tmp
XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\is-EFH65.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\data\Config.xml (copy)
XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\Readme.txt (copy)
ASCII text, with CRLF line terminators
#