flash

file.exe

Status: finished
Submission Time: 2023-01-25 10:16:08 +01:00
Malicious
Trojan
Evader
Nymaim

Comments

Tags

  • exe

Details

  • Analysis ID:
    791306
  • API (Web) ID:
    1158569
  • Analysis Started:
    2023-01-25 10:16:08 +01:00
  • Analysis Finished:
    2023-01-25 10:25:11 +01:00
  • MD5:
    209dca1a9633807b9cf36d6447f972da
  • SHA1:
    c4235ac91cd8e3c0e70ede54e43f857709f00859
  • SHA256:
    2004da2c60d73a66c6feffe50f130483750da799b90a78c76da90f61208101e6
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
92/100

malicious
24/40

IPs

IP Country Detection
45.12.253.72
Germany
45.12.253.75
Germany
45.12.253.98
Germany
Click to see the 1 hidden entries
45.12.253.56
Germany

URLs

Name Detection
http://45.12.253.72/default/stuk.php
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte
http://45.12.253.72/default/puk.php
Click to see the 20 hidden entries
http://45.12.253.75/dll.php
http://45.12.253.75/dll.phpx
http://45.12.253.75/dll.phpc
http://45.12.253.72/default/stuk.php2N
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinteeF
http://nbafrog.com/.
http://nbafrog.com/
http://www.remobjects.com/ps
http://45.12.253.75/dll.phpr
http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinteY
http://www.finalrecovery.com/buy.htm
http://45.12.253.75/dll.phprl
http://45.12.253.75/dll.phpQ
http://45.12.253.75/dll.phpi
http://45.12
http://45.12.253.75/dll.phpL
http://45.12.253.75/dll.phpK
http://www.remobjects.com/psU
http://45.12.253.75/dll.phpd
http://www.innosetup.com/

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\FgasoftFR\FinalRecovery\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\{e6e9dfa8-98f2-11e9-90ce-806e6f6e6963}\wEQg8.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-P0SS2.tmp\file.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 21 hidden entries
C:\Users\user\AppData\Local\Temp\is-J872N.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-J872N.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-J872N.tmp\_isetup\_RegDLL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\Preview.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-J1RPT.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-H9OSH.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\finalrecovery.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-I8MHH.tmp
MS Windows HtmlHelp Data
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-6R8AD.tmp
ASCII text, with CRLF line terminators
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\unins000.dat
InnoSetup Log FgasoftFR FinalRecovery, version 0x30, 4340 bytes, 701188\user, "C:\Program Files (x86)\FgasoftFR\FinalRecovery"
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\is-13C1Q.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fuckingdllENCR[1].dll
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\stuk[1].htm
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dll[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dll[1].htm
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\plus[1].htm
very short file (no magic)
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\finalrecovery.chm (copy)
MS Windows HtmlHelp Data
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\data\is-CFA7P.tmp
XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\is-J872N.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\data\Config.xml (copy)
XML 1.0 document, ASCII text, with very long lines (5978), with CRLF line terminators
#
C:\Program Files (x86)\FgasoftFR\FinalRecovery\Readme.txt (copy)
ASCII text, with CRLF line terminators
#