Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 23 19:11:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Chrome Cache Entry: 103

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 104

gzip compressed data, from Unix, original size modulo 2^32 37304

downloaded

Chrome Cache Entry: 105

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 106

gzip compressed data, from Unix, original size modulo 2^32 20691

downloaded

Chrome Cache Entry: 107

PNG image data, 1117 x 1028, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 108

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 566x236, components 3

dropped

Chrome Cache Entry: 109

gzip compressed data, from Unix, original size modulo 2^32 1389

downloaded

Chrome Cache Entry: 110

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 20x20, components 3

downloaded

Chrome Cache Entry: 111

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=13, height=2160, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=3840], progressive, precision 8, 3840x2160, components 3

downloaded

Chrome Cache Entry: 112

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 475x361, components 3

dropped

Chrome Cache Entry: 113

gzip compressed data, from Unix, original size modulo 2^32 86927

downloaded

Chrome Cache Entry: 114

ASCII text, with very long lines (625)

downloaded

Chrome Cache Entry: 118

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=12, height=460, bps=158, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x460, components 3

downloaded

Chrome Cache Entry: 119

dropped

Chrome Cache Entry: 120

gzip compressed data, from Unix, original size modulo 2^32 96419

downloaded

Chrome Cache Entry: 123

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1028, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1117], progressive, precision 8, 1028x1028, components 3

downloaded

Chrome Cache Entry: 124

gzip compressed data, from Unix, original size modulo 2^32 23316

downloaded

Chrome Cache Entry: 127

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 24x24, components 3

downloaded

Chrome Cache Entry: 128

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 131

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 500x155, components 3

downloaded

Chrome Cache Entry: 132

gzip compressed data, from Unix, original size modulo 2^32 20562

downloaded

Chrome Cache Entry: 135

gzip compressed data, from Unix, original size modulo 2^32 21404

downloaded

Chrome Cache Entry: 138

gzip compressed data, from Unix, original size modulo 2^32 7578

downloaded

Chrome Cache Entry: 140

gzip compressed data, from Unix, original size modulo 2^32 17218

downloaded

Chrome Cache Entry: 141

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 24x24, components 3

dropped

Chrome Cache Entry: 145

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 147

gzip compressed data, from Unix, original size modulo 2^32 6079

downloaded

Chrome Cache Entry: 151

JPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, baseline, precision 8, 1908x198, components 3

dropped

Chrome Cache Entry: 155

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 24x24, components 3

downloaded

Chrome Cache Entry: 156

gzip compressed data, from Unix, original size modulo 2^32 21556

downloaded

Chrome Cache Entry: 157

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1162, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], progressive, precision 8, 139x81, components 3

dropped

Chrome Cache Entry: 158

dropped

Chrome Cache Entry: 159

PNG image data, 560 x 97, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 160

gzip compressed data, from Unix, original size modulo 2^32 1333

downloaded

Chrome Cache Entry: 162

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 165

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1117x1028, components 3

downloaded

Chrome Cache Entry: 166

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 212x95, components 3

downloaded

Chrome Cache Entry: 167

gzip compressed data, from Unix, original size modulo 2^32 7603

downloaded

Chrome Cache Entry: 168

gzip compressed data, from Unix, original size modulo 2^32 9174

downloaded

Chrome Cache Entry: 93

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 232x109, components 3

downloaded

Chrome Cache Entry: 94

downloaded

Chrome Cache Entry: 99

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=833, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=968], progressive, precision 8, 62x61, components 3

dropped

There are 39 hidden files, click here to show them.

URLs

Name

Malicious

http://www.finelandip.com/

http://www.finelandip.com/uploads/20200506/e840f462a48fabde886960789d4f7d73.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/jquery.min.js

47.89.47.240

http://www.finelandip.com/uploads/20190919/55d943c3526fd62ae450a925ae86434f.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/css/swiper.min.css

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/swiperTab.js

47.89.47.240

http://www.finelandip.com/uploads/20220324/5bfe625138e40887b465e7f08bac8c5b.png

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/logo.jpg

47.89.47.240

http://www.finelandip.com/uploads/20240415/53eb77b45613be8230160a2eb16c4f8a.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/css/css.css

47.89.47.240

http://www.finelandip.com/en/index.php

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/css/swiper.min.css

47.89.47.240

http://www.finelandip.com/uploads/20230525/d71031f83676d089056d16aeb903ecca.jpg

47.89.47.240

http://www.finelandip.com/uploads/20231109/9a969ac668dd6fc5fdad18f603bbd1f6.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/icon_news.jpg

47.89.47.240

http://www.finelandip.com/uploads/20240415/974c118570054ff748f4224fba5316ed.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/icon_language.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/icon_about.jpg

47.89.47.240

http://www.finelandip.com/en//uploads/20230906/065f4623bbfee2cd9334bb51191eb008.jpg

47.89.47.240

http://www.finelandip.com/uploads/20230907/bd1d68f5a243f1571cb8c705650aea46.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/modernizr.custom.js

47.89.47.240

http://www.finelandip.com/en/uploads/20191113/19004cc505114a0d927f30eb7be8f9ad.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/css/font-awesome.css

47.89.47.240

http://www.finelandip.com/uploads/20230907/6e5e88a8fb3e1fd1dfc17e7628292499.jpg

47.89.47.240

http://www.finelandip.com/uploads/20230907/dbe044291520b2bb7ede3d9739395585.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/footer_logo.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/icon_case.jpg

47.89.47.240

http://www.finelandip.com/uploads/20200506/a958d3497833bbb1364962ae99f4d4b9.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/css/font-awesome.css

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/swiper.min.js

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/modernizr.custom.js

47.89.47.240

http://www.finelandip.com/uploads/20220623/36a072e4f020fdbf0a450a1b174b867b.png

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/common.js

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/icon_about.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/swiper.min.js

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/jquery.dlmenu.js

47.89.47.240

http://www.finelandip.com/

http://www.finelandip.com/uploads/20230907/272b7a32ed1206dd807eae744099d749.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/jquery.dlmenu.js

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/img/logo.jpg

47.89.47.240

http://www.finelandip.com/uploads/20190919/f8d2d305fcc559d17128a53a72f5888e.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/css/common.css

47.89.47.240

http://www.finelandip.com/uploads/20231109/09acdd6a4ce2c96a6a2da584c6a620a9.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/css/css.css

47.89.47.240

http://www.finelandip.com/uploads/20190919/bd48f759269beb00190cd946d1dfdad8.jpg

47.89.47.240

http://www.finelandip.com/uploads/20220715/0615753db414cf8aa4e3cfb2bc076e9e.png

47.89.47.240

http://www.finelandip.com/uploads/20240109/6660bc2bf6d36513ebec0a959b1568f5.png

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/icon_language.jpg

47.89.47.240

http://www.finelandip.com/uploads/20230906/507adc233d2062684bec205a4f7d1675.jpg

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/css/common.css

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/swiperTab.js

47.89.47.240

http://www.finelandip.com/en/yadotemp/yado/static/js/jquery.min.js

47.89.47.240

http://www.finelandip.com/favicon.ico

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/icon_case.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/footer_logo.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/img/icon_news.jpg

47.89.47.240

http://www.finelandip.com/yadotemp/yado/static/js/common.js

47.89.47.240

There are 46 hidden URLs, click here to show them.

Domains

Name

Malicious

www.finelandip.com

47.89.47.240

Details

Name:	www.finelandip.com
IP:	47.89.47.240
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

74.125.136.103

hm.e.shifen.com

183.240.98.228

qiniu.fengdumao.cn

unknown

hm.baidu.com

unknown

IPs

Domain

Country

Malicious

64.233.185.100

unknown

United States

1.1.1.1

unknown

Australia

239.255.255.250

unknown

Reserved

142.250.105.84

unknown

United States

183.240.98.228

hm.e.shifen.com

China

64.233.185.94

unknown

United States

47.89.47.240

www.finelandip.com

United States

192.168.2.16

unknown

172.217.215.94

unknown

United States

74.125.136.103

www.google.com

United States

142.250.105.138

unknown

United States

There are 1 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://www.finelandip.com/

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://www.finelandip.com/

Files

URLs

Domains

IPs

IOC Report
http://www.finelandip.com/