flash

open_attach_p2y.js

Status: finished
Submission Time: 08.04.2020 18:17:03
Malicious
E-Banking Trojan
Trojan
Evader
Gozi Ursnif

Comments

Tags

Details

  • Analysis ID:
    221263
  • API (Web) ID:
    339265
  • Analysis Started:
    08.04.2020 18:17:17
  • Analysis Finished:
    08.04.2020 18:29:50
  • MD5:
    d42f0d033004da6f8d6c67dfa6239cee
  • SHA1:
    59dbf0d280a8d5a56bb468a21b991e1b91625e82
  • SHA256:
    52a938584535c7a03fe06b7fae2ee6f0e912fcc8dd5f294e753abbd2d16b46a8
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
52/100

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Without Instrumentation

malicious
100/100

malicious
37/71

malicious
17/31

IPs

IP Country Detection
8.208.90.28
Singapore

Domains

Name IP Detection
f1.pipen.at
8.208.90.28
site-cdn.onenote.net
0.0.0.0

URLs

Name Detection
http://f1.pipen.at/api1/zf1YyM2D0qq/dv4HwKjvoGPS84/1qhH0K2Xek6YAh6tR0XIZ/pt0xfW_2FFptMyf2/ZDsbpSWyWxuLMgH/IBjLU1JBy0ys9i47vh/XmWMKbee4/6utCB3SHvGD3dRCl6sYn/J8QKxa9bhRYimjIIdrp/kkTm5Bz0hbdye_2BJwZ_2F/oZ6uMwPcYtz3Q/FoX03Kzm/jsy5Ty7DBaSG6MrU3vzWADc/9UJzFpne21/4zPh7s5qA6tPioCev/hWASaIklH0Tr/fMOezL9gwN_/0A_0DtLNCKqGgL/FdN2o0U0x2Tlot6a_2B0C/R_2FekczxIvK_2FZ/5bj5tYMNOYqD02F/k3itIA5kMRr2/y
http://https://file://USER.ID%lu.exe/upd
http://f1.pipen.at/api1/SfejCnwg/ObplLX6lgqMk8x5IYWyrQjz/Y2O4fs9mMk/g5eoex0bDl2DvVF1v/M6uzzMMscZde/GqXc2_2Fkiz/zIy5mXztZodBE_/2BxIFhanp_2B_2FgecwGc/qXbCjchMnq9d_2By/xSFy96cXsi_2Bvr/jZWSdrxEZ_2FqHfmDa/9HxiAkDke/iIPkW0ZGIi5a33pJqTQH/aG7V2XSvT4EaW83Zj4J/tBE_2F6g93SgF3rtATdt5C/BL39vJst0BmSb/_2FBNEbv/okmko2ExQMasUC_0A_0DgT_/2BfvRPq9FB/V8RUUgp9vepqYVcH3/KNlus3r_2FFs/hrai0uc9_2F/EMRkNVI3sBXy7Y/WDCf_2Fx/k
Click to see the 30 hidden entries
http://f1.pipen.at/api1/6_2FDqSOD/Nk1aDFtDzHFZEtdiGRH1/QXQBDQuGv8v8VDMhp2g/pBdt89kIiYQRHDo0EPzHC2/8blZ6Yv3GjwVY/JdLmBNGZ/1F_2FnBXN3pWZ769LwlJ0h6/FYzf5_2FJ_/2B9zcaBBY_2FLlTrJ/6Ik6vh3a07Fs/e66v5UzvBUU/YM_2FNpy_2FO8O/8fHd5dLpW7b5T3w_2FHGz/TB0wHf0r74ASXqdk/6Qv_2F1BCk0UWrC/jL_2BjDr37HaZYTT4C/0t0fW_2FF/Ql3e_2BsjcQKPuyNjli_/0A_0DOnCHUgIBBaHF_2/BHKaMuJ7glp5Ijo6QnQeNb/acEhs1lCg1RH7/R_2BMA_2/BJAOnfc9Rm5Gu/HjD_2F
http://f1.pipen.at/favicon.ico
http://f1.pipen.at/api1/zf1YyM2D0qq/dv4HwKjvoGPS84/1qhH0K2Xek6YAh6tR0XIZ/pt0xfW_2FFptMyf2/ZDsbpSWyWx
http://f1.pipen.at/api1/SfejCnwg/ObplLX6lgqMk8x5IYWyrQjz/Y2O4fs9mMk/g5eoex0bDl2DvVF1v/M6uzzMMscZde/G
http://f1.pipen.at/api1/6_2FDqSOD/Nk1aDFtDzHFZEtdiGRH1/QXQBDQuGv8v8VDMhp2g/pBdt89kIiYQRHDo0EPzH
http://www.apache.org/licenses/LICENSE-2.0
http://www.nytimes.com/
http://www.founder.com.cn/cn/bThe
http://constitution.org/usdeclar.txtC:
http://www.tiro.com
http://www.amazon.com/
http://www.goodfont.co.kr
http://www.twitter.com/
http://www.carterandcone.coml
http://www.sajatypeworks.com
http://www.typography.netD
http://www.founder.com.cn/cn/cThe
http://fontfabrik.com
http://www.founder.com.cn/cn
http://constitution.org/usdeclar.txt
http://www.youtube.com/
http://ns.adob1
http://www.jiyu-kobo.co.jp/
http://www.wikipedia.com/
http://www.fonts.com
http://www.sandoll.co.kr
http://www.live.com/
http://www.zhongyicts.com.cn
http://www.reddit.com/
http://www.sakkal.com

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\TsCrxrp.txt
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
Click to see the 14 hidden entries
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5oopjb0r.x2k.ps1
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orivl5po.cot.psm1
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\zwpCU.yVwpxaM
ASCII text, with no line terminators
#
C:\Users\user\Documents\20200408\PowerShell_transcript.305090.zSf3P6YK.20200408182324.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#