Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

open_attach_n2k.js

Status: finished
Submission Time: 2020-04-22 20:10:13 +02:00
Malicious
Evader
E-Banking Trojan
Trojan
Gozi Ursnif

Comments

Tags

Details

  • Analysis ID:
    224571
  • API (Web) ID:
    345726
  • Analysis Started:
    2020-04-22 20:12:01 +02:00
  • Analysis Finished:
    2020-04-22 20:25:50 +02:00
  • MD5:
    18ae4c38bd8a0801c0f3723651a38b1b
  • SHA1:
    88e3430ea7ab062013d031c7006580ea25ea216f
  • SHA256:
    344c335954ac7a0b43cd63e39ed18a085707906a7e6861578a2a08b0e672f2a0
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 56
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Without Instrumentation

Third Party Analysis Engines

Open Full Report
malicious
Score: 15/59

IPs

IP Country Detection
47.241.106.208
 United States

Domains

Name IP Detection
f1.pipen.at
 47.241.106.208
api10.dianer.at
 47.241.106.208

URLs

Name Detection
http://f1.pipen.at/api1/R1NJU94g4N/wxb9_2BTUmytHmlRp/DyOC4pGYtn71/VKpppweKVls/He_2BFZ3z9GdDj/MJ0eK3qnN7oV9up_2FdGD/EhrAIP0h8_2BexLC/9_2FKO8CDYMS5Qr/srBK9D1_2FY8n6zcMJ/C_2Fr6Xw8/lky1riXRkBzWOeAcP0w0/Gp_2BvsVBDl3A7hBzed/GL8_2FQ_2BdZEhbEncOIXV/r2Sm9iD95dRNe/Fj7eH618/2vnPhwfoDqXBj8ipFJpQLng/9LFEAV_2BE/2X88IgU6xj_2BKMZ9/1_0A_0DWT5az/_2FqBxB7vZO/S2uYdjcsIn5c5k/3v_2FtjEGqD/_2FkGXFH/Sgzr
http://f1.pipen.at/favicon.ico
http://f1.pipen.at/api1/9_2Fi3n1f/7FGB8_2F40_2FcxXZyJn/MYPNPdyBQdg05qIr4uV/UBpeqey5L5bx_2B9XOxmum/XW
Click to see the 13 hidden entries
http://f1.pipen.at/api1/9_2Fi3n1f/7FGB8_2F40_2FcxXZyJn/MYPNPdyBQdg05qIr4uV/UBpeqey5L5bx_2B9XOxm
http://https://file://USER.ID%lu.exe/upd
http://f1.pipen.at/api1/9_2Fi3n1f/7FGB8_2F40_2FcxXZyJn/MYPNPdyBQdg05qIr4uV/UBpeqey5L5bx_2B9XOxmum/XWCzESfD0GEF4/Qjx5aw51/G3fgrbAK8jrnIdMeRkz1f3I/vFKx_2FN1E/_2FtGaz62dC02Cddz/RaPqDvZTx_2B/awvst0R17dZ/0GfbzNl2n3qF9L/E7z046Msr_2BJT7rA_2FD/A8GGcdT9WzqgNb7z/BNY39tuIwWJYXDY/hGC0yZivJk9AmDj5Xd/CtOHNb0TO/Uk_2BZyKMemjBoc_0A_0/D4iJROIwC22J8Lo_2FC/D_2B62mE_2FFLXf4zekfTe/pVtfNYg5dNL_2/Bty160ii/60zh3n_2Byaa/vvL1S
http://www.nytimes.com/
http://constitution.org/usdeclar.txt
http://www.youtube.com/
http://constitution.org/usdeclar.txtC:
http://www.wikipedia.com/
http://www.amazon.com/
http://api10.dianer.at/jvassets/xI/t64.dat
http://www.live.com/
http://www.reddit.com/
http://www.twitter.com/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\PGpPBocoGo.txt
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
Click to see the 13 hidden entries
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
 XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
 data
 #
C:\Users\user\AppData\Local\Temp\DDdNGtqHaD.nfdQyjXrtb
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmmhnq25.1qe.ps1
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v42shhbr.llk.psm1
 ASCII text, with no line terminators
 #
C:\Users\user\Documents\20200422\PowerShell_transcript.494126.LoiX2P7n.20200422201943.txt
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #