flash

sphinx_1.0.1.0.exe

Status: finished
Submission Time: 19.07.2020 21:34:51
Malicious
Phishing
E-Banking Trojan
Trojan
Spyware
Evader
ZeusVM

Comments

Tags

  • sphinx

Details

  • Analysis ID:
    247383
  • API (Web) ID:
    390382
  • Analysis Started:
    20.07.2020 04:35:39
  • Analysis Finished:
    20.07.2020 04:51:20
  • MD5:
    36269d4e8402c65c5f46aef0313db9c3
  • SHA1:
    c884ba2f073a775a69d03f6342804c3c4f6abb5d
  • SHA256:
    c3f8265bfcc61ef328a8f776318d74e588873047f51e0dc8e445c1f6d4334f30
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
63/73

malicious
32/43

malicious
25/25

malicious

IPs

IP Country Detection
194.109.206.212
Netherlands
86.59.21.38
Austria
148.251.11.21
Germany
Click to see the 5 hidden entries
45.129.183.239
Germany
212.32.240.165
Netherlands
1.0.1.0
China
2.17.179.193
European Union
84.53.167.113
European Union

URLs

Name Detection
http://kdsk3afdiolpgejs.onion/sphinx/config.bin
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-semibold-webfont.eot?
https://site-cdn.onenote.net/161111931555_Images/LiveTileImages/Wid
Click to see the 94 hidden entries
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
https://www.torproject.org/documentation.html
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-semibold-italic-webfont.eot?
https://site-cdn.onenote.net/161111931555_Images/LiveTileImages/Wide/Image3.png
https://contextual.media.net/nrrV36594.js
https://ow1.res.office365.com/apc/trans.gif?44c9495a6a5b3b1a831fe38b8e6d9551
https://1.f.ix.de/heisejobs/icons/jobs_logo.png
https://oneclient.sfx.ms/Win/Prod/18.212.1021.0008/update10.xml?OneDriveUpdate=b91e8627eb3cb64b1a907
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-bold-italic-webfont.eot?
https://static.chartbeat.com/js/chartbeat_mab.js
https://1.f.ix.de/imgs/02/2/5/3/0/4/5/8/Comarch-4fddbfcafe05fdde.jpg
https://gzhls.at/i/52/81/1685281-s0.jpg
https://site-cdn.onenote.net/161111931555_Images/LiveTileImages/MediumAndLarge/Image3.png
https://www.torproject.
https://wiki.torprojec
https://www.heise.de/assets/akwa/v12/css/akwa.css?2e1b445264a4c552d85e
https://www.googletagservices.com/tag/js/gpt.js
https://gzhls.at/i/44/56/1804456-s0.jpg
https://www.heise.de/assets/heise/add-device-to-html/js/add-device-to-html.js?a5f6e986c8c5a5404904
https://cdn.onenote.net/livetile/?Language=en-US
http://www.msn.com/de-ch/?ocid=iehp
https://www.heise.de/icons/svg/logos/svg/preisvergleich.svg
https://aefd.nelreports.net/api/report?cat=bingaot
https://www.torproject.org/download/download#warningalphabetaThis
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
https://1.f.ix.de/imgs/02/2/5/4/0/9/8/7/2018-11-21-16zu9-banner-klein-mit-logo-c4cdf6c87d9a90e8.jpg
https://gzhls.at/i/44/62/1804462-s0.jpg
https://de.ioam.de/tx.io?st=mobheise&cp=homepage&sv=ke&pt=CP&ps=lin&er=N22&rf=&r2=&ur=www.heise.de&x
https://28f09a9a31a7b6e49a64ccf9175dcf92.clo.footprintdns.com/apc/trans.gif?edf0ba347b6529ea351c248f
https://www.heise.de/
https://dw8wjz3q0i4gj.cloudfront.net/apc/trans.gif?76c4263fb9baa97249f7c5aefc2f08e4
https://activity.windows.com
https://gzhls.at/i/53/51/1745351-s0.jpg
https://%s.dnet.xboxlive.com
https://gzhls.at/i/69/04/1756904-s0.jpg
https://ow1.res.office365.com/apc/trans.gif?179bfc1bf014a80f707f49534d911219
https://wiki.torproject.org/TheOnionRouter/TorFAQ#ServerOS
https://tarifrechner.heise.de/widget.php?produkt=dsl
https://www.heise.de/icons/ho/heise_online_lupe.gif
https://www.heise.de/avw-bin/ivw/CP/barfoo/ho/4206427/0.gif?d=1865586839
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/Small/Image2.png
https://ow1.res.office365.com/apc/trans.gif?60b9babae36a1ead54874c2c5f7295ee
https://login.windows.net/(
https://www.heise.de/assets/akwa/v12/js/akwa.js?cb93c9c59739ab662325
https://www.torproject.org/
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-regular-webfont.eot?
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-light-webfont.eot?
https://www.heise.de/assets/heise/hohomepage/css/hohomepage.css?01d3b8b15a86356e88d9
https://contextual.media.net/mediamain.html?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3D%3D&
https://www.heise.de/ivw-bin/ivw/CP/
https://1.f.ix.de/imgs/02/1/8/1/5/2/2/3/TrendMicro_Webcast_HBSAd_300x600_pre-b38353e8c8c30790.jpg
https://cdn.onenote.net/xy.dll
https://maps.windows.com/windows-app-web-link
http://www.msn.com/?ocid=iehp
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/MediumAndLarge/Image2.png
https://securepubads.g.doubleclick.net/gpt/pubads_impl_275.js
https://ow1.res.office365.com/apc/trans.gif?0c9aa04cd4189be02a6814bd263c9761
https://site-cdn.onenote.net/161111931555_Images/LiveTileImages/MediumAndLarge/Image2.png
https://site-cdn.onenote.net/161311631557_Images/LiveTileImages/Wide/Image2.png
http://crl.pki.goog/GTS1O1.crl0
https://gzhls.at/i/44
http://ocsp.pki.goog/gts1o10
https://www.heise.de/icons/ho/heise_online_lupe.pngs
http://pki.goog/gsr2/GTS1O1.crt0
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
http://ocsp.pki.goog/gsr202
https://pki.goog/repository/0
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-light-italic-webfont.eot?
https://%s.xboxlive.com
https://www.heise.de
https://dw8wjz3q0i4gj.cloudfront.net/apc/trans.gif?e52d8af823fb691d6070a8d08c122966
https://logincdn.msauth.net/16.000/js/MeControl_tfp5xc9B9RRsZ_q18BJrBA2.js
https://ow1.res.office365.com/apc/trans.gif?8f13507f566234aa18900ee01200968a
https://script.ioam.de/p3p.xml
https://aefd.nelreports.net/api/report?cat=bingrms
https://www.torproject.org/download/download#warning
http://crl.pki.goog/gsr2/gsr2.crl0?
https://site-cdn.onenote.net/161111931555_Images/LiveTileImages/Small/Image3.png
https://policies.yahoo.com/w3c/p3p.xml
https://ow1.res.office365.com/apc/trans.gif?ab883dc0791716ffc6417fbff491e867
https://script.ioam.de/iam.js?m=1
https://xsts.auth.xboxlive.com/
https://login.windows.net
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-italic-webfont.eot?
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
https://www.heise.de/fonts/source-sans-pro-subset/sourcesanspro-bold-webfont.eot?
https://xsts.auth.xboxlive.com
http://GETHEADPOSTPUTCONNECTHTTP/1.Couldn
https://ad.yieldlab.net/yp/66430
https://oneclient.sfx.ms/Win/Prod/18.192.0920.0015/OneDriveSetup.exe
http://freehaven.net/anonbib/#hs-attack06
http://www.openssl.org/support/faq.html
https://www.heise.de/icons/ho/heise_online_lupe.png
https://s.yimg.com/lo/api/res/1.2/VDiJ3sgxtBN_DlN7ef9aNw--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Yxvyca\dyho.exe
MS-DOS executable
#
C:\Users\user\AppData\Local\Microsoft\Windows\ActionCenterCache\windows-systemtoast-securityandmaintenance_13_0.png
PNG image data, 306 x 306, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Roaming\tor\cached-certs.tmp
ASCII text, with CRLF line terminators
#
Click to see the 5 hidden entries
C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus.tmp
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\tor\cached-microdescs.new
ASCII text, with very long lines
#
C:\Users\user\AppData\Roaming\tor\state.tmp
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus.tmp
ASCII text, with very long lines, with CRLF line terminators
#
\Device\ConDrv
ASCII text, with CRLF line terminators
#