top title background image
flash

Customer Complaint letter NHBRC258812.PDF.exe

Status: finished
Submission Time: 2020-07-31 13:43:53 +02:00
Malicious
Phishing
Evader

Comments

Tags

  • exe
  • Neurevt

Details

  • Analysis ID:
    255338
  • API (Web) ID:
    405983
  • Analysis Started:
    2020-07-31 22:09:23 +02:00
  • Analysis Finished:
    2020-07-31 22:22:59 +02:00
  • MD5:
    69940b99a87df030b38ab4b04281d7ff
  • SHA1:
    a4cecf005b0777ed740e4dc9671e87349e3017cc
  • SHA256:
    9f829213a1f233378e8e9069adac865edfb8dd4a7e64998d273930c54ab258eb
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
5.53.124.16
Russian Federation

Domains

Name IP Detection
winqits.com
5.53.124.16
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
168.63.67.155
g.msn.com
0.0.0.0

URLs

Name Detection
http://winqits.com/~zadmin/lk/dm/logout.php?id=6727837
http://winqits.com/~zadmin/lk/dm/logout.php?pid=48
http://winqits.com/~zadmin/lk/dm/logout.php?page=33
Click to see the 24 hidden entries
http://winqits.com/~zadmin/lk/dm/logout.php?pid=865
http://winqits.com/~zadmin/lk/dm/logout.php?id=827877
http://winqits.com/~zadmin/lk/dm/logout.php?id=9304132
http://winqits.com/~zadmin/lk/dm/logout.php?pid=482
http://winqits.com/~zadmin/lk/dm/logout.php?id=9627894
http://winqits.com/~zadmin/lk/dm/logout.php?id=1766650
http://winqits.com/~zadmin/lk/dm/logout.php?page=111
http://winqits.com/~zadmin/lk/dm/logout.php?page=10
http://winqits.com/~zadmin/lk/dm/logout.php?id=7563560
http://winqits.com/~zadmin/lk/dm/logout.php?id=7114667
http://winqits.com/~zadmin/lk/dm/logout.php
http://winqits.com/~zadmin/lk/dm/logout.php?pid=574
http://winqits.com/~zadmin/lk/dm/logout.php?pid=374
http://winqits.com/~zadmin/lk/dm/logout.php:
http://winqits.com/~zadmin/lk/dm/logout.php?id=7563560J
http://winqits.com/~zadmin/lk/dm/logout.php6482u
http://winqits.com/~zadmin/lk/dm/logout.phpE
http://winqits.com/~zadmin/lk/dm/logout.php#
http://winqits.com/~zadmin/lk/dm/logout.php?pid=5743V
http://winqits.com/~zadmin/lk/dm/logout.php?id=1766650J
http://winqits.com/~zadmin/lk/dm/logout.php?id=1766650U
http://winqits.com/~zadmin/lk/dm/logout.php?id=7563560U
http://winqits.com/~zadmin/lk/dm/logout.php?pid=574)
http://winqits.com/~zadmin/lk/dm/logout.php?id=1766650$

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a
data
#