top title background image
flash

PAYMENT ADVICE.pdf.exe

Status: finished
Submission Time: 2020-07-31 15:44:58 +02:00
Malicious
Trojan
Spyware
Evader
AgentTesla Matiex

Comments

Tags

  • exe

Details

  • Analysis ID:
    255456
  • API (Web) ID:
    406255
  • Analysis Started:
    2020-08-01 00:32:48 +02:00
  • Analysis Finished:
    2020-08-01 00:43:17 +02:00
  • MD5:
    1275d29213c2580894371739beb16148
  • SHA1:
    5591bfdbad8f70d177b2889f0242d858fafc7750
  • SHA256:
    20e1f222ebae73bc71db60552d3733124fc5a2ce835ca2dde406c34217e6a061
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
131.186.113.70
United States
149.154.167.220
United Kingdom
104.28.5.151
United States

Domains

Name IP Detection
checkip.dyndns.org
0.0.0.0
freegeoip.app
104.28.5.151
api.telegram.org
149.154.167.220
Click to see the 2 hidden entries
checkip.dyndns.com
131.186.113.70
g.msn.com
0.0.0.0

URLs

Name Detection
http://certs.godaddy.com/repository/1301
https://freegeoip.app4
http://checkip.dyndns.com
Click to see the 54 hidden entries
http://www.urwpp.deDPlease
https://www.geodatatool.com/en/?ip=91.132.136.174
http://www.zhongyicts.com.cn
https://freegeoip.app/xml/91.132.136.174
http://certificates.godaddy.com/repository/gdig2.crt0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.sakkal.com
http://freegeoip.app
http://checkip.dyndns.org/HB;j
https://freegeoip.app/xml/
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.sandoll.co.kr
https://www.geodatatool.com/en/?ip=
http://checkip.dyndns.org
https://certs.godaddy.com/repository/0
http://www.carterandcone.coml
http://checkip.dyndns.orgD8
http://crl.godaddy.com/gdroot-g2.crl0F
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-jones.html
http://www.jiyu-kobo.co.jp/
http://crl.godaddy.com/gdroot.crl0F
http://www.fontbureau.com/designers8
http://api.telegram.org
https://api.telegram.org/bot962940633:AAFWOS5PMSGq49vE3MQVWuNLcoWDhmmugxg/sendDocument?chat_id=13926
https://i.imgur.com/GJD7Q5y.png
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
https://api.telegram.org
https://api.telegram.org/bot
http://certificates.godaddy.com/repository/0
http://www.fontbureau.com/designers?
https://freegeoip.app
http://www.tiro.com
http://crl.godaddy.com/gdig2s1-1823.crl0
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
http://www.sajatypeworks.com
http://www.fontbureau.com/designersG
http://checkip.dyndns.org4
http://www.typography.netD
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
https://api.telegram.org4
http://checkip.dyndns.org/
https://freegeoip.app/xml/91.132.136.174x
https://freegeoip.app/xml/LoadTimeZoneCountryNameCountryCodehttps://www.geodatatool.com/en/?ip=/
https://freegeoip.appD8
http://www.galapagosdesign.com/DPlease
https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8Win32_ComputerSystemModelManufactu
http://www.fonts.com

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PAYMENT ADVICE.pdf.exe.log
ASCII text, with CRLF line terminators
#