top title background image
flash

o_37118.vbs

Status: finished
Submission Time: 2020-08-04 15:02:35 +02:00
Malicious
Trojan
Evader
Ursnif

Comments

Tags

Details

  • Analysis ID:
    256868
  • API (Web) ID:
    409404
  • Analysis Started:
    2020-08-04 15:02:52 +02:00
  • Analysis Finished:
    2020-08-04 15:09:28 +02:00
  • MD5:
    40ad174e1bce5e2c5b3e078cc08412b0
  • SHA1:
    cb2adcbdfc7320bb3416554d85b6f79ebf653947
  • SHA256:
    fa9d9c6208f3e2e73fe571f54670e999178843d70af1af2afe39a552e5c1738a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 80
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

IPs

IP Country Detection
5.53.124.137
Russian Federation

Domains

Name IP Detection
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
168.63.67.155
cdn.arsis.at
5.53.124.137

URLs

Name Detection
http://cdn.arsis.at/api1/grJsd2_2Bu2dvWPOsf_2B8r/JlCFwlxTBy/e3amZT7l90ZpAcP_2/BFE6kbBrhlwq/TEJLY0wqfij/9ui_2BC_2Baty_/2B1mbiGXLXfD8YqxMlIsT/6jxqiaRm9ckk8pFV/uXN_2BFAVVcSzbd/HZn_2F_2B9dweDKlmu/L2UvygAGW/1CSJpg0rEUnx_2BPGGvh/HgENAo5RnnnXmWsE_2B/u3RtmcAIu5f4jxgIm9_2BR/FofdGbvtP2KNJ/zDHTLio_/2FCfuuipSmkUBnBtS80dD7Z/xer3sTu_0A/_0DfgbGUvoHE_2Brx/RkL3zBT8D3yj/gOY_2Fi9WIY/BFbsjGrJqXL7VB/8cEXFAy7ioME1WvG05c/2G
http://www.wikipedia.com/
http://www.amazon.com/
Click to see the 6 hidden entries
http://wantsea.com:
http://www.nytimes.com/
http://www.live.com/
http://www.reddit.com/
http://www.twitter.com/
http://www.youtube.com/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\technic.ogg
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\pupil.nsv
ASCII text, with no line terminators
#
Click to see the 15 hidden entries
C:\Users\user\AppData\Local\Temp\large.xz
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\flatland.tbz2
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\equilibrium.exe
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Temp\adobe.url
MS Windows 95 Internet shortcut text (URL=<https://adobe.com/>), ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\Selena.py
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Marx.zip
Zip archive data, at least v2.0 to extract
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#