flash

vyac9eSGFdsBaas.exe

Status: finished
Submission Time: 12.09.2020 15:02:11
Malicious
Trojan
Spyware
Evader
FormBook

Comments

Tags

  • Formbook

Details

  • Analysis ID:
    284767
  • API (Web) ID:
    464718
  • Analysis Started:
    12.09.2020 15:02:12
  • Analysis Finished:
    12.09.2020 15:13:10
  • MD5:
    9f17b7998ba35f50527dbd5264c637a4
  • SHA1:
    32c51e444e34a5412d5d9fc51093673ba585de55
  • SHA256:
    bffc51435a1d5a46ec9199c40b72ca08f2708d7384ea9c1a625cc737c73b6eb1
  • Technologies:
Full Report Engine Info Verdict Score Reports

malicious

System: w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
15/69

IPs

IP Country Detection
45.205.10.214
Seychelles
35.206.117.184
United States
52.68.224.253
United States

Domains

Name IP Detection
www.coin-1234.com
52.68.224.253
www.cloutmonk.com
35.206.117.184
www.nastykiki.com
45.205.10.214
Click to see the 2 hidden entries
www.aigou898.com
0.0.0.0
agent31.juming.com
47.88.84.51

URLs

Name Detection
http://www.nastykiki.com/k8b/?GZFPC=VC7ph94nBwHqpUSYspNTCN309MDkymEOcmQ6ikEgb4YKagxI1RKoe1AlMLDdw+SPwNPO&Jzr=WbI4nLcxNx9xB
http://www.camdio.xyz/k8b/
http://www.coin-1234.com/k8b/?GZFPC=/9OlxiJfDFCR+kV/3jQOp8a9FKVAShy06VW92GW7Kq51jBaeGYNY0G4LSnjLLhaFT7RV&Jzr=WbI4nLcxNx9xB
Click to see the 97 hidden entries
http://www.cloutmonk.com/k8b/
http://www.nastykiki.com/k8b/
http://www.cloutmonk.com/k8b/?GZFPC=l8hWUFLJuml4eYku4/VYU6RSnNDRvqfvURXgu3llAvj/NGacI/RacADph16unSeN08+r&Jzr=WbI4nLcxNx9xB
http://www.camdio.xyz/k8b/Micr0
http://www.coin-1234.com/k8b/
http://www.alriyadh-ksa.onlineReferer:
http://www.p229pbfc9frm4.netReferer:
http://www.fivestarthestud.com/k8b/
http://tempuri.org/DataSet1.xsd
http://www.jiyu-kobo.co.jp/sk-s
http://www.mensajera-radio.onlineReferer:
http://www.lamparacuerda.com
http://www.cloutmonk.comReferer:
http://www.fontbureau.com/designers
http://www.clickfeminino.comReferer:
http://www.clickfeminino.com/k8b/
http://www.sajatypeworks.com
http://www.founder.com.cn/cn/cThe
http://www.alriyadh-ksa.online/k8b/www.fivestarthestud.com
http://www.jiyu-kobo.co.jp/1
http://www.mensajera-radio.online/k8b/www.lamparacuerda.com
http://www.galapagosdesign.com/DPlease
http://www.jiyu-kobo.co.jp/jp/Nj
http://www.lamparacuerda.comReferer:
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://www.clickfeminino.com
http://www.dancoimage.comReferer:
http://www.autoitscript.com/autoit3/J
http://www.fundwise.pro
http://www.alriyadh-ksa.online
http://www.lamparacuerda.com/k8b/
http://www.clickfeminino.com/k8b/www.p229pbfc9frm4.net
http://www.jiyu-kobo.co.jp/Y0P
http://www.fundwise.pro/k8b/
http://www.fundwise.proReferer:
http://www.aigou898.comReferer:
http://www.coin-1234.comReferer:
http://www.zhongyicts.com.cnQl
http://www.fontbureau.comaH
http://www.carterandcone.coml
http://www.founder.com.cn/cn/
http://www.fontbureau.com/designers/frere-jones.html
http://www.zhongyicts.com.cna
http://www.mensajera-radio.online/k8b/
http://www.dancoimage.com
http://www.fontbureau.comlvfet
http://www.jiyu-kobo.co.jp/rj
http://www.dancoimage.com/k8b/
http://www.aigou898.com/k8b/www.clickfeminino.com
http://www.nastykiki.comReferer:
http://www.jiyu-kobo.co.jp/3j:l-
http://www.nastykiki.com
http://www.fontbureau.com/designersG
http://www.aigou898.com
http://www.fontbureau.com/designers/?
http://www.salestalentforhire.comReferer:
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers?
http://www.fundwise.pro/k8b/www.alriyadh-ksa.online
http://www.dancoimage.com/k8b/www.fundwise.pro
http://www.p229pbfc9frm4.net/k8b/www.salestalentforhire.com
http://www.salestalentforhire.com
http://www.tiro.com
http://www.jiyu-kobo.co.jp/jp/1
http://www.infi88.com/k8b/www.xn--ucko5bzcwf3b2c.com
http://www.camdio.xyzReferer:
http://www.goodfont.co.kr
http://www.carterandcone.com
http://www.founder.com.cn/cnC
http://www.xn--ucko5bzcwf3b2c.com
http://www.typography.netD
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.infi88.com
http://www.aigou898.com/k8b/
http://www.p229pbfc9frm4.net
http://www.xn--ucko5bzcwf3b2c.com/k8b/
http://www.coin-1234.com
http://www.%s.comPA
http://www.fonts.com
http://www.sandoll.co.kr
http://www.p229pbfc9frm4.net/k8b/
http://www.sakkal.com
http://www.salestalentforhire.com/k8b/
http://www.xn--ucko5bzcwf3b2c.comReferer:
http://www.fivestarthestud.com/k8b/www.camdio.xyz
http://www.apache.org/licenses/LICENSE-2.0
http://www.cloutmonk.com/k8b/www.nastykiki.com
http://www.fontbureau.com
http://www.carterandcone.comTC
http://www.jiyu-kobo.co.jp/)jl-
http://www.nastykiki.com/k8b/www.coin-1234.com
http://www.jiyu-kobo.co.jp/Nj
http://www.jiyu-kobo.co.jp/Ej$l
http://www.jiyu-kobo.co.jp/jp/
http://www.fontbureau.coma

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\vyac9eSGFdsBaas.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmp5B2B.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\L6725004\L67logri.ini
data
#
Click to see the 3 hidden entries
C:\Users\user\AppData\Roaming\L6725004\L67logrv.ini
data
#
C:\Users\user\AppData\Roaming\oDcrHUXLZvF.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\L6725004\L67logim.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
#