flash

officina.Dll

Status: finished
Submission Time: 21.09.2020 07:30:16
Malicious
E-Banking Trojan
Trojan
Ursnif

Comments

Tags

  • gozi
  • isfb
  • ursnif

Details

  • Analysis ID:
    287926
  • API (Web) ID:
    470984
  • Analysis Started:
    21.09.2020 07:30:17
  • Analysis Finished:
    21.09.2020 07:37:17
  • MD5:
    0c47d472a69e47a50f5c4c794e8c4376
  • SHA1:
    62d75a0d19ebb1d24d5519d7aca77876ff2ed5a3
  • SHA256:
    dfbc5b7983de8ea77c2eaee6b821132699737755b27007c6f932ac673a6a1ea8
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
56/100

Domains

Name IP Detection
pop53334.yahoo.com
0.0.0.0

URLs

Name Detection
http://pop53334.yahoo.com/images/cjNLOfnmDRtZkYRiCFIK/i_2FF8gmC7vkCsWp_2B/OplnzOraYaweMM5TOqtvi4/ohV

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BBF8E5B-FC17-11EA-90E2-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4BBF8E5D-FC17-11EA-90E2-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
Click to see the 7 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dnserror[1]
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1]
PNG image data, 15 x 15, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\~DF1D5A708DE09C943D.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF23AC15F7B41AD67D.TMP
data
#