flash

company certificate.exe

Status: finished
Submission Time: 10.10.2020 09:02:19
Malicious
Trojan
Adware
Spyware
Evader
HawkEye MailPassView

Comments

Tags

  • exe
  • HawkEye

Details

  • Analysis ID:
    296160
  • API (Web) ID:
    487434
  • Analysis Started:
    10.10.2020 09:05:43
  • Analysis Finished:
    10.10.2020 09:22:44
  • MD5:
    b934fc6cc0c384172bebd09853d20bb5
  • SHA1:
    e56d56fd478c8e74d81a74c8f15ca7ac3fc501c4
  • SHA256:
    3822d27d679a8a6ed258783c32000566819f58779cdb911c36e122fe902950f2
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
11/70

malicious
6/29

IPs

IP Country Detection
104.23.99.190
United States
104.23.98.190
United States

Domains

Name IP Detection
smtp.hugeoutcome.com
199.188.200.150
9.96.11.0.in-addr.arpa
0.0.0.0
pastebin.com
104.23.98.190

URLs

Name Detection
http://fontfabrik.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Click to see the 67 hidden entries
http://www.founder.com.cn/cnl
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
http://whatismyipaddress.com/-
http://www.galapagosdesign.com/DPlease
http://www.ascendercorp.com/typedesigners.html
http://www.urwpp.deFT
http://www.fonts.com
http://www.goodfont.co.krn
http://www.sandoll.co.kr
http://www.site.com/logs.php
http://www.urwpp.deDPlease
http://www.nirsoft.net/
http://www.urwpp.de
http://www.zhongyicts.com.cn
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.sakkal.com
https://pastebin.com/raw/B2rJyfA1
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.galapagosdesign.com/
http://www.agfamonotype.
https://pastebin.com/raw/W63zsRav
http://www.agfamonotype.W
http://www.founder.com.cn/cnTC
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
http://www.goodfont.co.kreq
http://www.fontbureau.coma
http://en.wikip
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
http://www.carterandcone.coml
http://www.founder.com.cn/cn/
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-user.html
http://www.fontbureau.com/designers/cabarga.html
http://www.jiyu-kobo.co.jp/
http://www.fontbureau.com/designers/cabarga.htmlX
http://www.fontbureau.com/designers8
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
http://www.fontbureau.com/designers/
https://pastebin.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
http://www.fontbureau.com/designers?
http://www.tiro.com
http://www.fontbureau.comgritoE)
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
http://www.fontbureau.com/designers
http://www.founder.c
http://www.goodfont.co.kr
http://www.sandoll.co.kra-e
http://www.carterandcone.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
http://www.fontbureau.comF0.g
http://www.founder.com.cn/cnC
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
http://www.sandoll.co.krFeq
http://www.sajatypeworks.com
http://www.typography.netD
http://www.founder.com.cn/cn/cThe
http://www.founder.com.cn/cnn
http://www.galapagosdesign.com/staff/dennis.htm

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\company certificate.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\company certificate.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_company certific_2fee9a6cce4dffa7da4b89e6ea75241016dcd_3d4ce445_1190b929\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 5 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CF8.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Oct 10 07:07:58 2020, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER54D2.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A42.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\pid.txt
ASCII text, with no line terminators
#
C:\Users\user\AppData\Roaming\pidloc.txt
ASCII text, with no line terminators
#