top title background image
flash

BANK-STATMENT _xlsx.exe

Status: finished
Submission Time: 2020-11-19 15:55:32 +01:00
Malicious
Phishing
Trojan
Spyware
Evader
HawkEye MailPassView

Comments

Tags

  • exe
  • HawkEye

Details

  • Analysis ID:
    320625
  • API (Web) ID:
    543057
  • Analysis Started:
    2020-11-19 16:01:48 +01:00
  • Analysis Finished:
    2020-11-19 16:18:21 +01:00
  • MD5:
    debe564cd4c27c02d23c828df27fe27f
  • SHA1:
    1b55fba242460cc0a5b38299acaaacf3f54c5e87
  • SHA256:
    edafe7e62738e180cb882d93f37d2d306627aef482d6f7a7a06c69198c61cd58
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 29/72
malicious
Score: 20/48

IPs

IP Country Detection
166.62.27.57
United States
104.16.154.36
United States
104.16.155.36
United States

Domains

Name IP Detection
mail.iigcest.com
166.62.27.57
201.75.14.0.in-addr.arpa
0.0.0.0
whatismyipaddress.com
104.16.154.36

URLs

Name Detection
http://www.carterandcone.comTC
http://www.fontbureau.comd
http://www.fontbureau.coma
Click to see the 86 hidden entries
http://www.jiyu-kobo.co.jp/jp/
http://go.microsoft.LinkId=42127
https://contextual.media.net/
http://www.jiyu-kobo.co.jp/E
http://www.fontbureau.com/designersno
http://whatismyipaddress.com
http://go.microsoft.
https://whatismyipaddress.comx&
http://www.jiyu-kobo.co.jp/N
http://www.carterandcone.comg
http://www.carterandcone.comc
http://www.galapagosdesign.com/S
http://www.fontbureau.comF
https://whatismyipaddress.com
http://www.galapagosdesign.com/
http://www.fontbureau.com
http://www.apache.org/licenses/LICENSE-2.0
https://whatismyipaddress.com/
http://www.founder.com.cn/cnd
http://www.fontbureau.com/designerst
http://www.founder.com.cn/cn7
http://www.tiro.comic
http://www.fontbureau.comalic
http://www.msn.com/?ocid=iehpEM3LMEM
http://www.jiyu-kobo.co.jp/j
http://www.fontbureau.com/designers8
https://contextual.media.net/checksync.php?&vsSyn
http://www.jiyu-kobo.co.jp/
http://www.founder.com.cn/cn8
http://www.fontbureau.comcomF
http://static-global-s-msn-com.ak
http://www.fontbureau.comueed
http://www.fontbureau.com/designers/cabarga.html
http://www.carterandcone.comz
http://www.fontbureau.comoitu
http://www.fontbureau.come
http://www.fontbureau.com/designers/frere-user.html
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn/
http://www.jiyu-kobo.co.jp/Y0nt
http://www.carterandcone.coml
http://www.fontbureau.com/designers
http://www.founder.com.cn/cn/cThe
http://www.fontbureau.com)
http://www.typography.netD
http://www.sajatypeworks.com
http://www.founder.com.cn/cnD
http://whatismyipaddress.comx&
http://www.fontbureau.com/designersS
http://www.jiyu-kobo.co.jp/alny
http://www.carterandcone.com
http://www.goodfont.co.kr
http://www.galapagosdesign.com/staff/dennis.htm
http://www.jiyu-kobo.co.jp/Y0s
http://www.tiro.com
http://www.founder.com.cn/cnrb
http://www.jiyu-kobo.co.jp/typo
http://www.fontbureau.com/designers?
http://www.jiyu-kobo.co.jp/://w7
http://www.carterandcone.com#
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers/?
http://www.fontbureau.com/designersG
https://login.yahoo.com/config/login
http://www.sakkal.com
http://www.zhongyicts.com.cn
http://www.nirsoft.net/
http://whatismyipaddress.com/
http://www.urwpp.deDPlease
http://www.founder.com.cn/cnZ
http://www.site.com/logs.php
http://www.sandoll.co.kr
http://www.jiyu-kobo.co.jp/Norm
http://www.fonts.com
http://www.carterandcone.comsig
http://www.jiyu-kobo.co.jp/jp/N
http://www.jiyu-kobo.co.jp/)
http://www.galapagosdesign.com/DPlease
http://whatismyipaddress.com/-
http://www.fontbureau.com/designersd
http://www.fontbureau.comcom
http://www.msn.com/de-ch/?ocid=iehpHLMEMh
http://www.jiyu-kobo.co.jp/font
http://fontfabrik.com
http://www.jiyu-kobo.co.jp/7

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65F6.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\pidloc.txt
ASCII text, with no line terminators
#
C:\Users\user\AppData\Roaming\pid.txt
ASCII text, with no line terminators
#
Click to see the 15 hidden entries
C:\Users\user\AppData\Local\Temp\holderwb.txt
Little-endian UTF-16 Unicode text, with no line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1C7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0FB.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC01.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB64.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER66C2.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_15082965\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E9F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DA4.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21C5.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2128.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_173bee50\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_1aa0f8cb\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_17308cf2\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_1534c334\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#