flash

BANK-STATMENT _xlsx.exe

Status: finished
Submission Time: 19.11.2020 15:55:32
Malicious
Phishing
Trojan
Spyware
Evader
HawkEye MailPassView

Comments

Tags

  • exe
  • HawkEye

Details

  • Analysis ID:
    320625
  • API (Web) ID:
    543057
  • Analysis Started:
    19.11.2020 16:01:48
  • Analysis Finished:
    19.11.2020 16:18:21
  • MD5:
    debe564cd4c27c02d23c828df27fe27f
  • SHA1:
    1b55fba242460cc0a5b38299acaaacf3f54c5e87
  • SHA256:
    edafe7e62738e180cb882d93f37d2d306627aef482d6f7a7a06c69198c61cd58
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
29/72

malicious
20/48

IPs

IP Country Detection
166.62.27.57
United States
104.16.154.36
United States
104.16.155.36
United States

Domains

Name IP Detection
mail.iigcest.com
166.62.27.57
201.75.14.0.in-addr.arpa
0.0.0.0
whatismyipaddress.com
104.16.154.36

URLs

Name Detection
http://www.carterandcone.comsig
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/?
Click to see the 86 hidden entries
http://www.founder.com.cn/cn/bThe
http://www.carterandcone.com#
http://www.jiyu-kobo.co.jp/://w7
http://www.fontbureau.com/designers?
http://www.jiyu-kobo.co.jp/typo
http://www.founder.com.cn/cnrb
http://www.tiro.com
http://www.jiyu-kobo.co.jp/Y0s
http://www.fontbureau.com/designers
http://www.goodfont.co.kr
http://www.carterandcone.com
http://www.jiyu-kobo.co.jp/alny
http://www.fontbureau.com/designersS
http://whatismyipaddress.comx&
http://www.founder.com.cn/cnD
http://www.sajatypeworks.com
http://www.typography.netD
http://www.fontbureau.com)
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://www.jiyu-kobo.co.jp/7
http://fontfabrik.com
http://www.jiyu-kobo.co.jp/font
http://www.msn.com/de-ch/?ocid=iehpHLMEMh
http://www.fontbureau.comcom
http://www.fontbureau.com/designersd
http://whatismyipaddress.com/-
http://www.galapagosdesign.com/DPlease
http://www.jiyu-kobo.co.jp/)
http://www.jiyu-kobo.co.jp/jp/N
https://login.yahoo.com/config/login
http://www.fonts.com
http://www.jiyu-kobo.co.jp/Norm
http://www.sandoll.co.kr
http://www.site.com/logs.php
http://www.founder.com.cn/cnZ
http://www.urwpp.deDPlease
http://whatismyipaddress.com/
http://www.nirsoft.net/
http://www.zhongyicts.com.cn
http://www.sakkal.com
http://www.fontbureau.comueed
http://www.fontbureau.com/designerst
http://www.founder.com.cn/cnd
https://whatismyipaddress.com/
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.galapagosdesign.com/
https://whatismyipaddress.com
http://www.fontbureau.comF
http://www.galapagosdesign.com/S
http://www.carterandcone.comc
http://www.carterandcone.comTC
http://www.jiyu-kobo.co.jp/N
https://whatismyipaddress.comx&
http://go.microsoft.
http://whatismyipaddress.com
http://www.fontbureau.com/designersno
http://www.jiyu-kobo.co.jp/E
https://contextual.media.net/
http://go.microsoft.LinkId=42127
http://www.jiyu-kobo.co.jp/jp/
http://www.fontbureau.coma
http://www.fontbureau.comd
http://www.carterandcone.comg
http://www.carterandcone.coml
http://www.jiyu-kobo.co.jp/Y0nt
http://www.founder.com.cn/cn/
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-user.html
http://www.fontbureau.come
http://www.fontbureau.comoitu
http://www.carterandcone.comz
http://www.fontbureau.com/designers/cabarga.html
http://www.founder.com.cn/cn7
http://static-global-s-msn-com.ak
http://www.fontbureau.comcomF
http://www.founder.com.cn/cn8
http://www.jiyu-kobo.co.jp/
https://contextual.media.net/checksync.php?&vsSyn
http://www.fontbureau.com/designers8
http://www.jiyu-kobo.co.jp/j
http://www.msn.com/?ocid=iehpEM3LMEM
http://www.fontbureau.comalic
http://www.tiro.comic

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_15082965\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_1534c334\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_17308cf2\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 15 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_1aa0f8cb\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bank-statment _x_319d48559b0a1af85a57a6082102ce05f64a1d9_00000000_173bee50\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2128.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21C5.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DA4.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E9F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65F6.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER66C2.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB64.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC01.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0FB.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF1C7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\holderwb.txt
Little-endian UTF-16 Unicode text, with no line terminators
#
C:\Users\user\AppData\Roaming\pid.txt
ASCII text, with no line terminators
#
C:\Users\user\AppData\Roaming\pidloc.txt
ASCII text, with no line terminators
#