flash

GT-9333 Medical report COVID-19.doc

Status: finished
Submission Time: 21.12.2020 22:12:09
Malicious
Trojan
Evader

Comments

Tags

Details

  • Analysis ID:
    332936
  • API (Web) ID:
    567728
  • Analysis Started:
    21.12.2020 22:12:13
  • Analysis Finished:
    21.12.2020 22:21:16
  • MD5:
    a111ce91bd895c36fa2573483ddba7ef
  • SHA1:
    d4ef1a6f54d64ec0398fac3a2f3e2694d7ed8cb5
  • SHA256:
    f2ebfaec6ca0aeaf9fca020147398f74d7500b6be6259fc2eb4bb2e968e0cafe
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious
New

System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
100/100

malicious
12/48

malicious

IPs

IP Country Detection
35.208.182.43
United States
78.188.225.105
Turkey
50.116.111.59
United States
Click to see the 3 hidden entries
186.64.117.145
Chile
197.87.160.216
South Africa
191.6.208.18
Brazil

Domains

Name IP Detection
isatechnology.com
35.208.182.43
arquivopop.com.br
191.6.208.18
transfersuvan.com
186.64.117.145
Click to see the 1 hidden entries
www.isatechnology.com
0.0.0.0

URLs

Name Detection
http://arquivopop.com.br/index_htm_files/Kxh/
http://hotelshivansh.com/UserFiles/8/
http://transfersuvan.com
Click to see the 23 hidden entries
https://www.isatechnology.com/training/b/
http://transfersuvan.com/wp-admin/OVl/
https://cairocad.com/cgi-bin/1PBB/
https://physio-svdh.ch/wp-admin/kK/
http://arquivopop.com.br
http://50.116.111.59:8080/zikye087/k6io5sui3jj27i90cer/zipbonjrmr/
https://www.isatechnology.com
http://ownitconsignment.com/files/b/
https://b2bcom.com.br/site/0H/
http://www.windows.com/pctv.
http://investor.msn.com
http://www.msnbc.com/news/ticker.txt
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
http://www.hotmail.com/oe
https://www.isatechnology.comp
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
http://www.icra.org/vocabulary/.
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
http://investor.msn.com/
https://physio-svdh.ch/wp-admin/kK/P
http://www.piriform.com/ccleaner
http://www.%s.comPA

Dropped files

Name File Type Hashes Detection
C:\Users\user\F2nefq6\Prs2ndh\Chpieog.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{78474F9B-DE8E-4300-98F0-AE5841A8170E}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8389C138-A4A2-4116-9DB9-6D688B84E1DE}.tmp
data
#
Click to see the 6 hidden entries
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
data
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\GT-9333 Medical report COVID-19.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Wed Aug 26 14:08:15 2020, atime=Tue Dec 22 05:12:36 2020, length=207360, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C5EXUK8NUVGJWY1Z9OMU.temp
data
#
C:\Users\user\Desktop\~$-9333 Medical report COVID-19.doc
data
#