flash

A4-058000200390-10-14_REV_pdf.exe

Status: finished
Submission Time: 23.02.2021 09:37:25
Malicious
Trojan
Spyware
Evader
AgentTesla

Comments

Tags

  • AgentTesla
  • exe

Details

  • Analysis ID:
    356536
  • API (Web) ID:
    615055
  • Analysis Started:
    23.02.2021 09:46:01
  • Analysis Finished:
    23.02.2021 10:01:51
  • MD5:
    5af8f94a752ca9996fbfbf01dcc30edd
  • SHA1:
    b52d9ba9b7890e2b51e64ab889805cfce5126ebb
  • SHA256:
    b37d450b7d60fd2497ae794e9835b999339549406b1a05d92bb46a9f1a23eb12
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports
New

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
6/47

IPs

IP Country Detection
103.17.211.69
Malaysia
104.21.71.230
United States

Domains

Name IP Detection
mail.soonlogistics.com
103.17.211.69
coroloboxorozor.com
104.21.71.230

URLs

Name Detection
http://2nUtGMgnxihCA8N2g.org
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Click to see the 20 hidden entries
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
http://cps.letsencrypt.org0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
http://mail.soonlogistics.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
http://coroloboxorozor.com/base/BE0C9BE287721D2E1639C8881BC9F105.html
http://r3.o.lencr.org0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
http://coroloboxorozor.com
http://coroloboxorozor.com/base/B7EFDEC15CD29E4CF1B708AC6486760D.html
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
http://cps.root-x1.letsencrypt.org0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
http://r3.i.lencr.org/0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\NewApp\NewApp.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\NewApp\NewApp.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_A4-058000200390-_22b30012e2a9340b0356f203be6ce5a2ae6da_1d3dc762_18d9dc37\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 13 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_NewApp.exe_2b4ac1a517da4509e55ae841ecc74477b428236_b4418cc1_06f2fc1e\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_NewApp.exe_2b4ac1a517da4509e55ae841ecc74477b428236_b4418cc1_10572409\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B46.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Feb 23 08:47:58 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER94AB.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D76.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9B8.tmp.dmp
Mini DuMP crash report, 15 streams, CheckSum 0x00000004, Tue Feb 23 08:48:14 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD95.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Feb 23 08:47:05 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC218.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4C9.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F8.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD510.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\3pg5upzt.i5q\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3032001
#
C:\Users\user\AppData\Roaming\aldkfvcd.2z0\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3032001
#