top title background image
flash

A4-058000200390-10-14_REV_pdf.exe

Status: finished
Submission Time: 2021-02-23 09:37:25 +01:00
Malicious
Trojan
Spyware
Evader
AgentTesla

Comments

Tags

  • AgentTesla
  • exe

Details

  • Analysis ID:
    356536
  • API (Web) ID:
    615055
  • Analysis Started:
    2021-02-23 09:46:01 +01:00
  • Analysis Finished:
    2021-02-23 10:01:51 +01:00
  • MD5:
    5af8f94a752ca9996fbfbf01dcc30edd
  • SHA1:
    b52d9ba9b7890e2b51e64ab889805cfce5126ebb
  • SHA256:
    b37d450b7d60fd2497ae794e9835b999339549406b1a05d92bb46a9f1a23eb12
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 6/47

IPs

IP Country Detection
103.17.211.69
Malaysia
104.21.71.230
United States

Domains

Name IP Detection
mail.soonlogistics.com
103.17.211.69
coroloboxorozor.com
104.21.71.230

URLs

Name Detection
http://2nUtGMgnxihCA8N2g.org
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
http://r3.i.lencr.org/0
Click to see the 20 hidden entries
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
http://cps.root-x1.letsencrypt.org0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://coroloboxorozor.com/base/B7EFDEC15CD29E4CF1B708AC6486760D.html
http://coroloboxorozor.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://r3.o.lencr.org0
http://coroloboxorozor.com/base/BE0C9BE287721D2E1639C8881BC9F105.html
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
http://mail.soonlogistics.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
http://cps.letsencrypt.org0
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\NewApp\NewApp.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\NewApp\NewApp.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_A4-058000200390-_22b30012e2a9340b0356f203be6ce5a2ae6da_1d3dc762_18d9dc37\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 13 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_NewApp.exe_2b4ac1a517da4509e55ae841ecc74477b428236_b4418cc1_06f2fc1e\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_NewApp.exe_2b4ac1a517da4509e55ae841ecc74477b428236_b4418cc1_10572409\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B46.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Feb 23 08:47:58 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER94AB.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D76.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA9B8.tmp.dmp
Mini DuMP crash report, 15 streams, CheckSum 0x00000004, Tue Feb 23 08:48:14 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD95.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Feb 23 08:47:05 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC218.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4C9.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0F8.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD510.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\3pg5upzt.i5q\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3032001
#
C:\Users\user\AppData\Roaming\aldkfvcd.2z0\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3032001
#