top title background image
flash

KHAWATMI CO.IMPORT & EXPORT_PDF.exe

Status: finished
Submission Time: 2021-04-12 10:35:37 +02:00
Malicious
Trojan
Spyware
Evader
AgentTesla

Comments

Tags

Details

  • Analysis ID:
    385328
  • API (Web) ID:
    672760
  • Analysis Started:
    2021-04-12 10:35:38 +02:00
  • Analysis Finished:
    2021-04-12 10:49:00 +02:00
  • MD5:
    ee8919ff7b5f2a89b6c1984a6a3b7fbc
  • SHA1:
    cafb42ed9189ff950da2b14d7ab3aeab229d8165
  • SHA256:
    5074a2f201d924bdf62f0a58bca9cf0a5536af84b3b90bc6915a5cf36dfe019f
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 6/48

IPs

IP Country Detection
101.50.1.12
Indonesia
104.21.17.57
United States

Domains

Name IP Detection
jumatsedekah.com
101.50.1.12
mail.jumatsedekah.com
0.0.0.0
bornforthis.ml
104.21.17.57
Click to see the 1 hidden entries
clientconfig.passport.net
0.0.0.0

URLs

Name Detection
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194
https://s2-prod.liverpool.com/
Click to see the 97 hidden entries
https://securepubads.g.doubleclick.net/tag/js/gpt.js
http://schema.org/BreadcrumbList
https://www.liverpool.com/schedule/
http://schema.org/NewsArticle
https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
https://bornforthis.ml46kX
http://bornforthis.ml
https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
https://www.liverpool.com/all-about/steven-gerrard
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
https://www.liverpool.com/all-about/curtis-user
https://www.liverpool.com/all-about/champions-league
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
https://s2-prod.mirror.co.uk/
https://www.liverpool.com/all-about/ozan-kabak
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg
https://felix.data.tm-awx.com/felix.min.js
https://i2-prod.liverpool.com
http://schema.org/ListItem
https://www.liverpool.com/all-about/transfers
https://www.liverpool.com/
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.
https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533
https://api.ipify.org%GETMozilla/5.0
https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.
https://www.liverpool.com/all-about/andrew-robertson
https://felix.data.tm-awx.com
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
https://mab.data.tm-awx.com/rhs"
https://www.liverpool.com/all-about/georginio-wijnaldum
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
https://felix.data.tm-awx.com/ampconfig.json"
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
https://www.liverpool.com/liverpool-fc-news/
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
https://www.liverpool.com/all-about/premier-league
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
http://mail.jumatsedekah.com
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668
https://c.amazon-adsystem.com/aax2/apstag.js
https://WmLbJDkaOPbXW.org
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg
http://ZUOsUg.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.
http://127.0.0.1:HTTP/1.1
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816
https://s2-prod.liverpool.com
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png
https://reachplc.hub.loginradius.com"
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
http://bornforthis.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalgli
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
http://bornforthis.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7E01
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png
https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\firefox\firefox.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\firefox\firefox.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_KHAWATMI CO.IMPO_5234892f60a6fc5cef568f6b8afb785bfdf6873_4cf11da3_169e8dc4\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 9 hidden entries
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_firefox.exe_da79bea013ab5e47f0eb56f8dd08072c163a39f_ba7a16af_0b6b26b8\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6685.tmp.dmp
Mini DuMP crash report, 15 streams, CheckSum 0x00000004, Mon Apr 12 08:36:39 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BA4.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D5B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB61.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREED.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF393.tmp.dmp
Mini DuMP crash report, 14 streams, CheckSum 0x00000004, Mon Apr 12 08:37:15 2021, 0x1205a4 type
#
C:\Users\user\AppData\Roaming\qxn1gmbt.ift\Chrome\Default\Cookies
SQLite 3.x database, last written using SQLite version 3032001
#
C:\Users\user\YmbIShslLTQZdUqXrfprIi
ASCII text, with very long lines, with no line terminators
#