flash

presentation.jar

Status: finished
Submission Time: 04.05.2021 12:27:31
Malicious
Trojan
Exploiter
Ursnif

Comments

Tags

Details

  • Analysis ID:
    403821
  • API (Web) ID:
    709791
  • Analysis Started:
    04.05.2021 12:34:08
  • Analysis Finished:
    04.05.2021 12:55:33
  • MD5:
    6c5e7908c3a06aafd6dcebc8a2dcb674
  • SHA1:
    d094aef9d24e13ab70f2ef767242be554ed855ae
  • SHA256:
    cb8b20c28a0ac697b6f5bd430bd86762f6b9ef635428fe3fe77e174b172ac6f4
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
84/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Without Tracing

malicious
84/100

malicious
14/62

malicious
5/47

IPs

IP Country Detection
34.202.206.65
United States
50.87.249.219
United States
35.181.18.61
United States
Click to see the 3 hidden entries
143.204.98.126
United States
13.224.193.90
United States
143.204.98.25
United States

Domains

Name IP Detection
consent-pref.trustarc.com
143.204.98.25
consent-st.trustarc.com
143.204.98.126
oracle.112.2o7.net
35.181.18.61
Click to see the 11 hidden entries
docs.cyberservices.biz
50.87.249.219
prefmgr-cookie.truste-svc.net
34.202.206.65
consent.trustarc.com
13.224.193.90
static.oracle.com
0.0.0.0
www.oracle.com
0.0.0.0
s.go-mpulse.net
0.0.0.0
c.oracleinfinity.io
0.0.0.0
684dd30c.akstat.io
0.0.0.0
www.java.com
0.0.0.0
c.go-mpulse.net
0.0.0.0
dc.oracleinfinity.io
0.0.0.0

URLs

Name Detection
http://search.naver.com/favicon.ico
http://search.msn.co.jp/results.aspx?q=
http://www.clarin.com/favicon.ico
Click to see the 97 hidden entries
http://www.chambersign.orgs
http://buscar.ozu.es/
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
http://kr.search.yahoo.com/
http://search.about.com/
http://ocsp.sectigo.com
http://busca.igbusca.com.br/
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
http://www.ask.com/
http://www.priceminister.com/favicon.ico
http://cps.chambersign.org/cps/chambersroot.html
http://www.cjmall.com/
http://search.centrum.cz/
http://www.certplus.com/CRL/class3P.crl
http://suche.t-online.de/
http://www.google.it/
http://search.auction.co.kr/
http://www.ceneo.pl/
http://www.amazon.de/
http://crl.securetrust.com/STCA.crl
http://sads.myspace.com/
https://consent.trustarc.com/get?name=crossdomain.html&domain=oracle.com
http://busca.buscape.com.br/favicon.ico
http://www.pchome.com.tw/favicon.ico
http://browse.guardian.co.uk/favicon.ico
http://google.pchome.com.tw/
http://list.taobao.com/browse/search_visual.htm?n=15&q=
http://www.rambler.ru/favicon.ico
https://consent.trustarc.com/log
http://uk.search.yahoo.com/
http://espanol.search.yahoo.com/
http://r3.o.lencr.org
http://www.ozu.es/favicon.ico
http://search.sify.com/
http://openimage.interpark.com/interpark.ico
http://search.yahoo.co.jp/favicon.ico
http://search.ebay.com/
http://www.gmarket.co.kr/
http://ocsp.sectigo.com0
http://search.nifty.com/
http://searchresults.news.com.au/
http://www.google.si/
http://www.google.cz/
http://www.soso.com/
http://www.univision.com/
http://search.ebay.it/
http://www.amazon.com/
http://images.joins.com/ui_c/fvc_joins.ico
https://github.com/requirejs/requirejs/blob/master/LICENSE
http://www.asharqalawsat.com/
http://busca.orange.es/
http://search.chol.com/favicon.ico
http://www.mercadolivre.com.br/
http://www.merlin.com.pl/favicon.ico
http://search.ebay.de/
http://www.mtv.com/
http://www.rambler.ru/
http://www.nifty.com/favicon.ico
http://www.dailymail.co.uk/
http://www3.fnac.com/favicon.ico
https://s2.go-mpulse.net/boomerang/
http://buscar.ya.com/
http://search.yahoo.com/favicon.ico
https://consent-pref.trustarc.com/defaultpreferencemanager/67B873F492AD87C25B322202223D7A22.cache.ht
http://www.chambersign.org1
http://repository.swisssign.com/0
http://www.sogou.com/favicon.ico
http://asp.usatoday.com/
http://consent.trustarc.com/bannermsg?
http://fr.search.yahoo.com/
http://rover.ebay.com
http://in.search.yahoo.com/
http://img.shopzilla.com/shopzilla/shopzilla.ico
http://search.ebay.in/
http://image.excite.co.jp/jp/favicon/lep.ico
http://%s.com
http://msk.afisha.ru/
https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trust
http://www.reddit.com/
http://busca.igbusca.com.br//app/static/images/favicon.ico
http://policy.camerfirma.com0
http://search.rediff.com/
https://static.oracle.com/cdn/cec/v21.2.1.30/_sitesclouddelivery/renderer/renderer.js
http://www.ya.com/favicon.ico
http://bugs.webkit.org/show_bug.cgi?id=3810
http://www.etmall.com.tw/favicon.ico
http://it.search.dada.net/favicon.ico
http://search.naver.com/
http://www.google.ru/
http://cps.letsencrypt.org0
http://search.hanafos.com/favicon.ico
http://cgi.search.biglobe.ne.jp/favicon.ico
http://www.certplus.com/CRL/class2.crl
http://bugreport.sun.com/bugreport/
http://www.abril.com.br/favicon.ico
http://search.daum.net/
http://java.oracle.com/

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\broker.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\6BAUBVPU\consent-pref.trustarc[1].xml
ASCII text, with no line terminators
#
Click to see the 76 hidden entries
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\EQAWN5DV\www.java[1].xml
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IB42RK38\consent.trustarc[1].xml
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D4340500-AD0F-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D4340502-AD0F-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D4340503-AD0F-11EB-90E5-ECF4BB2D2496}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\JavaGreenfoot[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\T79A9-GDDN2-93ZD5-M6HUR-X83QX[1].js
C source, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\a[1].gif
GIF image data, version 89a, 1 x 1
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\caas_contenttypemap[1].json
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\footer.min[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\get[1].gif
GIF image data, version 89a, 133 x 18
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\infinity_common[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\javamagazine(2)[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\layout[1].htm
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\metrics_group1[1].js
C source, ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\print[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\render[1].js
exported SGML document, UTF-8 Unicode text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\require[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\trustarc-logo-small[1].png
PNG image data, 198 x 34, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\6.cache[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\JavaAlice[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Oracleacademy(2)[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\controller[1].js
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\header[1].js
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\header[2].js
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\items[1].json
HTML document, ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\jv0dl_a[1].png
PNG image data, 672 x 128, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\jv0h[1].jpg
[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS4 Macintosh, datetime=2011:01:25 18:25:40], baseline, precision 8, 777x95, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\loading[1].gif
GIF image data, version 89a, 31 x 31
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\notice[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\notice[2].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\s_code_remote[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\screen[1].css
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\theme.min[1].js
UTF-8 Unicode text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\10.cache[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\2B2KCDL9.htm
HTML document, ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\67B873F492AD87C25B322202223D7A22.cache[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\EuPreferenceManager[1].css
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\config[1].json
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\cookie_inneriframe[1].htm
HTML document, ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\favicon[1].ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\i18n.min[1].js
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\java_home_photo2[1].jpg
JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 320x303, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\jv0_oracle[1].gif
GIF image data, version 89a, 91 x 22
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\layout[1].htm
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\promise-polyfill.min[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\render[1].js
ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\render[2].js
exported SGML document, UTF-8 Unicode text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\1.cache[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\GoJava[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\JavaOne(2)(2)[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x132, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\cookie_iframe[1].htm
HTML document, ASCII text
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\defaultpreferencemanager.nocache[1].js
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\en[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\get[1].htm
HTML document, ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\jv0_search_btn[1].gif
GIF image data, version 89a, 19 x 18
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\jv0ht[1].gif
GIF image data, version 89a, 351 x 173
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\oldcss[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\renderer[1].js
UTF-8 Unicode text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\setupLibs[1].js
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\theme.deferred.min[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\v1[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Temp\~DF23476C21BA7AE237.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DFC3C698C18811D67C.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DFF893335E5A47C1F6.TMP
data
#
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a
data
#