top title background image
flash

SHIPPING DOCUMENT.exe

Status: finished
Submission Time: 2021-05-04 19:27:49 +02:00
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • exe

Details

  • Analysis ID:
    404217
  • API (Web) ID:
    710528
  • Analysis Started:
    2021-05-04 20:09:44 +02:00
  • Analysis Finished:
    2021-05-04 20:20:56 +02:00
  • MD5:
    25e847b9631bc2fe8d87fe4278fa142e
  • SHA1:
    641756a84fdce68e101a53cfa6809b68190b7ad7
  • SHA256:
    70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 24/70
malicious
Score: 21/47

IPs

IP Country Detection
107.151.79.234
United States
154.220.41.208
Seychelles
64.190.62.111
United States
Click to see the 1 hidden entries
34.102.136.180
United States

Domains

Name IP Detection
www.barkinlot.com
107.151.79.234
www.union-green.com
154.220.41.208
www.fuerzaagavera.com
64.190.62.111
Click to see the 2 hidden entries
www.buyruon.com
0.0.0.0
buyruon.com
34.102.136.180

URLs

Name Detection
www.knighttechinca.com/dxe/
http://www.fuerzaagavera.com/dxe/?k0GxOl=RbAtrmEWvlHFDlwUmkIgxTv6ob9YXkoV/NFTjoChCyM+ucvF9ABfViB5xXwNeUqJEtMU&NX1TzP=t8UH-PXh7J
http://www.union-green.com/dxe/?k0GxOl=sOnMPkACxZJCHwFpI01WJHJoP6Rqh5hpLBOGFt1I8eGpOjOkLkuqJ1zaMIEMMNEsyDxC&NX1TzP=t8UH-PXh7J
Click to see the 34 hidden entries
http://www.barkinlot.com/dxe/?k0GxOl=WjDhBMZGXEFchLZ7o6W3JT2VhJsjwIpQ+RcXbs0zm7DaFFVtu5gSyYsWe3hhttt0VKfM&NX1TzP=t8UH-PXh7J
http://www.%s.comPA
http://www.yabovip1288.com
http://www.fontbureau.com/designers/frere-user.html
http://nsis.sf.net/NSIS_Error
http://www.jiyu-kobo.co.jp/
http://www.galapagosdesign.com/DPlease
http://www.fontbureau.com/designers8
http://fontfabrik.com
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://www.buyruon.com/dxe/?k0GxOl=sFVJxLIQKAVd+Y7XtG7gnaG34PPCpjG6GFyGl+6CuFNb0W3+mUMXX+9XGZNJldEnuWZ9&NX1TzP=t8UH-PXh7J
http://www.sakkal.com
https://hm.baidu.com/hm.js?2f7ed51008e649f38c9a7a932b01f7d5
http://nsis.sf.net/NSIS_ErrorError
http://www.fontbureau.com
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers?
http://www.tiro.com
http://www.fontbureau.com/designers
https://sedo.com/search/details/?partnerid=324561&language=it&domain=fuerzaagavera.com&origin=sales_
http://www.founder.com.cn/cn
http://www.goodfont.co.kr
http://www.carterandcone.coml
http://www.sajatypeworks.com
http://www.typography.netD
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://www.apache.org/licenses/LICENSE-2.0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\nszA951.tmp\2x6gdfzk.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\ex08fobkizb
data
#
C:\Users\user\AppData\Local\Temp\kmvt65sofzhcy6
data
#
Click to see the 1 hidden entries
C:\Users\user\AppData\Local\Temp\nseA921.tmp
data
#