flash

SHIPPING DOCUMENT.exe

Status: finished
Submission Time: 04.05.2021 19:27:49
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • exe

Details

  • Analysis ID:
    404217
  • API (Web) ID:
    710528
  • Analysis Started:
    04.05.2021 20:09:44
  • Analysis Finished:
    04.05.2021 20:20:56
  • MD5:
    25e847b9631bc2fe8d87fe4278fa142e
  • SHA1:
    641756a84fdce68e101a53cfa6809b68190b7ad7
  • SHA256:
    70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
24/70

malicious
21/47

IPs

IP Country Detection
107.151.79.234
United States
154.220.41.208
Seychelles
64.190.62.111
United States
Click to see the 1 hidden entries
34.102.136.180
United States

Domains

Name IP Detection
www.barkinlot.com
107.151.79.234
www.union-green.com
154.220.41.208
www.fuerzaagavera.com
64.190.62.111
Click to see the 2 hidden entries
www.buyruon.com
0.0.0.0
buyruon.com
34.102.136.180

URLs

Name Detection
http://www.union-green.com/dxe/?k0GxOl=sOnMPkACxZJCHwFpI01WJHJoP6Rqh5hpLBOGFt1I8eGpOjOkLkuqJ1zaMIEMMNEsyDxC&NX1TzP=t8UH-PXh7J
www.knighttechinca.com/dxe/
http://www.fuerzaagavera.com/dxe/?k0GxOl=RbAtrmEWvlHFDlwUmkIgxTv6ob9YXkoV/NFTjoChCyM+ucvF9ABfViB5xXwNeUqJEtMU&NX1TzP=t8UH-PXh7J
Click to see the 34 hidden entries
http://www.barkinlot.com/dxe/?k0GxOl=WjDhBMZGXEFchLZ7o6W3JT2VhJsjwIpQ+RcXbs0zm7DaFFVtu5gSyYsWe3hhttt0VKfM&NX1TzP=t8UH-PXh7J
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers?
http://www.tiro.com
http://www.fontbureau.com/designers
https://sedo.com/search/details/?partnerid=324561&language=it&domain=fuerzaagavera.com&origin=sales_
http://nsis.sf.net/NSIS_ErrorError
http://www.goodfont.co.kr
http://www.carterandcone.coml
http://www.sajatypeworks.com
http://www.typography.netD
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.founder.com.cn/cn
http://www.yabovip1288.com
http://www.fontbureau.com/designers/frere-user.html
http://nsis.sf.net/NSIS_Error
http://www.jiyu-kobo.co.jp/
http://www.galapagosdesign.com/DPlease
http://www.fontbureau.com/designers8
http://www.%s.comPA
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://www.buyruon.com/dxe/?k0GxOl=sFVJxLIQKAVd+Y7XtG7gnaG34PPCpjG6GFyGl+6CuFNb0W3+mUMXX+9XGZNJldEnuWZ9&NX1TzP=t8UH-PXh7J
http://www.sakkal.com
https://hm.baidu.com/hm.js?2f7ed51008e649f38c9a7a932b01f7d5

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\nszA951.tmp\2x6gdfzk.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\ex08fobkizb
data
#
C:\Users\user\AppData\Local\Temp\kmvt65sofzhcy6
data
#
Click to see the 1 hidden entries
C:\Users\user\AppData\Local\Temp\nseA921.tmp
data
#