flash

sample1.doc

Status: finished
Submission Time: 27.05.2021 00:16:17
Malicious
Trojan
Exploiter
Evader
Emotet

Comments

Tags

Details

  • Analysis ID:
    425356
  • API (Web) ID:
    792960
  • Analysis Started:
    27.05.2021 00:16:20
  • Analysis Finished:
    27.05.2021 00:27:09
  • MD5:
    7dbd8ecfada1d39a81a58c9468b91039
  • SHA1:
    0d21e2742204d1f98f6fcabe0544570fd6857dd3
  • SHA256:
    dc40e48d2eb0e57cd16b1792bdccc185440f632783c7bcc87c955e1d4e88fc95
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

malicious
100/100

malicious
36/63

malicious
17/37

malicious
32/47

malicious

IPs

IP Country Detection
109.13.179.195
France
42.200.96.63
Hong Kong
73.100.19.104
United States
Click to see the 97 hidden entries
24.231.51.190
Bahamas
190.151.5.131
Chile
113.193.239.51
India
185.142.236.163
Netherlands
198.20.228.9
United States
139.59.12.63
Singapore
73.55.128.120
United States
91.83.93.103
Hungary
126.126.139.26
Japan
203.153.216.178
Indonesia
104.131.144.215
United States
143.95.101.72
United States
162.144.145.58
United States
180.23.53.200
Japan
190.164.135.81
Chile
45.239.204.100
Brazil
37.187.100.220
France
190.85.46.52
Colombia
88.247.58.26
Turkey
190.194.12.132
Argentina
103.80.51.61
Thailand
82.78.179.117
Romania
188.226.165.170
European Union
213.165.178.214
Malta
119.92.77.17
Philippines
46.105.131.68
France
47.154.85.229
United States
192.163.221.191
United States
190.117.101.56
Peru
190.192.39.136
Argentina
157.7.164.178
Japan
115.79.59.157
Viet Nam
192.241.220.183
United States
113.203.238.130
Pakistan
78.186.65.230
Turkey
46.32.229.152
United Kingdom
172.193.79.237
Australia
51.38.50.144
France
190.55.186.229
Argentina
60.125.114.64
Japan
94.212.52.40
Netherlands
58.27.215.3
Pakistan
41.185.29.128
South Africa
91.75.75.46
United Arab Emirates
95.76.142.243
Romania
27.83.209.210
Japan
2.58.16.86
Latvia
221.147.142.214
Korea Republic of
188.166.220.180
Netherlands
115.79.195.246
Viet Nam
118.33.121.37
Korea Republic of
188.40.170.197
Germany
179.5.118.12
El Salvador
36.91.44.183
Indonesia
192.210.217.94
United States
85.75.49.113
Greece
223.17.215.76
Hong Kong
185.208.226.142
Hungary
41.76.213.144
South Africa
75.127.14.170
United States
172.96.190.154
Canada
91.121.87.90
France
109.206.139.119
Russian Federation
103.229.73.17
Indonesia
178.33.167.120
France
43.255.175.197
Malaysia
5.79.70.250
Netherlands
120.51.34.254
Japan
125.200.20.233
Japan
103.93.220.182
Philippines
37.205.9.252
Czech Republic
118.243.83.70
Japan
172.105.78.244
United States
123.216.134.52
Japan
91.213.106.100
Latvia
37.46.129.215
Russian Federation
121.117.147.153
Japan
110.37.224.243
Pakistan
180.148.4.130
Viet Nam
113.161.148.81
Viet Nam
116.202.10.123
Germany
177.130.51.198
Brazil
153.229.219.1
Japan
203.56.191.129
Australia
180.21.3.52
Japan
54.38.143.245
France
77.74.78.80
Russian Federation
8.4.9.137
United States
79.133.6.236
Finland
202.29.237.113
Thailand
185.80.172.199
Azerbaijan
74.208.173.91
United States
116.91.240.96
Japan
139.59.61.215
Singapore
212.198.71.39
France
175.103.38.146
Indonesia
50.116.78.109
United States

URLs

Name Detection
http://91.121.87.90:8080/KFDwQljVkxD3/OOFcmzcP5LKdqC/7kx60YXntHFlDt/5Rmtlx5Mir4E2nTGMFj/vs6RDbQfHrygTYrI/
http://177.130.51.198/43z7rPqPirmV4qB/AthcoPDmU/Q4ILc7kQKSHycUR/pIpU/8iSRPWx/wgrz9ygVvehFY9FxG0/
http://www.%s.comPA
Click to see the 3 hidden entries
https://pornthash.mobi/videos/tayna_tung
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
https://pornthash.mobi/videos/tayna_tung%temp%/tmp_e473b4.exex

Dropped files

Name File Type Hashes Detection
C:\Users\Public\Ksh1.pdf
PE32 executable (DLL) (console) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0001.doc
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0002.doc
data
#
Click to see the 16 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0003.doc
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0005.doc
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0291.doc
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0416.doc
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D50EB3E9-B04E-4308-B886-6463077025FE}.tmp
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F52B8A12-B174-499E-B3BD-E7523F18DF93}.tmp
data
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Ksh1.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 27 06:17:39 2021, mtime=Thu May 27 06:17:39 2021, atime=Thu May 27 06:17:41 2021, length=595972, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Public.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Jul 14 02:20:08 2009, mtime=Thu May 27 06:17:39 2021, atime=Thu May 27 06:17:39 2021, length=4096, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\sample1.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 27 06:16:25 2021, mtime=Thu May 27 06:16:25 2021, atime=Thu May 27 06:16:31 2021, length=856064, window=hide
#
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
data
#
C:\Users\user\Desktop\~$ample1.doc
data
#
C:\Users\Public\~$Ksh1.doc
data
#
C:\Users\Public\~$Ksh1.xls
data
#
C:\Users\Public\~WRD0000.tmp
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\Public\~WRD0004.tmp
ASCII text, with very long lines, with CRLF line terminators
#