flash

NQBNpLezqZKv1P4.exe

Status: finished
Submission Time: 22.07.2021 13:13:09
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • exe

Details

  • Analysis ID:
    452473
  • API (Web) ID:
    820062
  • Analysis Started:
    22.07.2021 13:13:10
  • Analysis Finished:
    22.07.2021 13:24:29
  • MD5:
    f03bf8d3ecc2ae4b40f836c59ac09bdf
  • SHA1:
    58f48a5a960eac4ee1f33ea16075cfd44f37b3a3
  • SHA256:
    2e4cf88a434d484057fcc090cb7de5deb6d30c8e00da339c886f2482f6a7ebe1
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

IPs

IP Country Detection
156.241.53.248
Seychelles
46.137.146.55
Ireland
104.143.9.211
United States
Click to see the 3 hidden entries
184.168.131.241
United States
156.241.53.21
Seychelles
199.34.228.66
United States

Domains

Name IP Detection
round-peacock-r52qmr18tj1ljgerw1dev1ae.herokudns.com
46.137.146.55
iafzal.com
184.168.131.241
www.nirvananaturalcbd.net
104.143.9.211
Click to see the 7 hidden entries
www.boicity.com
156.241.53.21
www.zrcezzfdfkyjlir.com
199.34.228.66
fbgroupsmadesimple.com
184.168.131.241
www.sh-zzjy.com
156.241.53.248
www.fbgroupsmadesimple.com
0.0.0.0
www.iafzal.com
0.0.0.0
www.updates-app.com
0.0.0.0

URLs

Name Detection
http://www.zrcezzfdfkyjlir.com/4nn8/?Hdydvr=DlDj4b1enWmfAZKfxgQAJvc2gBRdZlUrx2lzN81LRJr5fJ6P75G3daxk/kXjeAeayVM3&kXL=IR8x3xdhtDZDo
http://www.iafzal.com/4nn8/?Hdydvr=pWFD+tLrYKeToD1KMEgTTE+DlvT9wYkFe5dsU0F7Fzakf2kv+MLtj4lbMtCDbvpgbO1m&kXL=IR8x3xdhtDZDo
www.extraclass.xyz/4nn8/
Click to see the 57 hidden entries
http://www.nirvananaturalcbd.net/4nn8/?Hdydvr=6ZiyAD0WbsnILW9skshccJUQJZ00spGUaUUFMt7jIZhEEaQshTVA3pGkMLGohXGeqNyo&kXL=IR8x3xdhtDZDo
http://www.sh-zzjy.com/4nn8/?Hdydvr=i0XGe6lKRF+5hxK276Prns6Op/qjCtWP9PfxQZZGRBq4WhJG8zoVsATrcXi5v9ulo8Wv&kXL=IR8x3xdhtDZDo
http://www.fbgroupsmadesimple.com/4nn8/?Hdydvr=sThjVoDGnNhVVqPbc3peDf/Cra5DhNXbrYT0A91inWiDGnxFPUQSzdJbzNWXTwBKB+6K&kXL=IR8x3xdhtDZDo
http://www.boicity.com/4nn8/?Hdydvr=K/+E+I2IaBFJ5+Cq3Rel2nBITE/CM1NIkmEUWNpd048Z4hITxZXmdbK/fpJNWxfegP81&kXL=IR8x3xdhtDZDo
http://www.updates-app.com/4nn8/?Hdydvr=ihdw70LkX5hxMDN4QIP96+3/t6llBoRk+wXl03wrkyTNzP4vjM3xTua4b/vQ4JbV31Pi&kXL=IR8x3xdhtDZDo
http://www.zhongyicts.com.cnue
http://www.fontbureau.com/designersG
http://www.fontbureau.com/designers/?
http://www.founder.com.cn/cn/bThe
http://www.founder.com.cn/cn/ct
http://www.sandoll.co.krbl
http://www.fontbureau.com/designers?
http://www.goodfont.co.krklJ
http://www.founder.com.cn/cnUc
http://api.twitter.com/1/direct_messages.xml?since_id=
http://www.carterandcone.comen
http://www.tiro.com
http://www.fontbureau.com/designers
http://www.carterandcone.comroa
http://www.goodfont.co.kr
http://twitter.com/statuses/user_timeline.xml?screen_name=
http://www.carterandcone.com
http://www.founder.com.cn/cnAc
http://www.sajatypeworks.com
http://www.typography.netD
http://www.founder.com.cn/cn/cThe
http://www.galapagosdesign.com/staff/dennis.htm
http://fontfabrik.com
http://www.tiro.comicFf
http://www.carterandcone.comR
http://www.galapagosdesign.com/DPlease
http://www.%s.comPA
http://www.sandoll.co.kr.kr
http://www.fonts.com
http://www.sandoll.co.kr
http://www.urwpp.deDPlease
http://www.zhongyicts.com.cn
http://www.carterandcone.como.
http://www.sakkal.com
http://fontfabrik.comp
http://www.sajatypeworks.coml
http://www.goodfont.co.krylx
http://www.apache.org/licenses/LICENSE-2.0
http://www.fontbureau.com
http://www.carterandcone.comTC
http://www.tiro.comicwf
http://050005.voodoo.com/js/partner.js
http://www.carterandcone.coml
http://www.founder.com.cn/cn/
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.founder.com.cn/cn
http://www.fontbureau.com/designers/frere-user.html
https://www.updates-app.com/4nn8/?Hdydvr=ihdw70LkX5hxMDN4QIP96
http://www.jiyu-kobo.co.jp/
http://www.fontbureau.com/designers8
http://fontfabrik.com(
http://www.sandoll.co.kr8l

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NQBNpLezqZKv1P4.exe.log
ASCII text, with CRLF line terminators
#