top title background image
flash

Inquiry-URGENT.exe

Status: finished
Submission Time: 2021-09-27 17:49:41 +02:00
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • exe
  • Formbook
  • xloader

Details

  • Analysis ID:
    491567
  • API (Web) ID:
    859137
  • Analysis Started:
    2021-09-27 17:53:02 +02:00
  • Analysis Finished:
    2021-09-27 18:05:28 +02:00
  • MD5:
    001127ea6a36d3b93e8c54ff1b8f22b8
  • SHA1:
    acd9171ec5641efc54a16c5c18184dd6e25138c8
  • SHA256:
    2728dc98fdebc00823b877eba49ace782c17db8a07074634aafca9dc00277776
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 25/69
malicious
Score: 8/35
malicious
Score: 20/28
malicious

IPs

IP Country Detection
74.208.236.139
United States
213.5.70.60
Netherlands
34.252.217.69
United States
Click to see the 4 hidden entries
103.100.209.77
Hong Kong
162.241.61.210
United States
184.168.131.241
United States
34.102.136.180
United States

Domains

Name IP Detection
khlopok.club
34.252.217.69
www.josiemaran-supernatural.com
0.0.0.0
www.zambiaedu.xyz
0.0.0.0
Click to see the 15 hidden entries
www.bajajfinservmutualfund.com
0.0.0.0
www.apexpropertiesltd.com
0.0.0.0
www.lakeefctmich.com
0.0.0.0
www.tovardarom.xyz
0.0.0.0
www.khlopok.club
0.0.0.0
www.tameka-stewart.com
0.0.0.0
www.lianshangtron.com
103.100.209.77
www.studyengland.com
209.99.64.43
www.trasportesemmanuel.com
162.241.61.210
www.nutritionhawks.com
74.208.236.139
tovardarom.xyz
213.5.70.60
tameka-stewart.com
184.168.131.241
www.novasaude-g1.online
172.67.153.117
josiemaran-supernatural.com
34.102.136.180
apexpropertiesltd.com
34.102.136.180

URLs

Name Detection
http://www.khlopok.club/b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3
http://www.tameka-stewart.com/b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3
Click to see the 36 hidden entries
http://www.tovardarom.xyz/b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3
http://www.lianshangtron.com/b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3
www.rheilea.com/b5ce/
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP
http://i1.cdn-image.com/__media__/pics/12471/bodybg.png)
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2
http://i1.cdn-image.com/__media__/pics/12471/logo.png)
http://findquickresultsnow.com/Best_Mortgage_Rates.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1
http://findquickresultsnow.com/Free_Credit_Report.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N
http://findquickresultsnow.com/Migraine_Pain_Relief.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO
https://www.novasaude-g1.online/b5ce/?7nqLWRV0=SAwBm0
http://i1.cdn-image.com/__media__/pics/12471/libg.png)
http://findquickresultsnow.com/Top_10_Luxury_Cars.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N
http://www.josiemaran-supernatural.com/b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff
http://i1.cdn-image.com/__media__/js/min.js?v2.3
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf
http://findquickresultsnow.com/fashion_trends.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4p
http://findquickresultsnow.com/song_lyrics.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4pPrs
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf
http://findquickresultsnow.com/Top_Smart_Phones.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ
http://i1.cdn-image.com/__media__/pics/12471/search-icon.png)
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf
http://i1.cdn-image.com/__media__/pics/12471/arrow.png)
http://findquickresultsnow.com/display.cfm
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot
http://i1.cdn-image.com/__media__/pics/12471/libgh.png)
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix
http://i1.cdn-image.com/__media__/pics/12471/kwbg.jpg)
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry-URGENT.exe.log
ASCII text, with CRLF line terminators
#