top title background image
flash

wUKXjICs5f.dll

Status: finished
Submission Time: 2021-11-24 16:45:13 +01:00
Malicious
Trojan
Evader
Emotet

Comments

Tags

  • dll

Details

  • Analysis ID:
    528002
  • API (Web) ID:
    895524
  • Analysis Started:
    2021-11-24 16:51:03 +01:00
  • Analysis Finished:
    2021-11-24 17:05:53 +01:00
  • MD5:
    b65325cbe036c4e86a94428d8e7fab49
  • SHA1:
    8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e
  • SHA256:
    3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 12/66
malicious
Score: 8/44

IPs

IP Country Detection
54.38.242.185
France
51.210.242.234
France
37.44.244.177
Germany
Click to see the 17 hidden entries
66.42.57.149
United States
177.72.80.14
Brazil
51.178.61.60
France
168.197.250.14
Argentina
78.47.204.80
Germany
195.77.239.39
Spain
195.154.146.35
France
207.148.81.119
United States
142.4.219.173
Canada
185.148.169.10
Germany
54.37.228.122
France
45.79.33.48
United States
191.252.103.16
Brazil
85.214.67.203
Germany
37.59.209.141
France
78.46.73.125
Germany
196.44.98.190
Ghana

URLs

Name Detection
https://51.178.61.60/eUOoKZnMdMEYuzcUGINMwfTbKAcjacjvJSVpjTRzbVm
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
https://dev.ditu.live.com/mapcontrol/logging.ashx
Click to see the 40 hidden entries
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
https://www.disneyplus.com/legal/privacy-policy
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
https://dev.virtualearth.net/REST/v1/Transit/Schedules/
https://dynamic.t
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://disneyplus.com/legal.
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
https://activity.windows.com
http://www.bingmapsportal.com
https://dev.ditu.live.com/REST/v1/Locations
http://help.disneyplus.com.
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://%s.dnet.xboxlive.com
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
https://dev.virtualearth.net/REST/v1/Routes/Walking
https://www.disneyplus.com/legal/your-california-privacy-rights
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
https://dev.ditu.live.com/REST/v1/Routes/
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
https://t0.tiles.ditu.live.com/tiles/gen
https://dev.virtualearth.net/REST/v1/Routes/
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
https://dev.virtualearth.net/mapcontrol/logging.ashx
http://crl.ver)
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
https://www.tiktok.com/legal/report/feedback
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
https://%s.xboxlive.com
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
https://dev.virtualearth.net/REST/v1/Locations
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
data
#
C:\ProgramData\Microsoft\Network\Downloader\edb.log
MPEG-4 LOAS
#
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x8e80a486, page size 16384, Windows version 10.0
#
Click to see the 6 hidden entries
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61414 bytes, 1 file
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
ASCII text, with no line terminators
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
#
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211125_005221_007.etl
data
#