top title background image
flash

20211129.exe

Status: finished
Submission Time: 2021-12-02 19:30:49 +01:00
Malicious
Ransomware
Trojan
Evader
GuLoader

Comments

Tags

  • exe
  • guloader
  • signed

Details

  • Analysis ID:
    532897
  • API (Web) ID:
    900419
  • Analysis Started:
    2021-12-02 19:35:10 +01:00
  • Analysis Finished:
    2021-12-02 20:00:08 +01:00
  • MD5:
    672587fb175264ef8b45a2b0857f273f
  • SHA1:
    ab7c2f5edf572d5b28d7da50f548d73d49f92b71
  • SHA256:
    c00b66ef61df2012b269bca3e60b301478641292948f1cac579096603ad67f98
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 80
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
malicious
Score: 96
System: Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run Condition: Suspected Instruction Hammering

Third Party Analysis Engines

malicious
Score: 25/68
malicious
Score: 7/32
malicious
Score: 23/45

IPs

IP Country Detection
142.250.186.46
United States

Domains

Name IP Detection
drive.google.com
142.250.186.46

URLs

Name Detection
https://account.live.com/Wizard/Password/Change?id=80601
https://drive.google.com/YZ
https://drive.google.com/4
Click to see the 60 hidden entries
https://account.live.com/inlinesignup.aspx?iww=1&id=80605
https://drive.google.com/.com
http://schemas.xmlsoap.org/ws/2005/02/sc2
https://account.live.com/inlinesignup.aspx?iww=1&id=80604
https://drive.google.com/801120000Z
https://account.live.com/msangcwam
https://drive.google.com/0
https://drive.google.com/aZ
https://drive.google.com/uk1
http://passport.net/tb
https://drive.google.com/iZ
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
https://drive.google.com/qZ
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
http://schemas.xmlsoap.org/ws/2005/02/sc
https://account.live.com/inlinesignup.aspx?iww=1&id=80601
https://account.live.com/inlinesignup.aspx?iww=1&id=80600
https://drive.google.com/.azu)Z
https://drive.google.com/yZ
https://drive.google.com/ertificates
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdKeyInf
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
https://drive.google.com/heal
http://go.microsoft.c
https://account.live.com/inlinesignup.aspx?iww=1&id=80605
https://account.live.com/inlinesignup.aspx?iww=1&id=80603
https://account.live.com/inlinesignup.aspx?iww=1&id=80604
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds/SO
https://account.live.com/InlineSignup.aspx?iww=1&id=80502
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdng
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdpen.or
https://csp.withgoogle.com/csp/drive-
https://drive.google.com/r
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
http://schemas.xmlsoap.o
http://schemas.xmlsoap.org/ws/2005/02/trust
https://drive.google.com/)Z
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
https://drive.google.com/&0
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
https://drive.google.com/
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
http://schemas.mi
https://login.liUTF-16p
https://csp.witW
https://drive.google.com/IZ
https://drive.google.com/_1
https://signup.live.com/signup.aspx
https://drive.google.com/ificate
https://drive.google.com/l-in
https://login.liUTF-8p
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdjA1BX
https://drive.google.com/a
https://csp.withgoogle.com/csp/report-to/gse_l9ocaq
https://account.live.com/inlinesignup.aspx?iww=1&id=80601
https://account.live.com/inlinesignup.aspx?iww=1&id=80603
http://schemas.xmlsoap.org/ws/2004/09/policy