top title background image
flash

G.dll

Status: finished
Submission Time: 2022-01-28 22:06:21 +01:00
Malicious
Trojan
Evader
Emotet

Comments

Tags

  • dll

Details

  • Analysis ID:
    562446
  • API (Web) ID:
    929968
  • Analysis Started:
    2022-01-28 22:06:22 +01:00
  • Analysis Finished:
    2022-01-28 22:21:57 +01:00
  • MD5:
    630b6dad3884c5f5d7ed81c5bb29cdbb
  • SHA1:
    a613c00841a31bc27a0c9bdf4f210d6c6aceaac6
  • SHA256:
    d393bc3918eb1f83e3e3b481ada09a63931b366137e5a7c5542f32ac4ddad4bb
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 92
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 10/68

IPs

IP Country Detection
192.254.71.210
United States
131.100.24.231
Brazil
46.55.222.11
Bulgaria
Click to see the 42 hidden entries
41.76.108.46
South Africa
173.212.193.249
Germany
45.176.232.124
Colombia
178.79.147.66
United Kingdom
212.237.5.209
Italy
162.243.175.63
United States
176.104.106.96
Serbia
207.38.84.195
United States
164.68.99.3
Germany
50.116.54.215
United States
212.237.56.116
Italy
104.168.155.129
United States
45.142.114.231
Germany
203.114.109.124
Thailand
209.59.138.75
United States
159.8.59.82
United States
129.232.188.93
South Africa
58.227.42.236
Korea Republic of
158.69.222.101
Canada
104.251.214.46
United States
103.75.201.2
Thailand
185.157.82.211
Poland
212.237.17.99
Italy
79.172.212.216
Hungary
110.232.117.186
Australia
173.214.173.220
United States
212.24.98.99
Lithuania
138.185.72.26
Brazil
178.63.25.185
Germany
160.16.102.168
Japan
81.0.236.90
Czech Republic
195.154.133.20
France
216.158.226.206
United States
45.118.115.99
Indonesia
51.15.4.22
France
159.89.230.105
United States
162.214.50.39
United States
200.17.134.35
Brazil
217.182.143.207
France
107.182.225.142
United States
51.38.71.0
France
45.118.135.203
Japan

URLs

Name Detection
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
https://dev.ditu.live.com/mapcontrol/logging.ashx
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Click to see the 44 hidden entries
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
https://www.disneyplus.com/legal/privacy-policy
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
https://dev.virtualearth.net/REST/v1/Transit/Schedules/
https://dynamic.t
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://disneyplus.com/legal.
https://dev.virtualearth.net/mapcontrol/logging.ashx
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
https://activity.windows.com
http://www.bingmapsportal.com
https://dev.ditu.live.com/REST/v1/Locations
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
http://help.disneyplus.com.
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://%s.dnet.xboxlive.com
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
https://dev.virtualearth.net/REST/v1/Routes/Walking
https://www.disneyplus.com/legal/your-california-privacy-rights
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
https://dev.ditu.live.com/REST/v1/Routes/
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
https://dev.ditu.live.com/REST/v1/Transit/Stops/
https://t0.tiles.ditu.live.com/tiles/gen
https://dev.virtualearth.net/REST/v1/Routes/
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
https://dev.virtualearth.net/REST/v1/Transit/Stops/
http://crl.ver)
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
https://www.tiktok.com/legal/report/feedback
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
https://%s.xboxlive.com
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
https://dev.virtualearth.net/REST/v1/Locations
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
data
#
C:\ProgramData\Microsoft\Network\Downloader\edb.log
MPEG-4 LOAS
#
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x52f2e4c5, page size 16384, Windows version 10.0
#
Click to see the 6 hidden entries
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61414 bytes, 1 file
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
ASCII text, with no line terminators
#
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
#
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220129_060738_769.etl
data
#