top title background image
flash

AA-021_market_research.exe

Status: finished
Submission Time: 2023-09-05 03:14:07 +02:00
Malicious
Trojan
Spyware
Evader
FormBook, NSISDropper

Comments

Tags

  • exe

Details

  • Analysis ID:
    1303169
  • API (Web) ID:
    1303169
  • Analysis Started:
    2023-09-05 03:14:08 +02:00
  • Analysis Finished:
    2023-09-05 03:28:50 +02:00
  • MD5:
    b8e7041651b0e6d50a5343b31d1edf9e
  • SHA1:
    decfa0a35fff7ed61d75598dbc8a9cebc2220297
  • SHA256:
    1b29005d1fa110dfb5b924c879e64d7d4cce8af163f9e6853e4bbda2c298acf0
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 23/58
malicious
Score: 17/38
malicious
malicious

IPs

IP Country Detection
199.21.76.77
United States
188.114.96.7
European Union
156.229.181.12
Seychelles
Click to see the 8 hidden entries
192.187.101.110
United States
84.201.186.241
Russian Federation
103.224.182.252
Australia
206.237.167.5
United States
194.58.112.174
Russian Federation
66.29.149.4
United States
103.159.37.24
unknown
199.59.243.224
United States

Domains

Name IP Detection
www.houtaijiaju.com
206.237.167.5
www.innovativefewsustra.com
199.21.76.77
www.nobelstone.online
84.201.186.241
Click to see the 10 hidden entries
www.saintprojetdesalers.com
103.224.182.252
www.ozu-sushi.com
199.59.243.224
www.samjungnz.com
156.229.181.12
www.ronikonmet.online
194.58.112.174
ayesahrentacar.com
103.159.37.24
hummall.com
192.187.101.110
www.admiralx-qjff.buzz
188.114.96.7
www.aboutmart.info
66.29.149.4
www.ayesahrentacar.com
0.0.0.0
www.hummall.com
0.0.0.0

URLs

Name Detection
http://www.samjungnz.com/stcf/
http://www.ayesahrentacar.com/stcf/
http://www.aboutmart.info/stcf/?b8jjgtPj=U3Hdzf4+NthdwoRpGDAZ6y7w0fD0AVbGixRD45JbkQ2tjCPrd668TNY137Da+VsAQrKNrIi3MCxqOMM7MQy8bipn0fSUwqFnFg==&Fx5ZQ_=6BloHSOv1ZyHcK7v
Click to see the 45 hidden entries
http://www.ozu-sushi.com/stcf/?b8jjgtPj=LKrymPldaGVeOYmLjLnfDBCuS5LDKv8BYLJE3jIYHQ9uzaoSGf2HsNLxs9tvMJFIFlWoY8HXqLBYBDB0uXRkbxH0rL1kUFhPYA==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.houtaijiaju.com/stcf/?b8jjgtPj=1dqEu7FqG0Fk44M2TIWIkPdmvMNRz5dcffezXnqN6lUv5lMi6TOQgWef0OCS4qFIBflAvfQDvD67ojcpiecxbKoyGT2zgInreg==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.innovativefewsustra.com/stcf/
http://www.hummall.com/stcf/?b8jjgtPj=Nk5K1Xbn5LNktyygc0duWF6O7J21J+ny2OkZcNPXdwEtJdOtq79vG3nr+UGCbIkWjHts+GLn64yrXZso6VTtiIKUmdKl3zB6Tg==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.ronikonmet.online/stcf/
http://www.nobelstone.online/stcf/
http://www.hummall.com/stcf/
http://www.nobelstone.online/stcf/?b8jjgtPj=UO8R3Wh9DeX87kmI5mG+qX7Jf53rpIlJlC/rcW2xAuKlr6l4WyeCwoS3FeVnVlD5ClEGJB4/JQQotgjA8Jow3l3/hYa0qHqzSw==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.saintprojetdesalers.com/stcf/?b8jjgtPj=+e/LxL8BCb5JT2mwhurC+XHKDzv7gePyU3D6l90SLvlYtUAerZBoThv8T49BZLGEmtbjYr9mU8XR9+Jyxj0Ac5nrmcjNV6mhEw==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.saintprojetdesalers.com/stcf/
http://www.aboutmart.info/stcf/
http://www.innovativefewsustra.com/stcf/?b8jjgtPj=KMOD9sTNx2YSpovUq1RNTR7ydjsH43DK6JEh/zvUzYRR0vvq/o2vUCUDqBAEOVPQMQY3UE4+b0y2G+Yt3aLZnK9Ok22XiyTYzA==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.ronikonmet.online/stcf/?b8jjgtPj=uecC1YIjKds5pfO1F3wdFXlUHPZNvi7vIYoUJgTFy6qDYT2nEUgowtzqh09li59TuaU03ONGA0mFlHcwSvbjYzeky5oxhNu9ig==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.admiralx-qjff.buzz/stcf/
http://www.admiralx-qjff.buzz/stcf/?b8jjgtPj=/cN5NAnYyQNGkv6VJc4g2g592ZYTo+Uxyk0R0Gf4W9JvbRZK1NaF+iIMjo3IerhAmq3FJ+E4bsEgqu5DkPbYshmlolwDNKWyQQ==&Fx5ZQ_=6BloHSOv1ZyHcK7v
http://www.ozu-sushi.com/stcf/
http://www.ayesahrentacar.com
https://www.reg.ru/web-sites/?utm_source=www.ronikonmet.online&utm_medium=parking&utm_campaign=s_lan
https://admiralx-memr.buzz/stcf/?b8jjgtPj=/cN5NAnYyQNGkv6VJc4g2g592ZYTo
http://hummall.com/stcf/?b8jjgtPj=Nk5K1Xbn5LNktyygc0duWF6O7J21J
https://java.sun.com
https://www.reg.ru/whois/?check=&dname=www.ronikonmet.online&reg_source=parking_auto
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://www.reg.ru/hosting/?utm_source=www.ronikonmet.online&utm_medium=parking&utm_campaign=s_land_
http://ww25.saintprojetdesalers.com/stcf/?b8jjgtPj=
https://duckduckgo.com/chrome_newtab
https://nobelstone.online/stcf/?b8jjgtPj=UO8R3Wh9DeX87kmI5mG
https://duckduckgo.com/ac/?q=
https://reg.ru
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
https://parking.reg.ru/script/get_domain_data?domain_name=www.ronikonmet.online&rand=
https://www.reg.ru/domain/new/?utm_source=www.ronikonmet.online&utm_medium=parking&utm_campaign=s_la
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
https://www.reg.ru/dedicated/?utm_source=www.ronikonmet.online&utm_medium=parking&utm_campaign=s_lan
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
https://www.google.com
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
https://www.reg.ru/web-sites/website-builder/?utm_source=www.ronikonmet.online&utm_medium=parking&ut
http://nsis.sf.net/NSIS_ErrorError
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
https://www.ecosia.org/newtab/
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
https://ac.ecosia.org/autocomplete?q=
https://search.yahoo.com?fr=crmas_sfp

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\jtquai.exe
PE32 executable (console) Intel 80386, for MS Windows
#