Edit tour

Windows Analysis Report
DNSBench.exe

Overview

General Information

Sample Name:	DNSBench.exe
Analysis ID:	1327966
MD5:	154ee28facb62e73e1dcaf3562c2d6ec
SHA1:	570b1f2153c735ea0f9e5680c8f21cc581cd69e9
SHA256:	ab42c94fc03ddbf446319772518b229d7b2e2546fdddaae7c01abe0fa8a02be1

Detection

Score:	30
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Compliance

Score:	46
Range:	0 - 100

Signatures

Snort IDS alert for network traffic

PE file has a writeable .text section

Tries to resolve many domain names, but no domain seems valid

Performs DNS TXT record lookups

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains an invalid checksum

May sleep (evasive loops) to hinder dynamic analysis

Connects to many different domains

Classification

×

Analysis Advice

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

System is w10x64_ra

DNSBench.exe (PID: 2692 cmdline: C:\Users\user\Desktop\DNSBench.exe MD5: 154EE28FACB62E73E1DCAF3562C2D6EC)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014 - Source IP: 24.113.32.29 - Destination IP: 192.168.2.17

Timestamp:	24.113.32.29192.168.2.1753648662018666 10/18/23-14:00:20.319037
SID:	2018666
Source Port:	53
Destination Port:	64866
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: DNSBench.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: DNSBench.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 4.79.142.202:443 -> 192.168.2.17:49715 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2018666 ET TROJAN Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014 24.113.32.29:53 -> 192.168.2.17:64866

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: www.capb3czthgep1ugo3utapkgkve.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.11.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.13.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: axwpxuasjx2howw0bfte4ut4rd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4twp0trq4lhrf4xsrlsshmeotc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pw2lmedtkvcftyidcxqq2t4zbg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.cocm1gqxtqazvfe0xlq0ffgdvd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: i4aufknxlm0x5v4qsrt2rilfzb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.xtbr2snwk3hsjxcdq4qifagasc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.9.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.192.153.198.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.og30ulxw1iypdl33icsaylxu4f.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 250.35.250.129.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: almje0iq2xi5zlhji0tussipyb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.6.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.cgw2g10sptfhaxcje2rekzsm3h.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.18.1.68.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.71.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 110.0.55.209.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.159.92.66.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 154.69.87.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 222.220.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 22.70.154.156.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.100.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.192.153.198.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.xnmsek2vtllnk3vjdtq0vhen4a.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.11.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.212.118.74.origin.asn.cymru.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 10.212.97.204.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.oyulnhgwmq01w0hejptopucioa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 200.234.194.204.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mjit4qfvrprdbkaaxjq40hz01a.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.c2dc2w4sxcodn0dltttukcbrfg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fs3zfudxdvyp0ybjh1rcn2nykg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.95.254.216.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.4.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.212.118.74.origin.asn.cymru.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 123.222.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: g2fovvyrs3c0ur01nfr2xlufxd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4xpmmjevt20kaol5fas2cdlzyc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ptkf0o3q1rqybpatritoz3wmrc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 200.234.194.204.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.71.154.156.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.0.0.1.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 10.252.2.199.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.32.113.24.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xq35ostwqp3bm0hdvoti3a4i0h.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 22.71.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 200.232.194.204.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 220.1.55.209.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 22.70.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.1rsazqyszwognv1kitqea5thib.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kh2fmievp3j3pscye4r203z4kb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.87.93.66.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.httywqaqdmrpszcq4erwwdhj2d.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bxpjpaywzxbrtacpo0rk150hqc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: g5bjwtgqi0s3myq4aws2z0mtga.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.127.81.64.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.70.154.156.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tdix34ysmkyinulndht4omtggg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.k3czke0t5ct3idfefptmnrfjff.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.194.153.198.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.70.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4q3hhdpt5w55b0hu01ro3ro22f.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.pv1nauuu50va0rfbfvqcpkyq3g.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 123.220.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 220.1.55.209.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 525puxbuc1hx5ughfkratsseef.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.111.81.64.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 8.8.8.8.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 200.232.194.204.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.zslj0j0xi5y3eg14mbryg0aalc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.100.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.212.118.74.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 154.64.87.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.u2n2lryssrgxclhrgfsydntgmg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.2.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.0x1saadsbczswhab3krmz3ntea.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 0zh1dy5tcfzo4dadfgraediimd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zvjwgumw5p5qv4kjtbrk5qnnkh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ch0jc5vrg4hg0q1ue2senzvn1e.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.x4agjo0ril2zdjjozhq2fz5w2g.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkyk0iow5vsqd34buhrqjgzfwc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.10.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.12.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.194.153.198.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2e3mv42vq1w0jbdnypsca5kmoe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.yscxv04tm4famwq2yhqoo3lcve.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 9.9.9.9.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 6.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.79.81.64.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 110.0.55.209.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.175.27.216.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqmuu5sxv1vddpboyft4slpdgh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bhy2gmeqr2isclykvxrijmgwhc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.10.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vtrmoifqubivuw4sdstajtop4f.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.111.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.70.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: t445eiovlxixsgx4uhrcltyeyc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 29.32.113.24.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ha4345hxkxy524bbicq4cliqoc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.224.92.66.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nqvumi1r25igflonhkqixnudee.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.159.81.64.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 251.35.250.129.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vfj4gbpqg0e153x0qvr0ks0myb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.41.231.216.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.jrnzoonx3qla2add5dqcoldt4f.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aiujmuwtrscjv5ri5stwldgbkf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 3.2.2.4.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.c5rje2dwud2uzdidt4q2n0mn0e.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.vgualr4tag1mh1yfv4qad1iwja.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.4.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.212.118.74.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.1lspz04sshgl3e3ltrronzaxug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jhvx4a4ttgw5pcoq4mq23vvkrb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.18.1.68.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4.4.8.8.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fu34ipmshuqvvmkfxwqqd3kpxc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 10.214.117.204.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.1fq3u1mtw0ox1zctdftoqrbzcc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.tgfqtmnqf2b35mmbuiqmsuflza.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.13.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 220.222.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 170.68.87.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eznoeisq3pexqvrjsgsa02ua2d.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: a5w3tonvyiriikqgpaqy40eyxc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 4t0d25tu2mvoskofmirwnhqrbe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.18.1.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.212.118.74.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.45.81.64.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.a04kprwwvmjvn1o3h2tiqr4qfd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.el5ol3nxeywp1nbaxergawf22d.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.6.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmee3fxqf4abiyjokot4crfaub.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.12.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.111.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.16.9.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 220.220.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 230fe4humclnardnp0rukcbezd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: h2pdcasq40s5mudljis0fa35ug.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 22.71.154.156.in-addr.arpa replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.1psllbnvzodpwmh50zqsjx0ooe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 2.64.92.66.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 5rbixjdtw32gye4dgkqsblguee.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 222.222.67.208.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 1.1.1.1.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 30.16.2.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.71.154.156.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lkhtcz0tdyg5zjc5r5tap3ftjd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.uyoo533xzijl0qy4w3sup4tbxe.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 25.18.1.68.test.senderbase.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kokc25fv2o2vozn0serulnyq5h.com replaycode: Name error (3)

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 316

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown	UDP traffic detected without corresponding DNS query: 198.41.0.4
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.2
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.0.0.1

Source: unknown

DNS traffic detected: queries for: tuwvialq5i03oisinpqah03p5b.isc.org

Source: global traffic	HTTP traffic detected: GET /x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb HTTP/1.1User-Agent: Gibson Research Corporation DNS BenchmarkHost: www.grc.com
Source: global traffic	HTTP traffic detected: GET /x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb HTTP/1.1User-Agent: Gibson Research Corporation DNS BenchmarkHost: www.grc.com
Source: global traffic	HTTP traffic detected: GET /x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb HTTP/1.1User-Agent: Gibson Research Corporation DNS BenchmarkHost: www.grc.com
Source: global traffic	HTTP traffic detected: GET /x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb HTTP/1.1User-Agent: Gibson Research Corporation DNS BenchmarkHost: www.grc.com
Source: global traffic	HTTP traffic detected: GET /x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb HTTP/1.1User-Agent: Gibson Research Corporation DNS BenchmarkHost: www.grc.com

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 4.79.142.202:443 -> 192.168.2.17:49715 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: DNSBench.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Uses 32bit PE files

Source: DNSBench.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: DNSBench.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\DNSBench.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\DNSBench.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\ne[1].dll

Source: classification engine

Classification label: sus30.troj.evad.winEXE@1/1@1509/518

Source: C:\Users\user\Desktop\DNSBench.exe

File read: C:\Windows\win.ini

Uses Rich Edit Controls

Source: C:\Users\user\Desktop\DNSBench.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Executable creates window controls seldom found in malware

Source: C:\Users\user\Desktop\DNSBench.exe

Window found: window name: SysTabControl32

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14
Source: C:\Users\user\Desktop\DNSBench.exe	Window detected: Number of UI elements: 14

PE / OLE file has a valid certificate

Source: DNSBench.exe

Static PE information: certificate valid

Data Obfuscation

PE file contains an invalid checksum

Source: DNSBench.exe

Static PE information: real checksum: 0x96e5193b should be: 0x3338f

Source: initial sample

Static PE information: section name: .text entropy: 7.997286904575205

Malware Analysis System Evasion

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\DNSBench.exe	Window / User API: threadDelayed 384
Source: C:\Users\user\Desktop\DNSBench.exe	Window / User API: threadDelayed 2978
Source: C:\Users\user\Desktop\DNSBench.exe	Window / User API: threadDelayed 978

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\DNSBench.exe TID: 6776	Thread sleep time: -58000s >= -30000s
Source: C:\Users\user\Desktop\DNSBench.exe TID: 6776	Thread sleep time: -384000s >= -30000s
Source: C:\Users\user\Desktop\DNSBench.exe TID: 4920	Thread sleep time: -32300s >= -30000s
Source: C:\Users\user\Desktop\DNSBench.exe TID: 4920	Thread sleep time: -297800s >= -30000s
Source: C:\Users\user\Desktop\DNSBench.exe TID: 6776	Thread sleep time: -978000s >= -30000s

HIPS / PFW / Operating System Protection Evasion

Performs DNS TXT record lookups

Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.1.1.1.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as13335.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.0.0.1.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as13335.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 3.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 5.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 6.2.2.4.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as3356.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 4.4.8.8.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as15169.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 8.8.8.8.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as15169.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 9.9.9.9.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 29.32.113.24.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as19281.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as11404.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.32.113.24.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as11404.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.45.81.64.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.79.81.64.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.111.81.64.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as18566.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.127.81.64.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.81.64.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.64.92.66.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.159.92.66.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.224.92.66.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: as11696.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.87.93.66.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as17184.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.18.1.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.18.1.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.2.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.2.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.4.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.4.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.6.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.6.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.9.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.9.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.10.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.10.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.11.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.11.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.12.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.12.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.13.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.13.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 154.64.87.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as7922.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 170.68.87.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as7922.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 154.69.87.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as7922.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.100.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.100.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.16.111.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 30.16.111.68.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as22773.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 250.35.250.129.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: as2914.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 251.35.250.129.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 2.212.118.74.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as2914.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.70.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.71.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.70.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.70.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 22.71.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 25.71.154.156.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.192.153.198.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 1.194.153.198.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as397213.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.252.2.199.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as1239.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.212.97.204.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as1239.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 10.214.117.204.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as1239.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 200.232.194.204.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 200.234.194.204.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 123.220.67.208.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 123.222.67.208.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.220.67.208.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 222.220.67.208.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 110.0.55.209.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 110.0.55.209.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 220.222.67.208.origin.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 220.1.55.209.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 110.0.55.209.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: as36692.asn.cymru.com
Source: Traffic	DNS traffic detected: queries for: 220.1.55.209.test.senderbase.org
Source: Traffic	DNS traffic detected: queries for: 222.222.67.208.origin.asn.cymru.com

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

No bigger version

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DNSBench.exe	4%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
net4.rebindtest.com	4.4.4.4	true	false		unknown
net192.rebindtest.com	192.168.0.1	true	false		unknown
www.grc.com	4.79.142.202	true	false		high
isc.org	149.20.2.28	true	false		high
net172.rebindtest.com	172.16.0.1	true	false		unknown
net127.rebindtest.com	127.0.0.1	true	false		unknown
net10.rebindtest.com	10.0.0.1	true	false		unknown
vfj4gbpqg0e153x0qvr0ks0myb.com	unknown	unknown	true		unknown
6.2.2.4.origin.asn.cymru.com	unknown	unknown	false		high
www.fu34ipmshuqvvmkfxwqqd3kpxc.com	unknown	unknown	true		unknown
nqvumi1r25igflonhkqixnudee.com	unknown	unknown	true		unknown
30.16.2.68.in-addr.arpa	unknown	unknown	true		unknown
154.64.87.68.test.senderbase.org	unknown	unknown	true		unknown
3.2.2.4.test.senderbase.org	unknown	unknown	true		unknown
123.222.67.208.origin.asn.cymru.com	unknown	unknown	false		high
2.45.81.64.test.senderbase.org	unknown	unknown	true		unknown
25.16.11.68.origin.asn.cymru.com	unknown	unknown	false		high
220.220.67.208.origin.asn.cymru.com	unknown	unknown	false		high
www.jrnzoonx3qla2add5dqcoldt4f.com	unknown	unknown	true		unknown
200.232.194.204.test.senderbase.org	unknown	unknown	true		unknown
25.16.111.68.test.senderbase.org	unknown	unknown	true		unknown
10.252.2.199.origin.asn.cymru.com	unknown	unknown	false		high
www.1fq3u1mtw0ox1zctdftoqrbzcc.com	unknown	unknown	true		unknown
www.cocm1gqxtqazvfe0xlq0ffgdvd.com	unknown	unknown	true		unknown
30.16.100.68.origin.asn.cymru.com	unknown	unknown	false		high
8.8.8.8.in-addr.arpa	unknown	unknown	true		unknown
170.68.87.68.in-addr.arpa	unknown	unknown	true		unknown
www.xtbr2snwk3hsjxcdq4qifagasc.com	unknown	unknown	true		unknown
220.222.67.208.test.senderbase.org	unknown	unknown	true		unknown
123.222.67.208.test.senderbase.org	unknown	unknown	true		unknown
250.35.250.129.origin.asn.cymru.com	unknown	unknown	false		high
30.16.6.68.test.senderbase.org	unknown	unknown	true		unknown
www.vgualr4tag1mh1yfv4qad1iwja.com	unknown	unknown	true		unknown
250.35.250.129.in-addr.arpa	unknown	unknown	true		unknown
25.16.6.68.origin.asn.cymru.com	unknown	unknown	false		high
www.ptkf0o3q1rqybpatritoz3wmrc.com	unknown	unknown	true		unknown
30.16.111.68.in-addr.arpa	unknown	unknown	true		unknown
tdix34ysmkyinulndht4omtggg.com	unknown	unknown	true		unknown
2.2.2.4.origin.asn.cymru.com	unknown	unknown	false		high
30.16.13.68.test.senderbase.org	unknown	unknown	true		unknown
222.222.67.208.in-addr.arpa	unknown	unknown	true		unknown
2.95.254.216.test.senderbase.org	unknown	unknown	true		unknown
110.0.55.209.test.senderbase.org	unknown	unknown	true		unknown
251.35.250.129.origin.asn.cymru.com	unknown	unknown	false		high
g5bjwtgqi0s3myq4aws2z0mtga.com	unknown	unknown	true		unknown
2.95.254.216.in-addr.arpa	unknown	unknown	true		unknown
25.16.9.68.origin.asn.cymru.com	unknown	unknown	false		high
4q3hhdpt5w55b0hu01ro3ro22f.com	unknown	unknown	true		unknown
25.16.11.68.in-addr.arpa	unknown	unknown	true		unknown
1.70.154.156.test.senderbase.org	unknown	unknown	true		unknown
30.16.11.68.in-addr.arpa	unknown	unknown	true		unknown
25.16.100.68.test.senderbase.org	unknown	unknown	true		unknown
pw2lmedtkvcftyidcxqq2t4zbg.com	unknown	unknown	true		unknown
as11404.asn.cymru.com	unknown	unknown	false		high
as15169.asn.cymru.com	unknown	unknown	false		high
a5w3tonvyiriikqgpaqy40eyxc.com	unknown	unknown	true		unknown
1.0.0.1.in-addr.arpa	unknown	unknown	true		unknown
154.64.87.68.in-addr.arpa	unknown	unknown	true		unknown
25.16.4.68.origin.asn.cymru.com	unknown	unknown	false		high
30.16.12.68.origin.asn.cymru.com	unknown	unknown	false		high
www.a04kprwwvmjvn1o3h2tiqr4qfd.com	unknown	unknown	true		unknown
as7922.asn.cymru.com	unknown	unknown	false		high
22.70.154.156.origin.asn.cymru.com	unknown	unknown	false		high
jhvx4a4ttgw5pcoq4mq23vvkrb.com	unknown	unknown	true		unknown
www.tgfqtmnqf2b35mmbuiqmsuflza.com	unknown	unknown	true		unknown
axwpxuasjx2howw0bfte4ut4rd.com	unknown	unknown	true		unknown
30.16.6.68.origin.asn.cymru.com	unknown	unknown	false		high
10.214.117.204.test.senderbase.org	unknown	unknown	true		unknown
25.16.4.68.in-addr.arpa	unknown	unknown	true		unknown
123.220.67.208.origin.asn.cymru.com	unknown	unknown	false		high
525puxbuc1hx5ughfkratsseef.com	unknown	unknown	true		unknown
1.70.154.156.origin.asn.cymru.com	unknown	unknown	false		high
www.kh2fmievp3j3pscye4r203z4kb.com	unknown	unknown	true		unknown
10.214.117.204.origin.asn.cymru.com	unknown	unknown	false		high
as397213.asn.cymru.com	unknown	unknown	false		high
30.16.111.68.origin.asn.cymru.com	unknown	unknown	false		high
1.1.1.1.in-addr.arpa	unknown	unknown	true		unknown
222.220.67.208.in-addr.arpa	unknown	unknown	true		unknown
6.2.2.4.test.senderbase.org	unknown	unknown	true		unknown
0zh1dy5tcfzo4dadfgraediimd.com	unknown	unknown	true		unknown
9.9.9.9.in-addr.arpa	unknown	unknown	true		unknown
8.8.8.8.origin.asn.cymru.com	unknown	unknown	false		high
xq35ostwqp3bm0hdvoti3a4i0h.com	unknown	unknown	true		unknown
2.212.118.74.origin.asn.cymru.com	unknown	unknown	false		high
10.214.117.204.in-addr.arpa	unknown	unknown	true		unknown
as18566.asn.cymru.com	unknown	unknown	false		high
30.16.13.68.origin.asn.cymru.com	unknown	unknown	false		high
25.16.12.68.test.senderbase.org	unknown	unknown	true		unknown
www.1rsazqyszwognv1kitqea5thib.com	unknown	unknown	true		unknown
www.k3czke0t5ct3idfefptmnrfjff.com	unknown	unknown	true		unknown
30.16.10.68.test.senderbase.org	unknown	unknown	true		unknown
www.1lspz04sshgl3e3ltrronzaxug.com	unknown	unknown	true		unknown
2.64.92.66.origin.asn.cymru.com	unknown	unknown	false		high
30.16.10.68.in-addr.arpa	unknown	unknown	true		unknown
30.16.13.68.in-addr.arpa	unknown	unknown	true		unknown
110.0.55.209.in-addr.arpa	unknown	unknown	true		unknown
www.c2dc2w4sxcodn0dltttukcbrfg.com	unknown	unknown	true		unknown
25.18.1.68.test.senderbase.org	unknown	unknown	true		unknown
25.16.2.68.in-addr.arpa	unknown	unknown	true		unknown
vtrmoifqubivuw4sdstajtop4f.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.grc.com/x/ne.dll?aaaaaaednxaptz5yqth3s3zvqtvtnkk30s52dlvtv42q01221x322qjlrb	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
64.81.111.2	unknown	United States		18566	MEGAPATH5-US	false
68.87.64.154	unknown	United States		7922	COMCAST-7922US	false
68.11.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
64.81.159.2	unknown	United States		17184	ATL-CBEYONDUS	false
74.118.212.2	unknown	United States		7251	THREATTRACK-SECURITY-INCUS	false
8.8.4.4	unknown	United States		15169	GOOGLEUS	false
68.1.18.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
216.231.41.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.6.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
68.1.18.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
156.154.70.1	unknown	United States		397240	ULTRADNSUS	false
66.92.64.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.12.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
204.97.212.10	unknown	United States		1239	SPRINTLINKUS	false
4.2.2.3	unknown	United States		3356	LEVEL3US	false
74.118.212.1	unknown	United States		7251	THREATTRACK-SECURITY-INCUS	false
4.2.2.2	unknown	United States		3356	LEVEL3US	false
4.2.2.5	unknown	United States		3356	LEVEL3US	false
68.4.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
4.2.2.4	unknown	United States		3356	LEVEL3US	true
4.2.2.6	unknown	United States		3356	LEVEL3US	false
66.92.159.2	unknown	United States		11696	NBS11696US	false
24.113.32.29	unknown	United States		11404	AS-WAVE-1US	true
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	true
68.111.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
208.67.222.123	unknown	United States		36692	OPENDNSUS	false
68.100.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.6.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
129.250.35.250	unknown	United States		2914	NTT-COMMUNICATIONS-2914US	false
129.250.35.251	unknown	United States		2914	NTT-COMMUNICATIONS-2914US	false
68.11.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
208.67.220.123	unknown	United States		36692	OPENDNSUS	false
68.100.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.4.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.111.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
64.81.79.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.12.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.87.69.154	unknown	United States		7922	COMCAST-7922US	false
68.10.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
24.113.32.30	unknown	United States		11404	AS-WAVE-1US	false
198.41.0.4	unknown	United States		397199	VRSN-AC28US	false
68.13.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
156.154.71.1	unknown	United States		397241	ULTRADNSUS	false
216.254.95.2	unknown	United States		17184	ATL-CBEYONDUS	false
204.117.214.10	unknown	United States		1239	SPRINTLINKUS	false
199.2.252.10	unknown	United States		1239	SPRINTLINKUS	false
156.154.70.22	unknown	United States		397240	ULTRADNSUS	false
204.194.234.200	unknown	United States		30607	302-DIRECT-MEDIA-ASNUS	false
156.154.70.25	unknown	United States		397240	ULTRADNSUS	false
216.27.175.2	unknown	United States		11696	NBS11696US	false
64.81.45.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.9.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.10.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
9.9.9.9	unknown	United States		19281	QUAD9-AS-1US	true
208.67.222.222	unknown	United States		36692	OPENDNSUS	false
208.67.222.220	unknown	United States		36692	OPENDNSUS	false
64.81.127.2	unknown	United States		17184	ATL-CBEYONDUS	false
4.2.2.1	unknown	United States		3356	LEVEL3US	false
4.79.142.202	www.grc.com	United States		3356	LEVEL3US	false
66.92.224.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.2.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
198.153.192.1	unknown	United States		397241	ULTRADNSUS	false
209.55.0.110	unknown	United States		10397	MOMENTUMUS	false
198.153.194.1	unknown	United States		397240	ULTRADNSUS	false
204.194.232.200	unknown	United States		30607	302-DIRECT-MEDIA-ASNUS	false
68.2.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
68.9.16.25	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
209.55.1.220	unknown	United States		10397	MOMENTUMUS	false
1.0.0.1	unknown	Australia		13335	CLOUDFLARENETUS	true
156.154.71.25	unknown	United States		397241	ULTRADNSUS	false
208.67.220.222	unknown	United States		36692	OPENDNSUS	false
66.93.87.2	unknown	United States		17184	ATL-CBEYONDUS	false
68.13.16.30	unknown	United States		22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
208.67.220.220	unknown	United States		36692	OPENDNSUS	false
68.87.68.170	unknown	United States		7922	COMCAST-7922US	false
156.154.71.22	unknown	United States		397241	ULTRADNSUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1327966
Start date and time:	2023-10-18 13:59:46 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample file name:	DNSBench.exe
Detection:	SUS
Classification:	sus30.troj.evad.winEXE@1/1@1509/518
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: DNSBench.exe

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\5IQBCSP1\ne[1].dll

Process:	C:\Users\user\Desktop\DNSBench.exe
File Type:	data
Category:	dropped
Size (bytes):	19396
Entropy (8bit):	7.588766714648591
Encrypted:	false
SSDEEP:
MD5:	519AD9B249AEAC5B8BB15D2972291285
SHA1:	54FD23CAC1727217F90F4B7B0860628960EE565C
SHA-256:	96F2F19EEE11641A511F55D04DBFFA5A7B47D121D933E5F32C25070B0D53968F
SHA-512:	D0C15EBF18E5BC25D5E246C18283C8344B563FE1ADD40F4C11E45DF34CC1981532EF1C61B103C14E9160B53C1B310707646D3B34892CEAC859375BDD8E889BCF
Malicious:	false
Reputation:	low
Preview:	................................................#...$....v...v...............]..s........... " .!" ..yD..yD.#3`..Pj.%.j.^.m.C...G.............................)....)........F...G...H...U.....................5...7....g...g....................#...#...8...Y...Y.w.].})]..7f.f>f.. q.. q..!t..'t...t...t...t...t...t...t...t...t...t..hu...\|.@r..D........................................................?...?...?...?...`...`..(....}..&...5@...`...`...a...a...a...a..........=...%.......M.......$...-...................!...K............A...A..........5...5...-..#...#...#..`&..d&..f&..t&.bw&...&...)...)$..)%..)...)...)...)-..)...)...)...)...+..C9..I9*s.:.9.:...:B`.:...:...:.\|@:..E:..E:.O.:...;2..;...;...;..<...<...<...<E`.=G`.=q..=...=1..=!..=1..=...=...=...=!..=!..=!..=...=...=...=...=...=D..=...=..8=..<=B.?=.?J=.tz=.tz=Ia.=Ja.=.c.=.c.=.r.=.r.=B..=C..=D..=...=D..=.@.=.I.=...=...=E..=I'.=D,.=B6.=.%.=.R.=...={..=...=.(.=.[.=.b.=.b.=...=...=...=...=...=...=(..=I..=v..=...=...=...=bF.=!].="].=...=Y..=

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Entropy (8bit):	7.915033051671682
TrID:	Win32 Executable (generic) a (10002005/4) 98.96% Win32 EXE PECompact compressed (v2.x) (59071/9) 0.58% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	DNSBench.exe
File size:	162'848 bytes
MD5:	154ee28facb62e73e1dcaf3562c2d6ec
SHA1:	570b1f2153c735ea0f9e5680c8f21cc581cd69e9
SHA256:	ab42c94fc03ddbf446319772518b229d7b2e2546fdddaae7c01abe0fa8a02be1
SHA512:	b000502243b66e9dc535b0eb6fbd9212ba6adabc519c0ca4c44d65ace1c659efa8be12a843f480e3e8ff436246d919ba19e5307e9aedd81893b77343274d7735
SSDEEP:	3072:XSww+ICvU0Qv8Z9yzvSh3gzaDKzHDa4cn2qTWM9gbYfNjh:XSwwPC08CzvSh3geOzm4cn2AWM9gb4
TLSH:	36F3F1D3C3D81C11E82A4A3134F0D822BE747981AA29D9F7A31DC44EAFD5B524CA87B5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.M?n.#ln.#ln.#ln."l..#l..~ly.#l...lo.#ln.#lo.#lRichn.#l........................PE..L....<.Z.................0...0......^......

File Icon


Icon Hash:	13554c92d244338f

Static PE Info

General

Entrypoint:	0x40bd5e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5AC53CC9 [Wed Apr 4 20:59:53 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	09d0478591d4f788cb3e5ea416c25237

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/04/2019 02:00:00 20/04/2022 14:00:00
Subject Chain	CN=Gibson Research Corporation, OU=Gibson Research Corporation, O=Gibson Research Corporation, L=Laguna Niguel, S=California, C=US, SERIALNUMBER=C1411812, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	7A34956311C60616188AF4DDACE69D56
Thumbprint SHA-1:	CE068EA21AA7C935AB9D3589BBDFB17610EAF717
Thumbprint SHA-256:	C989480EB128013BBB68079B3989C2032E11A8C02000621987B633A3E55248DB
Serial:	035F7EBDACF22EFED58CD2242C66B060

Entrypoint Preview

Instruction
mov eax, 004A930Ch
push eax
push dword ptr fs:[00000000h]
mov dword ptr fs:[00000000h], esp
xor eax, eax
mov dword ptr [eax], ecx
push eax
inc ebp
inc ebx
outsd
insd
jo 00007FB354688453h
arpl word ptr [edx+esi+00h], si
jmp 00007FB2F19C5A48h
or eax, 43D34444h
int1
int1
hlt
popad
sbb al, 06h
add edi, edx
push ds
enter 5258h, 15h
dec esi
pop ebp
cwde
add dword ptr [edi], AF19C1D2h
movsb
leave
dec edx
jbe 00007FB354688396h
mov eax, dword ptr [C0C0F467h]
fcmovnu st(0), st(4)
add esp, esi
inc ebx
jnbe 00007FB3546883E6h
xor byte ptr [ebx+edx*4], dh
sbb dword ptr [eax+72h], ebx
pop dword ptr [ebx+esi*2+7Dh]
sahf
push esp
xchg eax, ebp
jnl 00007FB354688413h
loopne 00007FB3546883E0h
int1
mov al, 04h
dec esi
sti
xor dword ptr [ebx-755D5F77h], 009AEF84h
les ebx, fword ptr [edx]
inc ebp
cmp eax, F6142FF2h
adc eax, E095D3BBh
push edx
xchg eax, esi
leave
or dh, byte ptr [eax]
les ebx, fword ptr [ecx-49DE750Fh]
in al, dx
jnc 00007FB35468838Dh
dec ecx
mov eax, dword ptr [AF890BEBh]
pop ebx
push esp
pop ebp
add eax, 5C41A0DBh
mov eax, 04B2A77Dh
shr byte ptr [edi-0456B33Bh], 1
inc esi
xchg eax, ecx
jns 00007FB354688431h
dec eax
mov edi, 8CA8CEC2h
retf
sbb al, 0Fh
inc eax
mov eax, dword ptr [AE119504h]
cmp dword ptr [edi], FFFFFFAFh
into
or esp, ecx
push 003E9AFDh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa86c4	0x8f	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa7000	0x16a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x22e00	0x4e20	.text
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa6000	0x20600	False	0.9984465492277992	data	7.997286904575205	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa7000	0x3000	0x2400	False	0.5944010416666666	data	5.760035483519286	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1c000	0x134	data	English	United States	1.0357142857142858
RT_ICON	0xa75c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.27673410404624277
RT_ICON	0xa7b28	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3387096774193548
RT_ACCELERATOR	0x1c138	0x170	OpenPGP Secret Key	English	United States	1.0298913043478262
RT_RCDATA	0x1c2a8	0x13948	data	English	United States	0.9882358455193101
RT_RCDATA	0x2fbf0	0x657	empty	English	United States	0
RT_RCDATA	0x30248	0x25d	empty	English	United States	0
RT_RCDATA	0x304a8	0x516	empty	English	United States	0
RT_RCDATA	0x309c0	0x23ca	empty	English	United States	0
RT_RCDATA	0x32d90	0x28e	empty	English	United States	0
RT_RCDATA	0x33020	0x3b36	empty	English	United States	0
RT_RCDATA	0x36b58	0x3b36	empty	English	United States	0
RT_RCDATA	0x3a690	0xa56	empty	English	United States	0
RT_RCDATA	0x3b0e8	0xa5ba	empty	English	United States	0
RT_RCDATA	0x456a8	0x4da	empty	English	United States	0
RT_RCDATA	0x45b88	0x8712	empty	English	United States	0
RT_RCDATA	0x4e2a0	0x29e56	empty	English	United States	0
RT_RCDATA	0x780f8	0x29e56	empty	English	United States	0
RT_RCDATA	0xa1f50	0x20fa	empty	English	United States	0
RT_RCDATA	0xa4050	0xb26	empty	English	United States	0
RT_RCDATA	0xa4b78	0x476	empty	English	United States	0
RT_GROUP_CURSOR	0xa4ff0	0x14	empty	English	United States	0
RT_GROUP_ICON	0xa7e10	0x22	data	English	United States	1.0588235294117647
RT_VERSION	0xa7e38	0x5d0	data	English	United States	0.4173387096774194
RT_MANIFEST	0xa8408	0x298	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5030120481927711

Imports

DLL	Import
kernel32.dll	LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States