top title background image
flash

3_Рахунок.pdf.exe

Status: finished
Submission Time: 2024-02-02 09:36:06 +01:00
Malicious
Trojan
Evader
RMSRemoteAdmin, Remote Utilities

Comments

Tags

  • exe
  • RemoteUtilities
  • rurat

Details

  • Analysis ID:
    1385428
  • API (Web) ID:
    1385428
  • Analysis Started:
    2024-02-02 09:36:08 +01:00
  • Analysis Finished:
    2024-02-02 09:47:08 +01:00
  • MD5:
    075d6c122274cb9226521d3cd298f2f2
  • SHA1:
    6f54d70f39fa28596ef90bfcb0c14278b016db1b
  • SHA256:
    92192af947017c20ad861faf4459fb705e63f7083b34c77c1727891b88091573
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 20/71

IPs

IP Country Detection
101.99.94.54
Malaysia
77.105.132.70
Russian Federation
64.20.61.146
United States
Click to see the 2 hidden entries
185.70.104.90
Russian Federation
66.23.226.254
United States

Domains

Name IP Detection
id.remoteutilities.com
64.20.61.146
fp2e7a.wpc.phicdn.net
192.229.211.108
id72.remoteutilities.com
0.0.0.0

URLs

Name Detection
https://www.remoteutilities.com/support/docs/rt/docs/
http://update.remoteutilities.net/upgrade.ini
https://www.remoteutilities.com/tell-me-more.php1
Click to see the 36 hidden entries
https://www.remoteutilities.com/tell-me-more.php.
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
http://www.symauth.com/rpa00
https://www.remoteutilities.com/index.php?src=app
https://www.remoteutilities.com/support/docs/t0
https://www.remoteutilities.com/tell-me-more.phpes.
https://www.remoteutilities.com/support/docs/connecting-over-the-internet/
https://www.remoteutilities.com/index.php?src=appx.php?src=app0
https://www.remoteutilities.com/tell-me-more.php
http://update.remoteutilities.net/upgrade_beta.ini
https://www.remoteutilities.com/tell-me-more.phpdo?
https://www.remoteutilities.com/tell-me-more.phpken
http://www.flexerasoftware.com0
http://www.inkscape.org/namespaces/inkscape
https://www.remoteutilities.com/support/docs/a0
https://www.remoteutilities.com/support/docs
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpum
https://www.remoteutilities.com/tell-me-more.phpet
https://www.remoteutilities.com/support/docs/e
https://www.remoteutilities.com/support/docs/
https://www.remoteutilities.com/tell-me-more.phpities.com/tell-me-more.phpet
http://www.openssl.org/V
https://www.remoteutilities.com/support/docs/s0
http://madExcept.comU
https://www.remoteutilities.com/support/docs/o0
https://www.remoteutilities.com/support/docs/rt/docs/r
http://schemas.xmlsoap.org/soap/envelope/
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
http://www.indyproject.org/
https://www.remoteutilities.com/support/docs/0
https://www.remoteutilities.com/tell-me-more.phpB
http://www.symauth.com/cps0(
http://rmansys.ru/internet-id/
https://www.remoteutilities.com/tell-me-more.php...
http://www.openssl.org/support/faq.html
https://www.remoteutilities.com/index.php?src=app?src=app

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\Remote Utilities - Host\rutserv.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\Exel.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Remote Utilities - Host 7.2 installation package, Comments: This installer (…)
#