Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

testu.txt

ASCII text, with very long lines (456), with CRLF line terminators

initial sample

Details

Filetype:	ASCII text, with very long lines (456), with CRLF line terminators
Entropy:	5.983197882153962
Filename:	testu.txt
Filesize:	1868
MD5:	71709cd72129a82cce420facd5e9aa8e
SHA1:	f6f00b4242af6c7ea08af3704114e51ea60a098b
SHA256:	388d14efff78b58c84a75d35ae309a121cb2f37851252ab6d07b43c6d89d8c6c
SHA512:	074f7b56af2617de6854e66d1b518de999692f20de21b5d90775884d69d3bae11bf7c223f39a0bbb7de4ea53c437d49e55bddab0733a74206c5f585a32dca1c5
SSDEEP:	48:OxmWpW7pWmFDwgzo/GH4HWrwKb9wW8E5g:OtpcpBFDhzo/GYH4wS9w8g
Preview:	https://link.diffusion.sante.gouv.fr/c?p=wAbNBrbDxBBuFFD70NzQk0Bq0KPQp-jQ3kE_OtCTxBAbNRLq_jJAVtCa5QJNG-L9PNl-aHR0cHM6Ly9mcmFuY2V0cmFuc2ZlcnQubnVtZXJpcXVlLmdvdXYuZnIvZG93bmxvYWQvZG93bmxvYWQtaW5mby1wdWJsaWM_ZW5jbG9zdXJlPTdiMDYyMTQ2LTc2NjctNDE0Ni05MWFmLWQyMj

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.11.dr
ID:	dr_4
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.985471244473703
Encrypted:	false
Size:	2673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.11.dr
ID:	dr_2
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.00239123754982
Encrypted:	false
Size:	2675
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.11.dr
ID:	dr_5
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.008409023747649
Encrypted:	false
Size:	2689
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.11.dr
ID:	dr_1
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.001974169254436
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.11.dr
ID:	dr_3
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9903986655253023
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.11.dr
ID:	dr_0
Target ID:	11
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jun 24 02:35:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.999128869303192
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Domains

Name

Malicious

hub08.sarbatech.com

185.75.141.215

plus.l.google.com

216.58.206.46

play.google.com

142.250.184.238

www3.l.google.com

142.250.186.78

www.google.com

142.250.186.100

sc-lb-pool-01.osc-secnum-fr1.suserngo-network.com

148.253.96.193

178-33-22-51.lb.d.eu-west-2.cloudprotector.com

178.33.22.51

sc-lb-pool-01.osc-fr1.suserngo-network.com

109.232.236.90

integration.lasuite.numerique.gouv.fr

unknown

link.diffusion.sante.gouv.fr

unknown

rizomo-connect.numerique.gouv.fr

unknown

francetransfert.numerique.gouv.fr

unknown

translate.google.com

unknown

apis.google.com

unknown

There are 4 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

142.250.185.99

unknown

United States

142.250.186.78

www3.l.google.com

United States

142.250.186.67

unknown

United States

172.217.16.202

unknown

United States

148.253.96.193

sc-lb-pool-01.osc-secnum-fr1.suserngo-network.com

France

178.33.22.51

178-33-22-51.lb.d.eu-west-2.cloudprotector.com

France

192.168.2.16

unknown

142.250.185.202

unknown

United States

216.58.206.46

plus.l.google.com

United States

192.168.2.5

unknown

74.125.206.84

unknown

United States

239.255.255.250

unknown

Reserved

142.250.185.131

unknown

United States

109.232.236.90

sc-lb-pool-01.osc-fr1.suserngo-network.com

France

142.250.186.110

unknown

United States

142.250.186.100

www.google.com

United States

142.250.184.238

play.google.com

United States

216.58.212.163

unknown

United States

185.75.141.215

hub08.sarbatech.com

France

142.250.186.42

unknown

United States

142.250.186.74

unknown

United States

142.250.186.99

unknown

United States

There are 12 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
testu.txt

Files

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporttestu.txt

Files

Domains

IPs

IOC Report
testu.txt