top title background image
flash

New order number 240611-06SN.exe

Status: finished
Submission Time: 2024-10-25 16:19:24 +02:00
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • exe

Details

  • Analysis ID:
    1542191
  • API (Web) ID:
    1542191
  • Analysis Started:
    2024-10-25 16:36:56 +02:00
  • Analysis Finished:
    2024-10-25 16:47:31 +02:00
  • MD5:
    2f3877d0041db22af7371e723df92208
  • SHA1:
    14453b14d3022d25e8a77b3d07ed86c262f605e3
  • SHA256:
    f5192d0f7603e198e0b3098e9204ab40d11958a9bc27d8477db41cd5350b6242
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 26/38
malicious

Domains

Name IP Detection
www.qega.shop
0.0.0.0
www.ecurity-apps-89277.bond
0.0.0.0
www.roker.autos
0.0.0.0
Click to see the 2 hidden entries
www.uy-smart-tv-ar.today
0.0.0.0
www.ohnpaulgetty.xyz
0.0.0.0

URLs

Name Detection
www.partments-for-rent-gurus.sbs/fh84/
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
http://www.uy-smart-tv-ar.todayReferer:
Click to see the 97 hidden entries
http://www.angerouslyliberalkamala.info
http://www.ldsoul.nyc/fh84/www.unkusol.xyz
http://www.uratedcelebrations.netReferer:
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
http://www.lsdao.xyz/fh84/
http://www.ldsoul.nyc/fh84/
http://www.roker.autos/fh84/www.races-dental-splints-52226.bond
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
http://www.unkusol.xyz/fh84/
http://www.partments-for-rent-gurus.sbs
http://www.uy-smart-tv-ar.today/fh84/www.ohnpaulgetty.xyz
http://www.etropixelshop.info/fh84/
http://www.8745.net
http://schemas.micro
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
http://www.uy-smart-tv-ar.today/fh84/
http://www.nmnm.topReferer:
http://www.ecurity-apps-89277.bond
https://www.pollensense.com/
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
http://www.foreca.com
http://www.races-dental-splints-52226.bondReferer:
https://www.msn.com:443/en-us/feed
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
https://api.msn.com/
http://www.qega.shopReferer:
http://www.roker.autosReferer:
http://www.ecurity-apps-89277.bond/fh84/
http://www.roker.autos
http://www.uratedcelebrations.net/fh84/www.nmnm.top
http://www.ohnpaulgetty.xyz
http://www.lsdao.xyz/fh84/www.roker.autos
http://www.qega.shop
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
https://powerpoint.office.com
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
http://www.unkusol.xyz/fh84/www.partments-for-rent-gurus.sbs
http://www.qega.shop/fh84/
http://www.nmnm.top
http://www.uy-smart-tv-ar.today
https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
http://www.lsdao.xyzReferer:
http://www.ldsoul.nycReferer:
http://www.ecurity-apps-89277.bondReferer:
http://www.partments-for-rent-gurus.sbs/fh84/
https://excel.office.com
http://www.asksksmsms.xyz
http://www.autoitscript.com/autoit3/J
https://wns.windows.com/
http://www.8745.net/fh84/www.asksksmsms.xyz
https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
http://www.ohnpaulgetty.xyz/fh84/www.qega.shop
http://www.partments-for-rent-gurus.sbs/fh84/www.uratedcelebrations.net
http://www.races-dental-splints-52226.bond/fh84/
http://www.ldsoul.nyc
http://www.angerouslyliberalkamala.infoReferer:
http://www.ohnpaulgetty.xyzReferer:
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
http://www.nmnm.top/fh84/
http://www.uratedcelebrations.net
http://www.8745.netReferer:
http://www.8745.net/fh84/
https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
https://api.msn.com:443/v1/news/Feed/Windows?
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
https://api.msn.com:443/v1/news/Feed/Windows?t
http://www.roker.autos/fh84/
http://www.nmnm.top/fh84/www.8745.net
http://www.unkusol.xyz
https://outlook.com
https://api.msn.com/v1/news/Feed/Windows?
http://www.angerouslyliberalkamala.info/fh84/
http://www.etropixelshop.infoReferer:
http://www.angerouslyliberalkamala.info/fh84/www.ldsoul.nyc
http://www.lsdao.xyz
http://www.unkusol.xyzReferer:
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
http://www.qega.shop/fh84/www.lsdao.xyz
http://www.asksksmsms.xyz/fh84/
https://android.notify.windows.com/iOS
http://www.etropixelshop.info
http://www.asksksmsms.xyzReferer:
http://www.uratedcelebrations.net/fh84/
http://www.races-dental-splints-52226.bond/fh84/www.angerouslyliberalkamala.info
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
http://www.ecurity-apps-89277.bond/fh84/www.uy-smart-tv-ar.today
http://www.asksksmsms.xyz/fh84/www.etropixelshop.info
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
http://www.partments-for-rent-gurus.sbsReferer:
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
http://www.ohnpaulgetty.xyz/fh84/
https://word.office.com
http://www.races-dental-splints-52226.bond

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New order number 240611-06SN.exe.log
ASCII text, with CRLF line terminators
#