top title background image
flash

HAWB 074-02689536.exe

Status: finished
Submission Time: 2025-01-20 14:36:14 +01:00
Malicious
Trojan
Spyware
Evader
FormBook, PureLog Stealer

Comments

Tags

  • exe

Details

  • Analysis ID:
    1595177
  • API (Web) ID:
    1595177
  • Analysis Started:
    2025-01-20 14:56:29 +01:00
  • Analysis Finished:
    2025-01-20 15:09:29 +01:00
  • MD5:
    f3950ad12ad7392982d52eb666627679
  • SHA1:
    2329e8aa67ba76e46d6b38c8e11abdf9d45cdc1a
  • SHA256:
    4c51ade72aa2794149ab89c2db1913bbb7d9ffe35b8b19d0217744356c998744
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 24/72
malicious
Score: 29/38
malicious
malicious

IPs

IP Country Detection
144.76.229.203
Germany
89.39.106.110
Netherlands
75.2.103.23
United States
Click to see the 6 hidden entries
104.21.16.1
United States
84.32.84.32
Lithuania
104.21.76.194
United States
104.21.3.103
United States
209.74.64.189
United States
104.21.64.1
United States

Domains

Name IP Detection
www.smartoves.xyz
209.74.64.189
www.tpisharagame.tech
104.21.3.103
031233226.xyz
144.76.229.203
Click to see the 16 hidden entries
www.lsj002.vip
104.21.76.194
solide.energy
89.39.106.110
www.rentaferry.net
75.2.103.23
www.cikolatasampuan.xyz
104.21.16.1
thesnusgang.fun
84.32.84.32
www.autoluxmod.xyz
0.0.0.0
www.031233226.xyz
0.0.0.0
www.arabhost.shop
0.0.0.0
www.elevatetextiles.net
0.0.0.0
www.fullhdfilmizlesene.uno
0.0.0.0
www.myj01.lol
0.0.0.0
www.voicecraft.pro
0.0.0.0
www.solide.energy
0.0.0.0
www.thesnusgang.fun
0.0.0.0
www.stayhealth.online
0.0.0.0
www.mzkd6gp5.top
104.21.64.1

URLs

Name Detection
http://www.rentaferry.net/7yc9/?lNN=aRIaC9gDe/dH3tfzY3lgbVqJ3R3EH2Fed+7DHi0iFYqyEoH18/D2WTK7l9Re+opRXTGlVFFbUp4OC3TvF/wqrjoV5UGDRUcmyM1cz6XaHw0x1RrJSbMLhKujGu6VAYe5hw==&In2lk=m23T5ZuX2nXD
http://www.rentaferry.net/7yc9/
http://www.solide.energy/at0e/
Click to see the 26 hidden entries
http://www.mzkd6gp5.top/w43d/
http://www.lsj002.vip/j82q/
http://www.thesnusgang.fun/7f2t/
http://www.solide.energy/at0e/?lNN=glBboHvnA5KwfVtLQ1mtEooO2PGRO7YOVM+o8955cLiD83QsgYuB7eKz8WZH6nHrES5//nUfd37XNyIPGQ+hDm9jm6zCBqrlVCpFmavug8MAMqqVTo1FfqvzWsrAQ9SR/g==&In2lk=m23T5ZuX2nXD
http://www.smartoves.xyz/phk4/
http://www.mzkd6gp5.top/w43d/?lNN=lLA/MNGMfc66cx7abJgEAS6+NUf5NH1ZKmnJTF5N5bJcdAsiLggGfcPrNz2JB8GMGDitbGZ0VxdkUq0i8QjW/C7UYlYACUrrHpj/vLHFjCpO1JXYqpsz+6M3Y8FZF8wV3w==&In2lk=m23T5ZuX2nXD
http://www.tpisharagame.tech/eds0/?lNN=PP6EakFAxnpp5GYljRuw0WPfiQngn2kDjGLSSYIW4GcAiHO963edCzVkG4LWAkqjf7cYRh4z/zUqGAI7EzPHOjd7oCscmzTaZ3o+pG8ZPcN4H02+b+TNev+SG0SRlcAwUA==&In2lk=m23T5ZuX2nXD
http://www.smartoves.xyz/phk4/?In2lk=m23T5ZuX2nXD&lNN=WtUVCzknD2xiUVKfbKcwKynAqh4b3EgB+SMfWY7VEStf7wlSIRe0LwHJO3qQAQmEPhRoUmkA9kegJawyjpGwi/klJQ/yphvVbDosbBy1CwJtt/L4Z0dE9xwc0aqlBu7UpA==
http://www.031233226.xyz/vcs0/?lNN=jt9tgHhOb8qKtaUSEcS8dZUE9nlaVMXik/PmFmQtEMonvuwIqKidj9Y7PpQINJjuRKGlvNe6URnoNuIvHnVR3ga0WGzPDqO1nOQ6MZxsGRy4LbrB1psZc3ycbECfHdX+NA==&In2lk=m23T5ZuX2nXD
http://www.cikolatasampuan.xyz/igu6/
http://www.lsj002.vip/j82q/?lNN=4If2eahAlLZkHgvX2j/c1tjGppon2+7Bpqc326es6gKqcy1LF6K46kZ+kQLwds/t3238MagTtt5T9hV4kkz+UqQmtzmww7XvsG6VsN2qmgxE4JihDqRQi/c8dKFxZTmOYg==&In2lk=m23T5ZuX2nXD
http://www.thesnusgang.fun/7f2t/?lNN=v+rH8pJ5SFQ4qmRI0R3Bawt45RpRJtkuWBFa2S8zd+dTec/4rH3NjAo9Z4uXCkYdZH8kOoxqkdRpTx3RMYVbROWAhCoX1Lf9x5Ne4hhEigxWXRZMftb7cwr5t7KhyieF4g==&In2lk=m23T5ZuX2nXD
http://www.cikolatasampuan.xyz/igu6/?lNN=V7LlAj5CuMsHzB55uLF42ed4BWARLEQ8RvKKdTIqGhgyrCaS0uKDWI+dkK8us+3a4OQ9qPYoMzisFxVP9FYZhdo7QX2Bt0+73qAojoF/+1lk8HCr4NuzJH0k0/K2FMkwgA==&In2lk=m23T5ZuX2nXD
http://www.031233226.xyz/vcs0/
http://www.tpisharagame.tech/eds0/
https://ac.ecosia.org/autocomplete?q=
https://www.ecosia.org/newtab/
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
http://cikolatasampuan.xyz/
https://duckduckgo.com/ac/?q=
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
http://www.mzkd6gp5.top
https://duckduckgo.com/chrome_newtab

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HAWB 074-02689536.exe.log
ASCII text, with CRLF line terminators
#