Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.984873547156934
Encrypted:	false
Size:	2673
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.001885967365184
Encrypted:	false
Size:	2675
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.010080528414421
Encrypted:	false
Size:	2689
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9986794921074456
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9876918144320186
Encrypted:	false
Size:	2677
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 08:15:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.996964269854148
Encrypted:	false
Size:	2679
Whitelisted:	false

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\Downloads\6066d596-c097-41ea-8c4a-8dec03ac3d68.tmp

PDF document, version 2.0 (zip deflate encoded)

dropped

Details

File:	C:\Users\user\Downloads\6066d596-c097-41ea-8c4a-8dec03ac3d68.tmp
Category:	dropped
Dump:	6066d596-c097-41ea-8c4a-8dec03ac3d68.tmp.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PDF document, version 2.0 (zip deflate encoded)
Entropy:	7.946845529354188
Encrypted:	false
Size:	15664
Whitelisted:	false

C:\Users\user\Downloads\INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf (copy)

PDF document, version 2.0 (zip deflate encoded)

dropped

Details

File:	C:\Users\user\Downloads\INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf (copy)
Category:	dropped
Dump:	INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf.crdownload.0.dr
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PDF document, version 2.0 (zip deflate encoded)
Entropy:	0.0
Encrypted:	false
Size:	0
Whitelisted:	false

C:\Users\user\Downloads\INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf.crdownload

PDF document, version 2.0 (zip deflate encoded)

dropped

Details

File:	C:\Users\user\Downloads\INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf.crdownload
Category:	dropped
Dump:	INDUSTRIAL CONNECTORS - COUPLINGS - DATA SHEET.pdf.crdownload.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PDF document, version 2.0 (zip deflate encoded)
Entropy:	7.990869163970242
Encrypted:	true
Size:	376028
Whitelisted:	false

URLs

Name

Malicious

https://we.tl/t-BVtGtb0HLz

Details

Filetype:	URL
Filename:	https://we.tl/t-BVtGtb0HLz

Signature Hits	Behavior Group	Mitre Attack
AI detected landing page (webpage, office document or email)	Persistence and Installation Behavior	Browser Extensions
Phishing site detected (based on favicon image match)	Phishing
Phishing site or detected (based on various text indicators)	Phishing
Detected non-DNS traffic on DNS port	Networking
HTML page contains hidden javascript code	Phishing
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Creates files inside the user directory	System Summary	Masquerading
HTML page is missing a favicon	Phishing
Performs DNS lookups	Networking	Non-Application Layer Protocol Application Layer Protocol
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Encrypted Channel
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

file:///C:/Users/user/Downloads/INDUSTRIAL%20CONNECTORS%20-%20COUPLINGS%20-%20DATA%20SHEET.pdf

Details

Name:	file:///C:/Users/user/Downloads/INDUSTRIAL%20CONNECTORS%20-%20COUPLINGS%20-%20DATA%20SHEET.pdf
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
AI detected landing page (webpage, office document or email)	Persistence and Installation Behavior	Browser Extensions
Phishing site detected (based on favicon image match)	Phishing
HTML page is missing a favicon	Phishing

Domains

Name

Malicious

sp-20200324121949090600000008-54648268.eu-west-1.elb.amazonaws.com

52.30.139.70

cs837.wac.edgecastcdn.net

192.229.133.221

dg2iu7dxxehbo.cloudfront.net

18.239.67.100

insight.adsrvr.org

3.33.220.150

scontent.xx.fbcdn.net

157.240.253.1

cdnjs.cloudflare.com

104.17.25.14

cm.g.doubleclick.net

172.217.16.194

www.google.com

172.217.23.100

ara.paa-reporting-advertising.amazon

108.138.192.119

wetransfer.fides-cdn.ethyca.com

18.245.86.79

bsp-proxy.wetransfer.net

52.17.56.161

match.adsrvr.org

52.223.40.198

doc-datafiles2891673526uayte6453-pubdoc.pages.dev

188.114.97.3

star-mini.c10r.facebook.com

157.240.253.35

a.nel.cloudflare.com

35.190.80.1

we.tl

18.66.147.15

ax-0001.ax-dc-msedge.net

150.171.29.10

s.amazon-adsystem.com

98.82.156.207

e-prod-alb-s105-us-east-1-01.adzerk.net

52.203.206.228

dna8twue3dlxq.cloudfront.net

18.66.196.119

api.pico.bendingspoonsapps.com

34.102.204.67

ax-0001.ax-msedge.net

150.171.27.10

d1ykf07e75w7ss.cloudfront.net

108.138.190.150

download.wetransfer.com

18.245.60.93

analytics-v2.wetransfer.com

13.32.27.54

prod.pinterest.global.map.fastly.net

151.101.192.84

di.rlcdn.com

35.244.174.68

googleads.g.doubleclick.net

142.250.186.162

dualstack.pinterest.map.fastly.net

151.101.0.84

cdn.wetransfer.com

143.204.98.97

ekstrom.wetransfer.net

34.247.65.7

wetransfer.com

143.204.98.51

auth-session-caching.wetransfer.net

34.247.65.7

experiments.wetransfer.com

13.33.187.87

tagging.wetransfer.com

18.245.46.95

ib.anycast.adnxs.com

185.89.210.122

nolan.wetransfer.net

13.224.189.11

cdn.jsdelivr.net

unknown

snowplow.wetransfer.com

unknown

ct.pinterest.com

unknown

www.w3schools.com

unknown

www.facebook.com

unknown

js.adsrvr.org

unknown

c.amazon-adsystem.com

unknown

privacy.wetransfer.com

unknown

pixel.rubiconproject.com

unknown

connect.facebook.net

unknown

public.profitwell.com

unknown

s.pinimg.com

unknown

ib.adnxs.com

unknown

e-10220.adzerk.net

unknown

There are 41 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

151.101.0.84

dualstack.pinterest.map.fastly.net

United States

108.138.192.119

ara.paa-reporting-advertising.amazon

United States

104.18.187.31

unknown

United States

13.32.27.54

analytics-v2.wetransfer.com

United States

18.245.86.118

unknown

United States

108.138.190.150

d1ykf07e75w7ss.cloudfront.net

United States

13.224.189.11

nolan.wetransfer.net

United States

98.82.156.207

s.amazon-adsystem.com

United States

151.101.128.84

unknown

United States

142.251.168.84

unknown

United States

34.102.204.67

api.pico.bendingspoonsapps.com

United States

52.30.139.70

sp-20200324121949090600000008-54648268.eu-west-1.elb.amazonaws.com

United States

18.204.39.54

unknown

United States

143.204.98.97

cdn.wetransfer.com

United States

143.204.98.51

wetransfer.com

United States

35.190.80.1

a.nel.cloudflare.com

United States

13.32.27.128

unknown

United States

69.173.144.165

unknown

United States

142.250.185.67

unknown

United States

3.33.220.150

insight.adsrvr.org

United States

34.104.35.123

unknown

United States

1.1.1.1

unknown

Australia

104.18.186.31

unknown

United States

185.89.210.122

ib.anycast.adnxs.com

Germany

108.138.192.103

unknown

United States

54.155.48.237

unknown

United States

239.255.255.250

unknown

Reserved

188.114.97.3

doc-datafiles2891673526uayte6453-pubdoc.pages.dev

European Union

150.171.29.10

ax-0001.ax-dc-msedge.net

United States

172.217.23.100

www.google.com

United States

35.244.174.68

di.rlcdn.com

United States

172.217.16.194

cm.g.doubleclick.net

United States

157.240.253.35

star-mini.c10r.facebook.com

United States

108.157.188.91

unknown

United States

52.223.40.198

match.adsrvr.org

United States

18.245.46.38

unknown

United States

151.101.192.84

prod.pinterest.global.map.fastly.net

United States

104.17.25.14

cdnjs.cloudflare.com

United States

18.245.60.93

download.wetransfer.com

United States

18.239.67.100

dg2iu7dxxehbo.cloudfront.net

United States

18.172.103.101

unknown

United States

192.168.2.16

unknown

34.247.65.7

ekstrom.wetransfer.net

United States

52.48.170.216

unknown

United States

13.33.187.87

experiments.wetransfer.com

United States

98.82.157.231

unknown

United States

18.244.140.9

unknown

United States

142.250.186.131

unknown

United States

142.250.184.206

unknown

United States

172.217.18.10

unknown

United States

52.203.206.228

e-prod-alb-s105-us-east-1-01.adzerk.net

United States

157.240.252.35

unknown

United States

18.66.147.15

we.tl

United States

142.250.184.202

unknown

United States

13.224.186.120

unknown

United States

18.66.196.119

dna8twue3dlxq.cloudfront.net

United States

142.250.186.162

googleads.g.doubleclick.net

United States

52.17.56.161

bsp-proxy.wetransfer.net

United States

108.159.227.117

unknown

United States

192.229.133.221

cs837.wac.edgecastcdn.net

United States

150.171.27.10

ax-0001.ax-msedge.net

United States

157.240.251.9

unknown

United States

142.250.181.226

unknown

United States

18.245.46.95

tagging.wetransfer.com

United States

18.245.46.51

unknown

United States

143.204.98.85

unknown

United States

157.240.253.1

scontent.xx.fbcdn.net

United States

142.250.181.228

unknown

United States

13.32.121.58

unknown

United States

18.245.86.79

wetransfer.fides-cdn.ethyca.com

United States

18.245.46.98

unknown

United States

142.250.186.66

unknown

United States

There are 62 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://we.tl/t-BVtGtb0HLz

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://we.tl/t-BVtGtb0HLz

Files

URLs

Domains

IPs

IOC Report
https://we.tl/t-BVtGtb0HLz