analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Sample_List_9845724(pdf).html |
| Full analysis: | https://app.any.run/tasks/9c857e72-781c-4525-8d71-7ef9dfb38cf7 |
| Verdict: | Malicious activity |
| Analysis date: | January 17, 2019, 19:39:45 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text, with CRLF line terminators |
| MD5: | 851FBDD68613EDE7C6E46107D54F9D88 |
| SHA1: | EE4E3B68B33FD9F01C07E5AD7B8BC5024D6F4CFD |
| SHA256: | 01FCF1488BAD8628469D418108FF0A947B8A2232DBD904A00605C9F5DD4CCFF1 |
| SSDEEP: | 96:5nwU6VAaQhJiUhRU0G/c3t2b0jx5Fygou5TodoyxDjIY8M7x96:5wUvaQiUhRhM8t2wuulydFsHYx96 |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads internet explorer settings
- iexplore.exe (PID: 3448)
- iexplore.exe (PID: 2552)
Changes internet zones settings
- iexplore.exe (PID: 2944)
Application launched itself
- iexplore.exe (PID: 2944)
Reads settings of System Certificates
- iexplore.exe (PID: 3448)
- iexplore.exe (PID: 2944)
Changes settings of System certificates
- iexplore.exe (PID: 3448)
- iexplore.exe (PID: 2944)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3448)
- iexplore.exe (PID: 2944)
Reads Internet Cache Settings
- iexplore.exe (PID: 3448)
- iexplore.exe (PID: 2552)
Creates files in the user directory
- iexplore.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .html | | | HyperText Markup Language (100) |
|---|
Total processes
34
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2944 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Sample_List_9845724(pdf).html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3448 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2552 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
644
Read events
538
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
1
Text files
35
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2552 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\excel[1].txt | — | |
MD5:— | SHA256:— | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFE7812658AC89678A.TMP | — | |
MD5:— | SHA256:— | |||
| 3448 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019011720190118\index.dat | dat | |
MD5:342DACA1995181D70E2281EE5B3A3249 | SHA256:6E3EEA0498358A96DDC691D5BEFAABCECC2A91803638624EEB5CDEB23F3AFDFD | |||
| 2552 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\social[1].txt | text | |
MD5:D6CD7FEB1102CDA5FC270328BDF929ED | SHA256:0AA38137F88323B1D5C74175F03C70D2DCA163A54789A8D47D9623261B992138 | |||
| 3448 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\QvZ50dc[1].png | image | |
MD5:AF85FD95ED88F25E0E8765332C8CA650 | SHA256:8C22D976AA2D1E204B3842656AB5411469056CDE9B06D765612D7FA1140E2472 | |||
| 3448 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\qR2cUkP[1].png | image | |
MD5:B821E81C45EA67B122F4B1B8DB02ED2B | SHA256:6D942AEC8B6C1CB62ED5B56C52A7DB106B1E828122A123C2957C7EDBA071B510 | |||
| 2552 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\12-c5ad5a[1].txt | text | |
MD5:D1BCCE755E79047605902AF25902912E | SHA256:F57DA4E47FC652EC1093B91B9DBC7B142B6B07F3CA10F1A52756E0914FEDA462 | |||
| 2552 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\65-fb0cb6[1].txt | text | |
MD5:6BE720B76D780BBD6C4F890B7487E6ED | SHA256:A8CC8DE948BAFAC15DA9431C406B5F048C60B6CD3082A11045B8D56DCBA33FB8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
36
DNS requests
12
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2552 | iexplore.exe | POST | 302 | 174.127.119.210:80 | http://moonmaroon.com/wp-content/uploads/2015/12/a.php | US | binary | 20 b | malicious |
2944 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2944 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3448 | iexplore.exe | 172.217.18.170:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
2552 | iexplore.exe | 174.127.119.210:80 | moonmaroon.com | WestHost, Inc. | US | suspicious |
3448 | iexplore.exe | 151.101.120.193:443 | i.imgur.com | Fastly | US | malicious |
2552 | iexplore.exe | 104.111.224.164:443 | products.office.com | Akamai International B.V. | NL | whitelisted |
3448 | iexplore.exe | 69.89.31.230:443 | smallenvelop.com | Unified Layer | US | suspicious |
2552 | iexplore.exe | 23.211.9.92:443 | www.microsoft.com | Akamai Technologies, Inc. | NL | whitelisted |
2944 | iexplore.exe | 23.210.249.93:443 | c.s-microsoft.com | Akamai International B.V. | NL | whitelisted |
2552 | iexplore.exe | 2.16.186.27:443 | img-prod-cms-rt-microsoft-com.akamaized.net | Akamai International B.V. | — | whitelisted |
2552 | iexplore.exe | 64.4.54.254:443 | web.vortex.data.microsoft.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ajax.googleapis.com |
| whitelisted |
i.imgur.com |
| shared |
www.bing.com |
| whitelisted |
smallenvelop.com |
| whitelisted |
moonmaroon.com |
| malicious |
products.office.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
c.s-microsoft.com |
| whitelisted |
mem.gfx.ms |
| whitelisted |
img-prod-cms-rt-microsoft-com.akamaized.net |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2552 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS Possible Successful Generic Phish Jan 14 2016 |