File name:

NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX.pdf with you.msg

Full analysis: https://app.any.run/tasks/58901ed9-0bc0-45c3-9805-dcbd5b0df53c
Verdict: Malicious activity
Analysis date: April 05, 2024, 18:51:19
OS: Ubuntu 22.04.2
Tags:
spam
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

2168E4837A10A317E9CEBEACB9BF8E8E

SHA1:

F53A634A71C255C189C730D1F0E1543C9CCDE2A5

SHA256:

19605CEF8741260DF2380B8C4A10DC117A42354B154BCC2F5595C0A72D69C49E

SSDEEP:

1536:GJJlmtQhzX+K3hm9+nWkWGWtW5xOWMW6NTJJL:GJytQ9NRCv5H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads /proc/mounts (likely used to find writable filesystems)

      • thunderbird (PID: 9346)
      • thunderbird (PID: 10027)
      • thunderbird (PID: 9637)

    • Checks DMI information (probably VM detection)

      • systemd-hostnamed (PID: 9992)
      • systemd-hostnamed (PID: 9326)
      • systemd-hostnamed (PID: 9601)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
544
Monitored processes
318
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sh no specs sudo no specs nautilus no specs locale-check no specs systemd-hostnamed no specs nautilus no specs thunderbird no specs which no specs thunderbird no specs glxtest no specs lsb_release no specs thunderbird no specs thunderbird no specs systemd-hostnamed no specs tracker-extract-3 no specs gjs-console no specs thunderbird no specs which no specs thunderbird no specs glxtest no specs lsb_release no specs thunderbird no specs gvfsd-http no specs thunderbird no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome no specs chrome no specs chrome no specs nacl_helper no specs chrome no specs chrome no specs nacl_helper no specs chrome no specs exe no specs chrome no specs chrome no specs chrome no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs which no specs grep no specs cut no specs dash no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs tr no specs dash no specs dash no specs tr no specs dash no specs dash no specs awk no specs cut no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs chrome no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs tr no specs dash no specs dash no specs tr no specs dash no specs awk no specs cut no specs dash no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs chrome no specs systemd-hostnamed no specs tracker-extract-3 no specs gjs-console no specs thunderbird no specs which no specs thunderbird no specs glxtest no specs lsb_release no specs thunderbird no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs nacl_helper no specs nacl_helper no specs chrome no specs chrome no specs chrome no specs exe no specs chrome no specs chrome no specs chrome no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs which no specs readlink no specs dash no specs grep no specs cut no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs dash no specs dash no specs tr no specs dash no specs tr no specs awk no specs cut no specs dash no specs basename no specs dash no specs which no specs readlink no specs dash no specs grep no specs cut no specs dash no specs xdg-mime no specs chrome no specs which no specs dash no specs dash no specs tr no specs dash no specs dash no specs tr no specs dash no specs awk no specs cut no specs dash no specs basename no specs dash no specs grep no specs cut no specs dash no specs which no specs readlink no specs chrome no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs exe no specs exe no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs thunderbird no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome no specs chrome_crashpad_handler no specs chrome no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome no specs nacl_helper no specs nacl_helper no specs chrome no specs chrome no specs thunderbird no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome_crashpad_handler no specs chrome no specs chrome no specs chrome no specs nacl_helper no specs nacl_helper no specs chrome no specs chrome no specs chrome no specs exe no specs chrome no specs chrome no specs chrome no specs xdg-settings no specs which no specs dash no specs basename no specs dash no specs which no specs grep no specs cut no specs dash no specs readlink no specs dash no specs xdg-mime no specs which no specs dash no specs dash no specs dash no specs dash no specs dash no specs dash no specs tr no specs dash no specs tr no specs awk no specs cut no specs basename no specs dash no specs which no specs readlink no specs xdg-mime no specs grep no specs cut no specs dash no specs which no specs dash no specs dash no specs dash no specs dash no specs tr no specs dash no specs tr no specs awk no specs cut no specs dash no specs basename no specs dash no specs which no specs readlink no specs grep no specs cut no specs dash no specs chrome no specs chrome no specs chrome no specs chrome no specs readlink no specs dirname no specs mkdir no specs cat no specs cat no specs chrome no specs chrome no specs chrome no specs chrome no specs chrome no specs

Process information

PID
CMD
Path
Indicators
Parent process
9305/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus \"/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg\" "/bin/sh—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
9306sudo -iu user nautilus "/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg"/usr/bin/sudo—sh
User:
user
Integrity Level:
UNKNOWN
9307nautilus "/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg"/usr/bin/nautilus—sudo
User:
user
Integrity Level:
UNKNOWN
9308/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
9326/lib/systemd/systemd-hostnamed/lib/systemd/systemd-hostnamed—systemd
User:
root
Integrity Level:
UNKNOWN
Exit code:
416
9345nautilus "/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg"/usr/bin/nautilus—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9346/usr/lib/thunderbird/thunderbird "/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg"/usr/lib/thunderbird/thunderbird—nautilus
User:
user
Integrity Level:
UNKNOWN
Exit code:
659
9347/bin/sh /usr/bin/which /usr/bin/thunderbird/usr/bin/which—thunderbird
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9349/usr/lib/thunderbird/thunderbird "/tmp/NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX\.pdf with you\.msg"/usr/lib/thunderbird/thunderbird—thunderbird
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
9354/usr/lib/thunderbird/glxtest -f 12/usr/lib/thunderbird/glxtest—thunderbird
User:
user
Integrity Level:
UNKNOWN
Exit code:
496
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
9307nautilus/home/user/.local/share/nautilus/tags/meta.db-wal —
MD5:—
SHA256:—
9307nautilus/home/user/.local/share/nautilus/tags/meta.db-shm —
MD5:—
SHA256:—
9307nautilus/home/user/.local/share/nautilus/tags/.meta.isrunning —
MD5:—
SHA256:—
9307nautilus/home/user/.config/mimeapps.list.PTS8L2 —
MD5:—
SHA256:—
9346thunderbird/home/user/.thunderbird/Crash Reports/InstallTime20231024181440 —
MD5:—
SHA256:—
9346thunderbird/tmp/thunderbird/.parentlock —
MD5:—
SHA256:—
9346thunderbird/home/user/.thunderbird/ubj17f5a.default-release/times.json —
MD5:—
SHA256:—
9346thunderbird/home/user/.thunderbird/6ls1yq17.default/times.json —
MD5:—
SHA256:—
9346thunderbird/home/user/.thunderbird/installs.ini —
MD5:—
SHA256:—
9346thunderbird/home/user/.thunderbird/profiles.ini —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
122
DNS requests
213
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
—
—
POST
200
184.24.77.54:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
—
—
POST
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclkrvzt3ph5qxof6xr7vwyfywmq_2024.4.1.0/niikhdgajlphfehepabhhblakbdgeefj_2024.04.01.00_all_cpyun4p2h7yxax6e2dt45dteja.crx3
unknown
binary
5.89 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/kiabhabjdbkjdpjbpigfodbdjmbglcoo/1.90b91aaa463ef666bf030c7f14b7046738dee86d64321b28cb834d04bbfea4b3/1.4a6508925b2ffec931c1e3931ddeb15ca41d820a8264cd5a962b526e9932bcdf/e7212b90bb1f0ff6252449bbddc556675aa725f13d46408fb87016facb011e35.puff
unknown
binary
3.21 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
binary
3.07 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.38d01effb9f02c3d201ba10492bdd903a464d5facba4a0ecfb2f7425ea1d1db9/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/46b11ec2cff16eaf5f1e6f5a34ea987cad9c35fe29615d0c221358f11073da1b.puff
unknown
binary
24.5 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqd6fue3v2wbae5o47rdgdgzsiq_441/lmelglejhemejginpboagddgdfbepgmp_441_all_ZZ_bxdub6eycravb226lszju6umqm.crx3
unknown
binary
46.8 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.0d7ae8d89e34c06da40cf00c682307af3cb63c62318011a392effd9fdb955322/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/faf82174b06a8e7bb61c7b66667a7b87dd1e00c85ba2d7581600b0e3f3995bce.puff
unknown
binary
54.9 Kb
unknown
—
—
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acv7kjxffunuzcslken2gczih6fa_8643/hfnkpimlhhgieaddgfemjhofmfblmnib_8643_all_ady7qhbyv5nfza4odusq5vfyv74a.crx3
unknown
binary
25.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.251:5353
—
—
—
unknown
—
—
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
unknown
—
—
13.224.189.107:443
services.addons.thunderbird.net
AMAZON-02
US
unknown
—
—
172.67.74.82:443
live.thunderbird.net
—
—
unknown
—
—
44.240.83.117:443
location.services.mozilla.com
AMAZON-02
US
unknown
—
—
184.24.77.54:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
—
—
104.26.3.27:443
live.thunderbird.net
CLOUDFLARENET
US
unknown
—
—
13.32.119.185:443
www.mozilla.org
AMAZON-02
US
unknown
—
—
142.250.186.174:443
sb-ssl.google.com
GOOGLE
US
unknown
—
—
142.250.186.35:80
ocsp.pki.goog
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.55
  • 185.125.188.54
  • 185.125.188.59
unknown
144.100.168.192.in-addr.arpa
  • —
unknown
services.addons.thunderbird.net
  • 13.224.189.107
  • 13.224.189.117
  • 13.224.189.48
  • 13.224.189.75
  • 2600:9000:20eb:c800:c:19e4:9800:93a1
  • 2600:9000:20eb:2e00:c:19e4:9800:93a1
  • 2600:9000:20eb:1200:c:19e4:9800:93a1
  • 2600:9000:20eb:a00:c:19e4:9800:93a1
  • 2600:9000:20eb:400:c:19e4:9800:93a1
  • 2600:9000:20eb:b600:c:19e4:9800:93a1
  • 2600:9000:20eb:9a00:c:19e4:9800:93a1
  • 2600:9000:20eb:ce00:c:19e4:9800:93a1
  • 2600:9000:20eb:3800:c:19e4:9800:93a1
  • 2600:9000:20eb:de00:c:19e4:9800:93a1
  • 2600:9000:20eb:7000:c:19e4:9800:93a1
  • 2600:9000:20eb:fc00:c:19e4:9800:93a1
  • 2600:9000:20eb:9400:c:19e4:9800:93a1
  • 2600:9000:20eb:d800:c:19e4:9800:93a1
  • 2600:9000:20eb:4c00:c:19e4:9800:93a1
  • 2600:9000:20eb:7c00:c:19e4:9800:93a1
whitelisted
location.services.mozilla.com
  • 44.240.83.117
  • 52.24.13.216
  • 52.41.233.141
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • —
unknown
live.thunderbird.net
  • 172.67.74.82
  • 104.26.2.27
  • 104.26.3.27
  • 2606:4700:20::681a:31b
  • 2606:4700:20::ac43:4a52
  • 2606:4700:20::681a:21b
whitelisted
r3.o.lencr.org
  • 184.24.77.54
  • 184.24.77.79
  • 184.24.77.48
  • 184.24.77.56
  • 2a02:26f0:480:e::210:f10f
  • 2a02:26f0:480:e::210:f108
shared
autoconfig.thunderbird.net
  • 104.26.3.27
  • 104.26.2.27
  • 172.67.74.82
  • 2606:4700:20::681a:21b
  • 2606:4700:20::ac43:4a52
  • 2606:4700:20::681a:31b
whitelisted
support.mozilla.org
  • 34.149.128.2
whitelisted
us-west1.prod.sumo.prod.webservices.mozgcp.net
  • —
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
—
—
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
—
—
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)
—
—
Misc activity
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NEW - ITTICK1485 FW EXTERNAL Keith West shared A file has been sent to you via DROPBOX.pdf with you.msg