File name: | 이력서12.zip |
Full analysis: | https://app.any.run/tasks/eb12d360-d133-4d30-bed5-50ca39f87ba2 |
Verdict: | Malicious activity |
Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
Analysis date: | October 05, 2022, 07:31:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 936CFF0DE02570F5D13F9B12F038852F |
SHA1: | EFBB70F33DE6B65E91734AEE36BA735A6937BA10 |
SHA256: | 314F1CE35ED76BEC5E9A01EE24F2CC7A1B8565C1CA323CFC909C3611FA50D191 |
SSDEEP: | 24576:NQ6ZR1oV9G25g0YhhOgq6p14/g/R6M5hVjaup:N1L1ao70Yfq6Xd6M5hVja+ |
.zip | | | ZIP compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
296 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\이력서12.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
3528 | "C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe" | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | Explorer.EXE | ||||||||||||
User: admin Company: PortableApps.com Integrity Level: MEDIUM Description: AkelPad Portable Exit code: 3221225477 Version: 4.9.8.0 Modules
| |||||||||||||||
3440 | ﮅ | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | ||||||||||||
User: admin Company: PortableApps.com Integrity Level: MEDIUM Description: AkelPad Portable Version: 4.9.8.0 Modules
| |||||||||||||||
1892 | C:\Windows\system32\WerFault.exe -u -p 3528 -s 364 | C:\Windows\system32\WerFault.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2380 | "C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe" | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | Explorer.EXE | ||||||||||||
User: admin Company: PortableApps.com Integrity Level: MEDIUM Description: AkelPad Portable Exit code: 0 Version: 4.9.8.0 Modules
| |||||||||||||||
3892 | ﮅ | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | — | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | |||||||||||
User: admin Company: PortableApps.com Integrity Level: MEDIUM Description: AkelPad Portable Exit code: 0 Version: 4.9.8.0 Modules
| |||||||||||||||
3988 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2896 | "C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe" | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | DllHost.exe | ||||||||||||
User: admin Company: PortableApps.com Integrity Level: HIGH Description: AkelPad Portable Exit code: 0 Version: 4.9.8.0 Modules
| |||||||||||||||
2648 | ﮅ | C:\Users\admin\Desktop\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | ||||||||||||
User: admin Company: PortableApps.com Integrity Level: HIGH Description: AkelPad Portable Exit code: 0 Version: 4.9.8.0 Modules
| |||||||||||||||
3388 | "C:\ProgramData\1D5A.tmp" | C:\ProgramData\1D5A.tmp | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3528 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | C:\Users\admin\AppData\Local\Temp\1228324467 | — | |
MD5:— | SHA256:— | |||
1892 | WerFault.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash___입사지원서(221003) _bf1736c6a476419fec9498368a13e42aac397e4e_0776e622\Report.wer | — | |
MD5:— | SHA256:— | |||
2380 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\Users\admin\AppData\Local\Temp\253527685 | — | |
MD5:— | SHA256:— | |||
1892 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe.3528.dmp | dmp | |
MD5:508BA0E20345B095C9622DC375241E08 | SHA256:3BF9D7B78D0C780A7FBD8429FF098638B99B1F596E870E81F165F46C3012A7DE | |||
2648 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DDDDDDDDDDD | binary | |
MD5:F4FFF59F7454FAA58DE20BD518DF744C | SHA256:9C8564B3CC4BBD3199F20D5B94519D37F031B2CB0D6D7A5F376E26FB34518D38 | |||
2648 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\BBBBBBBBBBB | binary | |
MD5:F4FFF59F7454FAA58DE20BD518DF744C | SHA256:9C8564B3CC4BBD3199F20D5B94519D37F031B2CB0D6D7A5F376E26FB34518D38 | |||
2648 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\GGGGGGGGGGG | binary | |
MD5:F4FFF59F7454FAA58DE20BD518DF744C | SHA256:9C8564B3CC4BBD3199F20D5B94519D37F031B2CB0D6D7A5F376E26FB34518D38 | |||
2648 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\EEEEEEEEEEE | binary | |
MD5:F4FFF59F7454FAA58DE20BD518DF744C | SHA256:9C8564B3CC4BBD3199F20D5B94519D37F031B2CB0D6D7A5F376E26FB34518D38 | |||
2648 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.ini | binary | |
MD5:F4FFF59F7454FAA58DE20BD518DF744C | SHA256:9C8564B3CC4BBD3199F20D5B94519D37F031B2CB0D6D7A5F376E26FB34518D38 | |||
3528 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | C:\Users\admin\AppData\Local\Temp\nsb4F04.tmp\System.dll | executable | |
MD5:CFF85C549D536F651D4FB8387F1976F2 | SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3440 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | GET | 200 | 23.217.138.108:80 | http://budgereegahprespinalunignominiousness.com/v6/rqeu.php?ztmo=6 | US | html | 406 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3440 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | 23.217.138.108:80 | budgereegahprespinalunignominiousness.com | Akamai International B.V. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
tinneatonenessnabobical.com |
| suspicious |
sakkoinosemaacarpous.com |
| malicious |
beautpollinctorremasticate.com |
| unknown |
dissensionconjecturalistprintout.com |
| unknown |
budgereegahprespinalunignominiousness.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3440 | __입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다1.exe | A Network Trojan was detected | ET USER_AGENTS Suspicious User-Agent (USERAGENT) |