analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://al4a.fun/ |
| Full analysis: | https://app.any.run/tasks/09b78a78-812c-4682-aabd-e5a65334e100 |
| Verdict: | No threats detected |
| Analysis date: | July 08, 2019, 08:04:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | CBFCDBAFEE6282516E768747BCAC614B |
| SHA1: | 87A53926916E0B0224C6081DAD11F5FB25EBCE48 |
| SHA256: | 4E4BE6384A4FAE8CDBB1F5AFB4A05DD78BD9588F6D362387F20C8E4C92A5A7E0 |
| SSDEEP: | 3:N1KfsOK:CkOK |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Changes internet zones settings
- iexplore.exe (PID: 3120)
Reads internet explorer settings
- iexplore.exe (PID: 3604)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3120)
Reads settings of System Certificates
- iexplore.exe (PID: 3120)
Changes settings of System certificates
- iexplore.exe (PID: 3120)
Creates files in the user directory
- iexplore.exe (PID: 3120)
- iexplore.exe (PID: 3604)
Reads Internet Cache Settings
- iexplore.exe (PID: 3604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3120 | "C:\Program Files\Internet Explorer\iexplore.exe" http://al4a.fun/ | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3604 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3120 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
432
Read events
356
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
35
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3604 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LGY7S9H9\al4a_fun[1].txt | — | |
MD5:— | SHA256:— | |||
| 3120 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT | smt | |
MD5:0E6270CCBB91CFC02FE2D292A8445557 | SHA256:01FF1000AA5D6E81E86FAC3398BD248F1A057490F85D369A6D9CCEF9FA8BBD03 | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LGY7S9H9\al4a_fun[1].htm | html | |
MD5:DB03D90B2918DD175763D6D3B536F411 | SHA256:AB857F29E893E73C10A8709C2699D7F58C98C0A15326FE0FD6EBF55FB0E54D7C | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:0CB7C4EFEE2E7F4A350307A1D1A096C7 | SHA256:7E0D220899DD7626EE8A89E893CEBFC8E6FEC60F7F942202B5CC7AC0D00603ED | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XHZFE1TS\exit[1].jpg | image | |
MD5:10F53A57B4AC295B8CFA85624C80127E | SHA256:3F396945C4EBAACBE742B9C8BEFB5BFEFE17060A9F12993392DBC7A6697FB692 | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\BOOBIEDD\al4a[1].xml | text | |
MD5:D85C3DBCEE82502225B3246C0B4C8094 | SHA256:5695C417F171CFCF371FEE39942DB4901F9D54DD0482A4FE2826A5DA979EF003 | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@al4a[2].txt | text | |
MD5:F2FA3EF66349CCEEB66ED0A3169BF4BD | SHA256:41D6BD188EB8EE834C13E5661C4DB1EC77726E8BAF50BFC0F395B4D65A997671 | |||
| 3604 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@al4a[1].txt | text | |
MD5:B1C81AC9617B4839283DEA8A4EF02484 | SHA256:6B7257EC11E5D77606A5653D3944A7B695F1BE19AFB544EACA9BC467EBE1CBC9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
16
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3604 | iexplore.exe | GET | 200 | 104.31.72.51:80 | http://al4a.fun/ | US | html | 1.46 Kb | suspicious |
3604 | iexplore.exe | GET | 200 | 104.31.72.51:80 | http://al4a.fun/exit.jpg | US | image | 6.97 Kb | suspicious |
3604 | iexplore.exe | GET | 200 | 104.31.72.51:80 | http://al4a.fun/enter.jpg | US | image | 5.56 Kb | suspicious |
3604 | iexplore.exe | GET | 200 | 104.31.72.51:80 | http://al4a.fun/lol2.jpg | US | image | 28.0 Kb | suspicious |
3120 | iexplore.exe | GET | 200 | 104.31.73.51:80 | http://al4a.fun/favicon.png | US | image | 6.89 Kb | suspicious |
3604 | iexplore.exe | GET | 301 | 5.188.211.10:80 | http://shrink-your-link.org/oPnHiS | RU | html | 348 b | suspicious |
3604 | iexplore.exe | GET | 200 | 104.20.3.47:80 | http://c.statcounter.com/t.php?sc_project=12023387&java=1&security=cce269cd&u1=6F8DAB59C9764F7FBD99C571E7AFD3BD&sc_random=0.7615922238325108&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1280&h=720&camefrom=&u=http%3A//al4a.fun/&t=Al4a%20*%20Al4a.com%20*%20Al-4a%20*%20www.al4a.com%20*%20Al4a%20com%20*%20Al4%20*%20a4a.com&rcat=d&rdom=d&rdomg=new&bb=1&sc_snum=1&sess=1763af&p=0&invisible=1 | US | image | 49 b | whitelisted |
3604 | iexplore.exe | GET | 200 | 104.20.3.47:80 | http://c.statcounter.com/click.gif?sc_project=12023387&security=cce269cd&c=http%3A//shrink-your-link.org/oPnHiS&m=2&u=http%3A//al4a.fun/&t=Al4a%20*%20Al4a.com%20*%20Al-4a%20*%20www.al4a.com%20*%20Al4a%20com%20*%20Al4%20*%20a4a.com&sess=1763af&rand=0.02692362407912341&u1=6F8DAB59C9764F7FBD99C571E7AFD3BD&jg=new&rr=1.1.1.1.1.1.1.1.1 | US | image | 42 b | whitelisted |
3120 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3604 | iexplore.exe | GET | 301 | 5.189.252.54:80 | http://yourpleasure-here1.com/?u=11ew2k7&o=0dc81m9 | CZ | html | 185 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3604 | iexplore.exe | 104.31.72.51:80 | al4a.fun | Cloudflare Inc | US | shared |
3604 | iexplore.exe | 172.217.18.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
— | — | 172.217.21.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3120 | iexplore.exe | 104.31.72.51:80 | al4a.fun | Cloudflare Inc | US | shared |
3604 | iexplore.exe | 5.188.211.10:80 | shrink-your-link.org | Petersburg Internet Network ltd. | RU | suspicious |
3604 | iexplore.exe | 104.20.2.47:443 | www.statcounter.com | Cloudflare Inc | US | shared |
3120 | iexplore.exe | 5.189.252.54:443 | yourpleasure-here1.com | LLHost Inc | CZ | unknown |
3120 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3120 | iexplore.exe | 104.31.73.51:80 | al4a.fun | Cloudflare Inc | US | shared |
— | — | 5.189.252.54:80 | yourpleasure-here1.com | LLHost Inc | CZ | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
al4a.fun |
| suspicious |
www.statcounter.com |
| whitelisted |
www.bing.com |
| whitelisted |
c.statcounter.com |
| whitelisted |
dns.msftncsi.com |
| shared |
shrink-your-link.org |
| suspicious |
yourpleasure-here1.com |
| unknown |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |