Analysis date (UTC): 15 August 2019, 16:25Analysis environment: Windows 7 Pro, build 7601, x86

http://4horlover.com/

MD5:6E9A45081B8A1C7DD8178D6BF188028E
SHA1:DCB16475603D3DC82C8A89E978F54166E658A4CE
SHA256:7C4D4FAFA568913DF5B9F61E0201A76990C0FA88957AC8E493AD57B336757579

Analysis result

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Modifies files in Chrome extension folder

  • chrome.exe (PID: 3444)

INFO

Dropped object may contain TOR URL's

  • chrome.exe (PID: 3444)

Application launched itself

  • chrome.exe (PID: 3444)

Threats

PIDProcessClassMessage
2888chrome.exePotential Corporate Privacy ViolationET INFO Suspicious Darkwave Popads Pop Under Redirect
1060svchost.exePotentially Bad TrafficET DNS Query for .to TLD
2888chrome.exePotentially Bad TrafficET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2888chrome.exePotentially Bad TrafficET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2888chrome.exePotential Corporate Privacy ViolationET INFO Suspicious Darkwave Popads Pop Under Redirect
2888chrome.exePotential Corporate Privacy ViolationET INFO Suspicious Darkwave Popads Pop Under Redirect
2888chrome.exeAttempted User Privilege GainET INFO Session Traversal Utilities for NAT (STUN Binding Request)
——Attempted User Privilege GainET INFO Session Traversal Utilities for NAT (STUN Binding Request)
——Attempted User Privilege GainET INFO Session Traversal Utilities for NAT (STUN Binding Request)
——Attempted User Privilege GainET INFO Session Traversal Utilities for NAT (STUN Binding Response)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN