File name: | ursnif.bin |
Full analysis: | https://app.any.run/tasks/de02616f-d912-451b-8cc2-62896e272b8a |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 07:55:44 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 7E72C94B81B431BEA7521322EEF4CB66 |
SHA1: | 63DA160195231A188A0DFCC88B61D817D986CFED |
SHA256: | 9A20E75A6952945D97F6113AF62303B15A81D86D4FC88126AD37D859D7DAB965 |
SSDEEP: | 3072:HnTHXRIusP5vuNUdJC2aICXOcCxqQ+jrdT:HDXGusPluNUdJC2a/XOczDVT |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2018:05:04 22:37:35+02:00 |
PEType: | PE32 |
LinkerVersion: | 14 |
CodeSize: | 28672 |
InitializedDataSize: | 106496 |
UninitializedDataSize: | - |
EntryPoint: | 0x1000 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 6.0.4.2 |
ProductVersionNumber: | 6.0.4.2 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Windows, Latin1 |
CompanyName: | The Document Foundation |
ProductName: | LibreOffice |
ProductVersion: | 6.0.4.2 |
FileVersion: | 6.0.4.2 |
OriginalFileName: | javaloaderlo.dll |
InternalName: | javaloaderlo |
LegalCopyright: | Copyright © 2000-2018 by LibreOffice contributors. All rights reserved. |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 04-May-2018 20:37:35 |
Detected languages: |
|
CompanyName: | The Document Foundation |
ProductName: | LibreOffice |
ProductVersion: | 6.0.4.2 |
FileVersion: | 6.0.4.2 |
OriginalFilename: | javaloaderlo.dll |
InternalName: | javaloaderlo |
LegalCopyright: | Copyright © 2000-2018 by LibreOffice contributors. All rights reserved. |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000140 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 04-May-2018 20:37:35 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000068F0 | 0x00007000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.83254 |
.rdata | 0x00008000 | 0x00000594 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.36109 |
.data | 0x00009000 | 0x00002500 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.78464 |
.CRT | 0x0000C000 | 0x0001402F | 0x00015000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.87402 |
.rsrc | 0x00021000 | 0x00000660 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.30595 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.44424 | 772 | UNKNOWN | English - United States | RT_VERSION |
2 | 5.25203 | 691 | UNKNOWN | English - United States | RT_MANIFEST |
GDI32.dll |
KERNEL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2368 | "C:\Users\admin\Desktop\ursnif.bin.exe" | C:\Users\admin\Desktop\ursnif.bin.exe | explorer.exe | |
User: admin Company: The Document Foundation Integrity Level: MEDIUM Exit code: 0 Version: 6.0.4.2 | ||||
2864 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2728 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:267521 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
944 | "C:\Windows\System32\forfiles.exe" /p C:\Windows\system32 /s /c "cmd /c @file -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwASQBkAGUAbgB0AGkAdABpAGUAcwBcAHsANQAxADEAQwBBAEEAQwAwAC0AQQAxADgANQAtADAANgBFADAALQA2ADUANgBBAC0ARQBFADIAQQBEADAAQgA1AEYARABFADUAfQAnACkALgBXAA==" /m p*ll.*e | C:\Windows\System32\forfiles.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2120 | /c "powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwASQBkAGUAbgB0AGkAdABpAGUAcwBcAHsANQAxADEAQwBBAEEAQwAwAC0AQQAxADgANQAtADAANgBFADAALQA2ADUANgBBAC0ARQBFADIAQQBEADAAQgA1AEYARABFADUAfQAnACkALgBXAA== | C:\Windows\System32\cmd.exe | — | forfiles.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2756 | powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwASQBkAGUAbgB0AGkAdABpAGUAcwBcAHsANQAxADEAQwBBAEEAQwAwAC0AQQAxADgANQAtADAANgBFADAALQA2ADUANgBBAC0ARQBFADIAQQBEADAAQgA1AEYARABFADUAfQAnACkALgBXAA== | C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2700 | "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\f44qny8l.cmdline" | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) | ||||
956 | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESE127.tmp" "c:\Users\admin\AppData\Local\Temp\CSCE126.tmp" | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) | ||||
1836 | "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\h7qyxfbm.cmdline" | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) | ||||
840 | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESE2BD.tmp" "c:\Users\admin\AppData\Local\Temp\CSCE2BC.tmp" | C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFF40471363DCFC71F.TMP | — | |
MD5:— | SHA256:— | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2864 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2756 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ONZ873ZDJBCU8IP3W4EA.temp | — | |
MD5:— | SHA256:— | |||
2700 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCE126.tmp | — | |
MD5:— | SHA256:— | |||
2700 | csc.exe | C:\Users\admin\AppData\Local\Temp\f44qny8l.pdb | — | |
MD5:— | SHA256:— | |||
956 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RESE127.tmp | — | |
MD5:— | SHA256:— | |||
2700 | csc.exe | C:\Users\admin\AppData\Local\Temp\f44qny8l.dll | — | |
MD5:— | SHA256:— | |||
2700 | csc.exe | C:\Users\admin\AppData\Local\Temp\f44qny8l.out | — | |
MD5:— | SHA256:— | |||
2756 | powershell.exe | C:\Users\admin\AppData\Local\Temp\h7qyxfbm.0.cs | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2864 | iexplore.exe | GET | 304 | 152.199.19.161:443 | https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlistWin7.xml | US | — | — | whitelisted |
2728 | IEXPLORE.EXE | POST | 200 | 46.29.166.6:443 | https://adultprizes.xyz/index.htm | RU | text | 44.4 Kb | unknown |
2368 | ursnif.bin.exe | POST | 200 | 46.29.166.6:443 | https://adultprizes.xyz/index.htm | RU | binary | 29.4 Kb | unknown |
2864 | iexplore.exe | GET | 200 | 152.199.19.161:443 | https://iecvlist.microsoft.com/IE11/1479242656000/iecompatviewlist.xml | US | xml | 351 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 204.79.197.200:443 | https://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2864 | iexplore.exe | GET | 200 | 204.79.197.200:443 | https://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2368 | ursnif.bin.exe | POST | 200 | 46.29.166.6:443 | https://adultprizes.xyz/index.htm | RU | binary | 31.1 Kb | unknown |
2864 | iexplore.exe | GET | 200 | 152.199.19.161:443 | https://r20swj13mr.microsoft.com/ieblocklist/v1/urlblocklist.bin | US | — | — | whitelisted |
2368 | ursnif.bin.exe | POST | 200 | 46.29.166.6:443 | https://adultprizes.xyz/index.htm | RU | binary | 27.0 Kb | unknown |
1936 | explorer.exe | POST | 200 | 194.147.32.248:443 | https://carringtonit.xyz/index.html | unknown | binary | 36.5 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2864 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2864 | iexplore.exe | 46.29.166.6:443 | adultprizes.xyz | LLC Baxet | RU | unknown |
2728 | IEXPLORE.EXE | 46.29.166.6:443 | adultprizes.xyz | LLC Baxet | RU | unknown |
2368 | ursnif.bin.exe | 46.29.166.6:443 | adultprizes.xyz | LLC Baxet | RU | unknown |
592 | mscorsvw.exe | 67.27.157.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
1936 | explorer.exe | 194.147.32.248:443 | carringtonit.xyz | — | — | unknown |
2864 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 77.68.17.108:80 | curlmyip.net | 1&1 Internet SE | GB | unknown |
2596 | mscorsvw.exe | 2.16.186.74:80 | crl.microsoft.com | Akamai International B.V. | — | whitelisted |
1936 | explorer.exe | 77.68.17.108:80 | curlmyip.net | 1&1 Internet SE | GB | unknown |
Domain | IP | Reputation |
---|---|---|
adultprizes.xyz |
| unknown |
www.bing.com |
| whitelisted |
api.bing.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
carringtonit.xyz |
| unknown |
curlmyip.net |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (curlmyip .net in DNS lookup) |
— | — | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (curlmyip .net in DNS lookup) |
Process | Message |
---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
|