File name:

confirmación bancaria bbva nov 2023.pdf.exe

Full analysis: https://app.any.run/tasks/5cb44f6e-4a25-48f4-8c77-069bcf9bec8d
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 16:44:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
remcos
remote
keylogger
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

CE569D3EFA2FB1128F4D321287DD5DFA

SHA1:

78434ABAAC0753485025ADAF6608D318A4A2F5DC

SHA256:

AFFA42C2A33C30FED8F680983924C6B8C6965501A334B608505A00FCDD09FAE5

SSDEEP:

49152:4M1wB9fZpoEdkIvdMrnii47ncLXjhWbkbezn1hnulnJnIC5V1FJv8cwuaXcz2U86:JOtoEndMrs7oYVCJZ5V1wXXmX8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)

    • Uses Task Scheduler to run other applications

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)

    • Actions looks like stealing of personal data

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 272)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)

    • Steals credentials from Web Browsers

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)

    • REMCOS has been detected (SURICATA)

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Remcos is detected

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Steals credentials

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)

    • Uses NirSoft utilities to collect credentials

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)

    • REMCOS has been detected (YARA)

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)

    • Reads the Internet Settings

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Application launched itself

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Connects to unusual port

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Writes files like Keylogger logs

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Accesses Microsoft Outlook profiles

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)

  • INFO

    • Checks supported languages

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 272)

    • Reads the computer name

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 272)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)

    • Creates files or folders in the user directory

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Reads the machine GUID from the registry

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 272)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)

    • Create files in a temporary directory

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1940)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 272)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1936)
      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 2868)

    • Reads Environment values

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Checks proxy server information

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)

    • Creates files in the program directory

      • confirmación bancaria bbva nov 2023.pdf.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(1012) confirmación bancaria bbva nov 2023.pdf.exe
C2 (1)cloudhost.myfirewall.org:9302
BotnetLEADERS
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_filesvchost.exe
Startup_valueFalse
Hide_fileTrue
Mutex_nameRmcQxSw1-BM67DC
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirwindows
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2073:03:15 16:25:21+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 944640
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xe87ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Property System
FileVersion: 1.0.0.0
InternalName: WiaApbYI.exe
LegalCopyright: Copyright © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: WiaApbYI.exe
ProductName: Property System
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start confirmación bancaria bbva nov 2023.pdf.exe no specs schtasks.exe no specs confirmación bancaria bbva nov 2023.pdf.exe no specs confirmación bancaria bbva nov 2023.pdf.exe no specs #REMCOS confirmación bancaria bbva nov 2023.pdf.exe confirmación bancaria bbva nov 2023.pdf.exe confirmación bancaria bbva nov 2023.pdf.exe confirmación bancaria bbva nov 2023.pdf.exe confirmación bancaria bbva nov 2023.pdf.exe no specs confirmación bancaria bbva nov 2023.pdf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" /stext "C:\Users\admin\AppData\Local\Temp\gqoodrtvkrsfzirf"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe
confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1012"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe
confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Remcos
(PID) Process(1012) confirmación bancaria bbva nov 2023.pdf.exe
C2 (1)cloudhost.myfirewall.org:9302
BotnetLEADERS
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_filesvchost.exe
Startup_valueFalse
Hide_fileTrue
Mutex_nameRmcQxSw1-BM67DC
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirwindows
Keylog_dirremcos
1652"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" /stext "C:\Users\admin\AppData\Local\Temp\cjzlgwtonudvaxicobhvlmyjxpxqgmy"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe—confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1936"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" /stext "C:\Users\admin\AppData\Local\Temp\vwbdkyicwjat"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe
confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1940"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
2100"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xgJLIqUIYFx" /XML "C:\Users\admin\AppData\Local\Temp\tmp6BF3.tmp"C:\Windows\SysWOW64\schtasks.exe—confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2404"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" /stext "C:\Users\admin\AppData\Local\Temp\cjzlgwtonudvaxicobhvlmyjxpxqgmy"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe—confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
2832"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe—confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2868"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe" /stext "C:\Users\admin\AppData\Local\Temp\luvkkgxaa"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe
confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2932"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe"C:\Users\admin\AppData\Local\Temp\confirmación bancaria bbva nov 2023.pdf.exe—confirmación bancaria bbva nov 2023.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Property System
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\confirmación bancaria bbva nov 2023.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
707
Read events
687
Write events
20
Delete events
0

Modification events

(PID) Process:(1940) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1940) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1940) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1940) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1012) confirmación bancaria bbva nov 2023.pdf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
1
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2868confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Temp\bhv7E71.tmp —
MD5:—
SHA256:—
1012confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\json[1].jsonbinary
MD5:50AD0280B5684470247E101EC9756E68
SHA256:6F899055115777623A4AE9E7D67208779EFB89576D6BE8CA70763941F9441785
1012confirmación bancaria bbva nov 2023.pdf.exeC:\ProgramData\remcos\logs.datbinary
MD5:CE0E3546726FB0E84B8ED9A2161EC163
SHA256:CD1840984C1A1FB4E3666A2AAA28D542F0FD22C6D4F4F5BB8602A38049634AFE
1936confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Temp\vwbdkyicwjattext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
2868confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Temp\luvkkgxaatext
MD5:2D9139D0CBF8301AE9DAD9173A0A6357
SHA256:2AFE12053A281037E21B2C83109E366E151B4848E9D5357E7B5AE6100CC1C481
1940confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Roaming\xgJLIqUIYFx.exeexecutable
MD5:CE569D3EFA2FB1128F4D321287DD5DFA
SHA256:AFFA42C2A33C30FED8F680983924C6B8C6965501A334B608505A00FCDD09FAE5
1940confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Temp\tmp6BF3.tmpxml
MD5:3AE04F024CB034CEE0807636BF4F8B78
SHA256:D5F4B9DD3835885AF4DB641DA95E56350DB18C4178550FA3FA2133DCC145192D
1012confirmación bancaria bbva nov 2023.pdf.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQYU0XHJ\json[1].jsonbinary
MD5:82B077F37AAB125296CEE42019102A97
SHA256:98DC8A2F3B37FD3BF43949932504AE41FCB6914EDDB856C801082CBCDCB0411D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
11
DNS requests
4
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1012
confirmación bancaria bbva nov 2023.pdf.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
950 b
unknown
1012
confirmación bancaria bbva nov 2023.pdf.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
950 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1012
confirmación bancaria bbva nov 2023.pdf.exe
85.195.105.66:9302
cloudhost.myfirewall.org
Host Europe GmbH
DE
unknown
1012
confirmación bancaria bbva nov 2023.pdf.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
cloudhost.myfirewall.org
  • 85.195.105.66
malicious
geoplugin.net
  • 178.237.33.50
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DDNS Domain .myfirewall .org
1012
confirmación bancaria bbva nov 2023.pdf.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1012
confirmación bancaria bbva nov 2023.pdf.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1012
confirmación bancaria bbva nov 2023.pdf.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1012
confirmación bancaria bbva nov 2023.pdf.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DDNS Domain .myfirewall .org
1012
confirmación bancaria bbva nov 2023.pdf.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1012
confirmación bancaria bbva nov 2023.pdf.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1012
confirmación bancaria bbva nov 2023.pdf.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
1012
confirmación bancaria bbva nov 2023.pdf.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
confirmación bancaria bbva nov 2023.pdf.exe