URL: | http://d1ye4i82ttwe0c.cloudfront.net/0vsnzm55)8v0y/adobe_flash_player.exe |
Full analysis: | https://app.any.run/tasks/e5073e57-f41d-4168-a6f6-afaad328fefd |
Verdict: | Malicious activity |
Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
Analysis date: | March 28, 2019, 20:00:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | 2752C554C38A8FA701DDA72FCDD6A3D9 |
SHA1: | F2C5E8ADB1C99B95D0F5571D47FF643AE03313DB |
SHA256: | BE5BCB2AD87D3FAC44D39B8C994F7C8321171613C4323FF2DB36DCD518128937 |
SSDEEP: | 3:N1KaUcxyl/0HrtOf8/DtbN:CaFZHrbtbN |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3288 | "C:\Program Files\Google\Chrome\Application\chrome.exe" http://d1ye4i82ttwe0c.cloudfront.net/0vsnzm55)8v0y/adobe_flash_player.exe | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
300 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6fa60f18,0x6fa60f28,0x6fa60f34 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
1740 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1020 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
3644 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3343603842752758998 --mojo-platform-channel-handle=952 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
2212 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=13880593200007958471 --mojo-platform-channel-handle=1476 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
3304 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --service-pipe-token=7847685158070219098 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7847685158070219098 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
3116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --service-pipe-token=1923156766253048545 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1923156766253048545 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 73.0.3683.75 Modules
| |||||||||||||||
828 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --service-pipe-token=17427284760112413217 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17427284760112413217 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
3412 | "C:\Users\admin\Downloads\adobe_flash_player_2744162724.exe" | C:\Users\admin\Downloads\adobe_flash_player_2744162724.exe | — | chrome.exe | |||||||||||
User: admin Company: Fabagub Integrity Level: MEDIUM Description: Bohagaho Setup Exit code: 0 Version: 4.0.5.8 Modules
| |||||||||||||||
2448 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5256127585613115174 --mojo-platform-channel-handle=3508 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
|
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | dr |
Value: 1 | |||
(PID) Process: | (1740) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | write | Name: | 3288-13198276837792875 |
Value: 259 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | delete value | Name: | 3488-13197474229333984 |
Value: 0 | |||
(PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
Operation: | delete value | Name: | 3288-13198276837792875 |
Value: 259 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\4ab9e216-fa18-4035-aa9a-04790f04371b.tmp | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index | — | |
MD5:— | SHA256:— | |||
3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
920 | adobe_flash_player_2744162724.exe | HEAD | 200 | 46.166.187.59:80 | http://www2.ferelar-yofi.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16.cis | NL | — | — | malicious |
920 | adobe_flash_player_2744162724.exe | HEAD | 200 | 46.166.187.59:80 | http://www2.ferelar-yofi.com/ofr/Solululadul/osutils.cis | NL | — | — | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Nuhududanew/BG.jpg | NL | image | 100 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Nuhududanew/BG_FS.jpg | NL | image | 19.1 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Sibarasawi/logo_comp.png | NL | image | 12.4 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 52.51.129.59:80 | http://support.ferelar-yofi.com/ | IE | binary | 502 Kb | malicious |
2212 | chrome.exe | GET | 200 | 13.32.222.230:80 | http://d1ye4i82ttwe0c.cloudfront.net/0vsnzm55)8v0y/adobe_flash_player.exe | US | executable | 2.02 Mb | whitelisted |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Nuhududanew/BG_LONG.png | NL | image | 233 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Sibarasawi/bg_comp.png | NL | image | 25.2 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 52.214.73.247:80 | http://vpn.ferelar-yofi.com/ | IE | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2212 | chrome.exe | 172.217.22.99:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 172.217.18.99:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 172.217.22.45:443 | accounts.google.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 172.217.18.174:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
920 | adobe_flash_player_2744162724.exe | 18.203.190.76:80 | www3.ferelar-yofi.com | — | US | malicious |
2212 | chrome.exe | 13.32.222.230:80 | d1ye4i82ttwe0c.cloudfront.net | Amazon.com, Inc. | US | whitelisted |
920 | adobe_flash_player_2744162724.exe | 52.51.129.59:80 | support.ferelar-yofi.com | Amazon.com, Inc. | IE | malicious |
920 | adobe_flash_player_2744162724.exe | 185.59.222.146:80 | img.ferelar-yofi.com | Datacamp Limited | NL | malicious |
920 | adobe_flash_player_2744162724.exe | 52.214.73.247:80 | vpn.ferelar-yofi.com | Amazon.com, Inc. | IE | malicious |
920 | adobe_flash_player_2744162724.exe | 13.32.222.101:443 | d3rgy9jxa1r1e2.cloudfront.net | Amazon.com, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
d1ye4i82ttwe0c.cloudfront.net |
| whitelisted |
accounts.google.com |
| shared |
sb-ssl.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
vpn.ferelar-yofi.com |
| malicious |
www3.ferelar-yofi.com |
| malicious |
d3rgy9jxa1r1e2.cloudfront.net |
| whitelisted |
support.ferelar-yofi.com |
| malicious |
img.ferelar-yofi.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO EXE - Served Attached HTTP |
— | — | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2 |
— | — | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1 |
— | — | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3 |
— | — | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4 |
— | — | Generic Protocol Command Decode | SURICATA STREAM TIMEWAIT ACK with wrong seq |