analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://dicasemgeral.xpg.uol.com.br/noticias/22254/investimento-em-tecnologia-e-a-solucao-para-os-tempos-de-crise/?fdx_switcher=true

Full analysis: https://app.any.run/tasks/d26d5a85-98c8-4638-b16b-faf53a6ab431
Verdict: Malicious activity
Analysis date: November 08, 2019, 13:39:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

049D95BC1A32158AF06B89221E9193E6

SHA1:

D56F7595918CC86DA26564426380C3B088CD4A7C

SHA256:

C647714938143D3C3B4609B57D65EE8D0CE264EFC5A9D3EF13AB2A64FAC95879

SSDEEP:

3:N1KaMGIygLdWhyKVKMWA5BYKqIx5E95IWSQTTVEU3dCd4WSQayYRXV:CaH1gL4hZxHaKqINQTTVEoClAyYRl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3784)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2740)

    • Changes internet zones settings

      • iexplore.exe (PID: 2740)

    • Creates files in the user directory

      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 3424)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3784)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3424)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3424)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3424)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 3424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2740"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3424"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2740 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3784C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
669
Read events
557
Write events
112
Delete events
0

Modification events

(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{2C38B361-022D-11EA-AB41-5254004A04AF}
Value:
0
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(2740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070B00050008000D0027001800EE00
Executable files
0
Suspicious files
6
Text files
163
Unknown types
40

Dropped files

PID
Process
Filename
Type
2740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2740iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt —
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Q10DDF14\investimento-em-tecnologia-e-a-solucao-para-os-tempos-de-crise[1].txt —
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txttext
MD5:771BFE9CED9B7218968415D2BB26FBF3
SHA256:9DD7940B5567B33A320039CF9B1EB6A0950E0D67EF326155D4B838CC2DD36114
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:CF589371925EE4BE009BBB9407BD7C9B
SHA256:4B82267B68F049FCDE37FFEF9A502A5F7620B6BA3984458DA9CB4055700A9D94
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U1V18IP9\geral[1].csstext
MD5:971C692CDDCCE42A62F95CF1CDE4C3D8
SHA256:BF6A9FEF063508672F0DC06ECCEB8E4E313D767F1302619594DC6E593E2F9696
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:115871EC8BA7FCEA0152067C56B14CB8
SHA256:C078D73AD9D5BE0601463672639506494B2138BC54190B0A5124A15B07648E4E
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Q10DDF14\small[1].jstext
MD5:88714B5AFD8181A2F9E2E0CBB01FD426
SHA256:04C7297AAE5BF898E148EDA262A7D464F2CEAEBFE1CCFCDBB9FDE562CE210372
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Q10DDF14\posts[1].csstext
MD5:0D78D45DF75328ED428195E96714C993
SHA256:FEF6EBA526D0F449BB7033E654C078E9224AF1E51C0CC90942C7931222070B55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
114
TCP/UDP connections
105
DNS requests
42
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/wp-content/plugins/Viva-ThumbZoom/lib/v-zoom/viva-zoom.css
BR
text
807 b
unknown
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/wp-content/themes/dg9/css/menu.css
BR
text
1.38 Kb
unknown
3424
iexplore.exe
GET
200
50.17.188.236:80
http://lizard1301.spider.ad/spd_display?p1=1821.divSpdSuperBanner
US
text
3.26 Kb
unknown
3424
iexplore.exe
GET
200
185.225.208.133:80
http://widgets.amung.us/small.js
unknown
text
3.15 Kb
whitelisted
3424
iexplore.exe
GET
301
172.217.23.142:80
http://www.youtube.com/embed/videoseries?list=PLynm_Lel57z1ckrB1OBUHZeJWuaGMN6Hq&hl=pt_BR&autoplay=0&loop=1&showinfo=0&rel=0&hd=0&iv_load_policy=1&allowfullscreen=1&wmode=transparent
US
—
—
whitelisted
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/wp-content/themes/dg9/css/posts.css
BR
text
1.10 Kb
unknown
2740
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/imagens/darkblue.png
BR
image
181 b
unknown
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/img/bandeiras/br.png
BR
image
695 b
unknown
3424
iexplore.exe
GET
200
187.17.123.243:80
http://dicasemgeral.xpg.com.br/noticias/22254/investimento-em-tecnologia-e-a-solucao-para-os-tempos-de-crise/?fdx_switcher=true
BR
html
12.3 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2740
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3424
iexplore.exe
172.217.18.2:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3424
iexplore.exe
200.147.35.224:80
dicasemgeral.xpg.uol.com.br
Universo Online S.A.
BR
unknown
3424
iexplore.exe
185.225.208.133:80
widgets.amung.us
—
—
suspicious
3424
iexplore.exe
187.17.123.245:80
js.xpg.com.br
Universo Online S.A.
BR
unknown
3424
iexplore.exe
187.17.123.243:80
dicasemgeral.xpg.com.br
Universo Online S.A.
BR
unknown
3424
iexplore.exe
192.0.77.32:80
s0.wp.com
Automattic, Inc
US
suspicious
3424
iexplore.exe
192.0.77.2:80
i0.wp.com
Automattic, Inc
US
suspicious
3424
iexplore.exe
172.217.23.142:80
www.youtube.com
Google Inc.
US
whitelisted
3424
iexplore.exe
50.17.188.236:80
lizard1301.spider.ad
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dicasemgeral.xpg.uol.com.br
  • 200.147.35.224
suspicious
dicasemgeral.xpg.com.br
  • 187.17.123.243
unknown
pagead2.googlesyndication.com
  • 172.217.18.2
whitelisted
widgets.amung.us
  • 185.225.208.133
whitelisted
js.xpg.com.br
  • 187.17.123.245
unknown
lizard1301.spider.ad
  • 50.17.188.236
  • 54.243.79.219
  • 54.225.131.246
unknown
www.google-analytics.com
  • 172.217.21.238
whitelisted
cdn4.mediakit.com.br
  • 187.17.123.137
malicious
apis.google.com
  • 172.217.16.206
whitelisted

Threats

PID
Process
Class
Message
3424
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dicasemgeral.xpg.uol.com.br/noticias/22254/investimento-em-tecnologia-e-a-solucao-para-os-tempos-de-crise/?fdx_switcher=true