URL:

http://uflash.tv

Full analysis: https://app.any.run/tasks/dfd52e0b-871b-4b6e-8529-a93a030c5fcf
Verdict: Malicious activity
Analysis date: August 24, 2023, 19:37:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2155BD69734F3CA0D5B4DF3823892997

SHA1:

ACA61D7413747F15CEAE6535A402C2166199DFB9

SHA256:

F86614A8AC232119862983ECFC4F6635B88FF514E75187FBBE64AB37E1C82EF8

SSDEEP:

3:N1KLRTn:C9Tn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2340"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2968"C:\Program Files\Internet Explorer\iexplore.exe" "http://uflash.tv"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 931
Read events
18 866
Write events
65
Delete events
0

Modification events

(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
106
Unknown types
1

Dropped files

PID
Process
Filename
Type
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.hoverIntent.minified[1].jstext
MD5:6AB651CEDA51EA3DA7D53435FB428333
SHA256:4D8F84729F2BB3EECCDE4957C1CE7C46251F6A7148EC7FD9CA73403BA6CB07D5
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery.effects[1].jstext
MD5:966A66C96F15928947F8C072489A6C02
SHA256:39A25774F6EC71692ADEF8745689715E3BD3F646FDCEBCA65582138947B1C596
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jquery.fancybox-buttons[1].csstext
MD5:5D99B237217A53F9FC5890C829E92EED
SHA256:09FD5E02CDC76ABC66FFED9F7354997E29FD524A0911FC6278FFDF3CD188CA52
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery-1.7.2.min[1].jshtml
MD5:5BE210717F43903B577B1DC4DE5EF4E4
SHA256:6D4F49FA8201495113BEF2DE97641380E74A443DCCD15F145426C8DCFE33F295
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\EQGZZNSF.htmhtml
MD5:B0D0BA6BAAE74190BAE8FD20D5AFD814
SHA256:EA3E78EFF036FCBAA0667D1168F351256E2C20B40DF7296266DC45A91290CA0A
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\955R81JG.htmhtml
MD5:16A5105037823AE84823B4B7B38CA791
SHA256:BBC51193DEC86C08BA7031E71B6C4074133FAFAC0E4076296EFEDF9168B992F6
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\style[1].csstext
MD5:3EAED509BCEA509CFF22ADA8BF44E8BB
SHA256:E28C4103CA7EBBC8F804AE1FDC5C3687550BB4B5925CFE643CE979A43EEAE355
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\jquery.livequery.pack[1].jstext
MD5:D0C635BD9561035D213E68A72FBDFC41
SHA256:153A9C91E288BF083A0FBF6935D0A83B5D72ED9944BD3D4F3337CC3913D46DC4
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.fancybox[1].csstext
MD5:D6B02F6578597B65F36F68913E0E40E8
SHA256:3A7CF33AED2E14E09207F2FBC386987F9B45D976A5F6D9079F206C8285293E7F
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.avs-0.2[1].jstext
MD5:D38E742F92DD56AFCEEE87BACE881A95
SHA256:40FACEDB75079705808CE42BB45A6C0C4D46977EAAE843808CFD80343C6E9502
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
57
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
iexplore.exe
GET
301
209.95.46.75:80
http://uflash.tv/
US
html
185 b
whitelisted
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/
US
compressed
8.61 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery-1.7.2.min.js
US
html
32.9 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.livequery.pack.js
US
text
1.38 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/lightbox_me_pop.js?v=0001
US
text
2.86 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.hoverIntent.minified.js
US
text
629 b
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.avs-0.2.js?v001
US
text
2.17 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/media/videos/tmb/25047/1.jpg
US
image
10.6 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/media/videos/tmb/87543/1.jpg
US
image
12.1 Kb
unknown
2340
iexplore.exe
GET
200
8.253.204.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d2573a55f5d86ec8
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2340
iexplore.exe
8.253.204.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2340
iexplore.exe
209.95.46.75:80
www.uflash.tv
UK-2 Limited
US
unknown
2340
iexplore.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
2340
iexplore.exe
216.239.32.36:443
region1.google-analytics.com
GOOGLE
US
suspicious
2968
iexplore.exe
8.253.204.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2968
iexplore.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
suspicious
2968
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2340
iexplore.exe
185.94.237.64:80
poweredby.jads.co
Mojohost B.v.
NL
suspicious
2340
iexplore.exe
8.241.123.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
www.uflash.tv
  • 209.95.46.75
unknown
poweredby.jads.co
  • 185.94.237.64
whitelisted
www.googletagmanager.com
  • 142.250.185.104
whitelisted
js.juicyads.com
  • 13.249.9.29
  • 13.249.9.75
  • 13.249.9.43
  • 13.249.9.90
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.249
  • 8.241.123.254
  • 67.26.139.254
  • 67.27.233.254
  • 67.27.157.126
whitelisted
ocsp.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.pki.goog
  • 216.58.206.35
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.sectigo.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
www.google-analytics.com
  • 142.250.185.78
whitelisted

Threats

PID
Process
Class
Message
2340
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://uflash.tv