URL:

http://uflash.tv

Full analysis: https://app.any.run/tasks/dfd52e0b-871b-4b6e-8529-a93a030c5fcf
Verdict: Malicious activity
Analysis date: August 24, 2023, 19:37:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2155BD69734F3CA0D5B4DF3823892997

SHA1:

ACA61D7413747F15CEAE6535A402C2166199DFB9

SHA256:

F86614A8AC232119862983ECFC4F6635B88FF514E75187FBBE64AB37E1C82EF8

SSDEEP:

3:N1KLRTn:C9Tn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2340"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2968"C:\Program Files\Internet Explorer\iexplore.exe" "http://uflash.tv"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 931
Read events
18 866
Write events
65
Delete events
0

Modification events

(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
106
Unknown types
1

Dropped files

PID
Process
Filename
Type
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jquery.fancybox-buttons[1].csstext
MD5:5D99B237217A53F9FC5890C829E92EED
SHA256:09FD5E02CDC76ABC66FFED9F7354997E29FD524A0911FC6278FFDF3CD188CA52
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery.effects[1].jstext
MD5:966A66C96F15928947F8C072489A6C02
SHA256:39A25774F6EC71692ADEF8745689715E3BD3F646FDCEBCA65582138947B1C596
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\1[2].jpgimage
MD5:970A4BC1B7AF8C154C9F2E6625A76891
SHA256:61DAC53DB5A3276C9394CFD4699D059CD5D269CF5EE216624BE884E40C96A35D
2340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.fancybox[1].csstext
MD5:D6B02F6578597B65F36F68913E0E40E8
SHA256:3A7CF33AED2E14E09207F2FBC386987F9B45D976A5F6D9079F206C8285293E7F
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\lightbox_me_pop[1].jstext
MD5:41D09845A1EAD1D84B62D0609E6843BB
SHA256:F422EE0DD0D2E1AE5CFFC0C2EF81AD9F6D728AAE63AB43BDB3DA47BBA29AA2E0
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\jquery.livequery.pack[1].jstext
MD5:D0C635BD9561035D213E68A72FBDFC41
SHA256:153A9C91E288BF083A0FBF6935D0A83B5D72ED9944BD3D4F3337CC3913D46DC4
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.hoverIntent.minified[1].jstext
MD5:6AB651CEDA51EA3DA7D53435FB428333
SHA256:4D8F84729F2BB3EECCDE4957C1CE7C46251F6A7148EC7FD9CA73403BA6CB07D5
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\EQGZZNSF.htmhtml
MD5:B0D0BA6BAAE74190BAE8FD20D5AFD814
SHA256:EA3E78EFF036FCBAA0667D1168F351256E2C20B40DF7296266DC45A91290CA0A
2340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B6A4528E5D2038904B2487AF4BE122ED
SHA256:194B8F90FEFBC3D8DDDBCAE187F17640DD80C53EA3C11D9C93D61860759F0512
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
57
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/
US
compressed
8.61 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/fancybox/helpers/jquery.fancybox-buttons.css?v=1.0.2
US
text
602 b
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.effects.js
US
text
1.20 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.avs-0.2.js?v001
US
text
2.17 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/css/style.css?v00016
US
text
14.4 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/lightbox_me_pop.js?v=0001
US
text
2.86 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery-1.7.2.min.js
US
html
32.9 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.livequery.pack.js
US
text
1.38 Kb
unknown
2340
iexplore.exe
GET
301
209.95.46.75:80
http://uflash.tv/
US
html
185 b
whitelisted
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.hoverIntent.minified.js
US
text
629 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2340
iexplore.exe
142.250.185.104:443
www.googletagmanager.com
GOOGLE
US
suspicious
2340
iexplore.exe
185.94.237.64:443
poweredby.jads.co
Mojohost B.v.
NL
suspicious
2340
iexplore.exe
142.250.185.78:443
www.google-analytics.com
GOOGLE
US
whitelisted
2340
iexplore.exe
209.95.46.75:80
www.uflash.tv
UK-2 Limited
US
unknown
2340
iexplore.exe
13.249.9.29:443
js.juicyads.com
AMAZON-02
US
suspicious
2340
iexplore.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
2340
iexplore.exe
216.239.32.36:443
region1.google-analytics.com
GOOGLE
US
suspicious
2968
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.uflash.tv
  • 209.95.46.75
unknown
poweredby.jads.co
  • 185.94.237.64
whitelisted
www.googletagmanager.com
  • 142.250.185.104
whitelisted
js.juicyads.com
  • 13.249.9.29
  • 13.249.9.75
  • 13.249.9.43
  • 13.249.9.90
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.249
  • 8.241.123.254
  • 67.26.139.254
  • 67.27.233.254
  • 67.27.157.126
whitelisted
ocsp.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.pki.goog
  • 216.58.206.35
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.sectigo.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
www.google-analytics.com
  • 142.250.185.78
whitelisted

Threats

PID
Process
Class
Message
2340
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://uflash.tv