b365a249...0b07 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 98/100
Dynamic Analysis Report
Classification: Hacktool, Trojan, Dropper, Pua, Downloader

b365a249a15ceeaee2e054f7112bf83683e6ada258f90da71762c992797b0b07 (SHA256)

resultado-623472740.PDF.lnk

Windows Batch File (Shell Link)

Created at 2018-10-22 05:25:00

...

Notifications (1/1)

The overall sleep time of all monitored processes was truncated from "36 minutes, 30 seconds" to "6 minutes, 10 seconds" to reveal dormant functionality.

Indicators

File (6)
»
Filename Hash Operations Source
NUL - Access
C:\ProgramData\tempa\marxvxinhhmg.gif MD5: 9f23bc32d7a7301be6180bd71cb94bb8
SHA1: 4b9a92061c0db704ecdc3a08f8ef368329afabaa
SHA256: b25e74cd4e7ad8a72c893e6a65d012a1a623405fe6d5f2f49b6b3bb28792d9da
SSDeep: 24576:G+U+3yhhnsfavKGgvMyKyrexEBhz54Bj2Tiht:GXCyhxsoKZvMySxEBhzA1ht
ImpHash: None 		Access, Read Created File
C:\ProgramData\tempa\marxvxinhhmgx.gif MD5: 6775eed60fd6b5dfa5d9dba8f976e49b
SHA1: b7d360811f09185a13fe6f23650a6bb20fd96fb3
SHA256: 5ac790ca79eaf5c42171b496d9157b4fe8b60b6ea509c5b5a44a58f9579d1979
SSDeep: 6144:M+oYY1UA5qNrHPRsW8QgQ52+zeej+zWYIav6x70LkeQtlrsTgOitJHVKJ:GYYvqBH18Gdbj+1cxILSZPLtJ1KJ
ImpHash: None 		Access, Read Created File
c:\programdata\tempa\marxvxinhhmxa.gif MD5: c843e90ba4929afc31b56abd44cbbf0c
SHA1: 95429037d3461bbda19c8ea8cf44f8afc40fd938
SHA256: f89f02d38dc1ab0a8459e7a9d7d9776fd0f80a774988681bb369937d1bb06baa
SSDeep: 3072:oIPoJQ3TMogfqJGyc0S5xxQUWKb6T2TYfAALZ0jAo+m0L7yrXjPSlVZyugTSAvEu:jPQ6TdYsG0KO7PpL7sjqLZyuNvFU
ImpHash: None 		Access, Read Created File
c:\programdata\tempa\marxvxinhhmxb.gif MD5: 9096e58936be2c6f06254cc8556bf566
SHA1: 7e02caf99d9a7b163371f56d933fbea533dcdad1
SHA256: dbae1639ffbb0568174809db2929847accd8588b8db2f1c5404b6b5d51d3c59d
SSDeep: 3072:bPVTmNoQchJmJC2OWpEtetKH4z+YKgutcOoVWCMQbuxkABH9IpnlbFI:DJ3QchJm1OWpEjYzbKguahV1DAWl
ImpHash: None 		Access, Read Created File
C:\Windows\system32 - Access
Registry (36)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.dll Access, Read
HKEY_CLASSES_ROOT\dllfile Access
HKEY_CLASSES_ROOT\dllfile\AutoRegister Access
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Access
HKEY_CURRENT_USER\Software\Borland\Locales Access
HKEY_CURRENT_USER\Software\CodeGear\Locales Access
HKEY_CURRENT_USER\Software\Embarcadero\Locales Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Log File Max Size Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Directory Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\Software\Borland\Locales Access
HKEY_LOCAL_MACHINE\Software\CodeGear\Locales Access
HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales Access
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\COM+Enabled Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
Domain (1)
»
Domain Sources
xbr6lge984320911.notafiscal05.com Function Log
URL (15)
»
URL Operations Sources
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhma.jpg.zip?18841737 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmb.jpg.zip?607484307 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmc.jpg.zip?105185218 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmdwwn.gif.zip?918109560 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmdx.gif.zip?258277672 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhme.jpg.zip?231938807 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmf.jpg.zip?161905089 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmg.gif.zip?491458574 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmgx.gif.zip?482400544 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmxa.gif.zip?747193115 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmxb.gif.zip?93543106 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/r1.log GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhm98.dll.zip?714489159 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmhh.dll.zip?31092521 GET Function Log
http://xbr6lge984320911.notafiscal05.com:25067/04/marxvxinhhmhh.dll.zip?86737238 GET Function Log
IP (1)
»
IP Protocols Sources
35.196.254.156 HTTP, TCP Function Log
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image