bded6d7d...74b7 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Backdoor, Trojan, Dropper, Downloader

bded6d7de58298b9f1b3a5b0a502bd6cd2fb54e29d474c74ec5ff140d9b474b7 (SHA256)

Doc379450.doc

Word Document

Created at 2018-09-07 17:11:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Indicators

File (64)
»
Filename Hash Operations Source
C:\ - Access
C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\nss3.dll - Access
C:\Program Files (x86)\Mozilla Firefox\sqlite3.dll - Access
C:\Program Files (x86)\Sea Monkey\nss3.dll - Access
C:\Users\ - Access
C:\Users\aETAdzjz\ - Access
C:\Users\aETAdzjz\AppData\ - Access
C:\Users\aETAdzjz\AppData\Local\ - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Login Data - Access, Read
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Web Data - Access, Read
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\EVWhitelist\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\EVWhitelist\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\pnacl\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\pnacl\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data - Access
C:\Users\aETAdzjz\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\ - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\ - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\footerdroid.exe - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat MD5: d6f3311cb3211039ec0b3625b2c5a741
SHA1: e194fb90e0ffd980549c2c248cf594a742ca8ee8
SHA256: 0bfc0d5582b0bbf5a7401a7c2fb079feabe402628ea9fcdf2ac4f6619ea20573
SSDeep: 96:qvzEMiozzcwjQ2ubh9NdeigWEsPooLBq4Irk0kXoKH+JWMonkyoNEH+wMthKmoXb:YzV8TPmdkeJWMonGg6hI
ImpHash: None 		Access, Read Modified File
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018090720180908\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017070320170710\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012017071220170713\index.dat - Access, Read
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe MD5: f166d8ca89010fa277c8ffc1f1585db9
SHA1: 4c3b883cab722a3f8a5839dcebc3997f63ba4dcd
SHA256: a30e3ad64db6f92fb3904edef6f96225a82f8a8262611e340cef0a960f290987
SSDeep: 6144:gZurs4foT7Pyk9Ov4l2hhJb1wCqhu6Oh9DOOqsJMBmP4:gQsF719ChbZ7yOqsUs4
ImpHash: 63bfeddfc34eb812afe72b34b0540f2c 		Access Created File
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed.exe:Zone.Identifier - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\orangeneed_lng.ini - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat - Access
C:\Users\aETAdzjz\AppData\Local\Microsoft\Windows\WebCache\WebCacheV24.dat - Access
C:\Users\aETAdzjz\AppData\Local\Temp\72DE.tmp MD5: 36427ecb2a0faf13af3047c51b29f9c5
SHA1: 9a3fb26927a7aa81255cf8abcc1f1c3e38f28c4f
SHA256: ea156f649bb1180b32c6d5be76c0969941ec76d1fface734f401b5327ac57345
SSDeep: 3:q8CJGEIUEF7eSAMzr+WABEImBzEWVAZGXhRAJ1zKI9:hCyUEZNiWSmBzNmeRAH9
ImpHash: None 		Access, Write Created File
C:\Users\aETAdzjz\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data - Access
C:\Users\aETAdzjz\AppData\Roaming\Apple Computer\Preferences\keychain.plist - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\history.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\logins.json - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\places.sqlite - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\Firefox\Profiles\3y2joh8o.default\signons.sqlite - Access
C:\Users\aETAdzjz\AppData\Roaming\Mozilla\SeaMonkey\profiles.ini - Access
C:\Users\aETAdzjz\AppData\Roaming\Opera Software\Opera Stable\Login Data - Access
C:\Users\aETAdzjz\AppData\Roaming\Opera\Opera7\profile\wand.dat - Access
C:\Users\aETAdzjz\AppData\Roaming\Opera\Opera\wand.dat - Access
C:\Users\aETAdzjz\Documents - Access
C:\Users\Public\428.exe - Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config - Access, Read
Registry (60)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\orangeneed Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\PipelineMaxStackSizeMB Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla Access
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin Access
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 25.0\bin\PathToExe Read
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\bin Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType Read
HKEY_PERFORMANCE_DATA Access
Mutex (10)
»
Mutex Name Operations
Global\.net clr networking Access, Delete
Global\I705BA84C Access, Delete
Global\M705BA84C Access
Global\Nx513464FA Access
PEM470 Access
PEM548 Access
PEM8D0 Access
PEM8D4 Access
PEM9CC Access
PEMB64 Access
Domain (16)
»
Domain Sources
201.132.110.134:8080 Function Log, PCAP
189.212.177.73:443 Function Log
239.255.255.250 Function Log
crl.verisign.com PCAP
crl-symcprod.digicert.com PCAP
cs9.wac.phicdn.net PCAP
sv.symcb.com PCAP
ocos-office365-s2s.msedge.net PCAP
ocos-office365-s2s-msedge-net.e-0009.e-msedge.net PCAP
e-0009.e-msedge.net PCAP
config.edge.skype.com PCAP
s-0001.s-msedge.net PCAP
farmasi.uin-malang.ac.id PCAP
client-office365-tas.msedge.net PCAP
afdo-tas-offload.trafficmanager.net PCAP
vip5.afdorigin-prod-bl02.afdogw.com PCAP
URL (10)
»
URL Operations Sources
HTTP://177.242.11.145 GET Function Log
HTTP://201.132.110.134 GET Function Log
http://201.132.110.134:8080/ GET PCAP
http://201.170.69.112:80/whoami.php GET Function Log
http://189.212.177.73:443/whoami.php GET Function Log
http://crl.verisign.com/ThawteTimestampingCA.crl GET PCAP
http://crl.verisign.com/tss-ca.crl GET PCAP
http://sv.symcb.com/sv.crl GET PCAP
http://farmasi.uin-malang.ac.id/wp-content/bw1e5Dg0 GET PCAP
http://farmasi.uin-malang.ac.id/wp-content/bw1e5Dg0/ GET PCAP
IP (13)
»
IP Protocols Sources
177.242.11.145 TCP Function Log, PCAP
201.132.110.134 TCP Function Log, PCAP
201.170.69.112 HTTP, TCP Function Log, PCAP
189.212.177.73 HTTP, TCP Function Log, PCAP
239.255.255.250 UDP Function Log
93.184.220.29 HTTP, TCP, UDP PCAP
13.107.5.88 TCP, UDP PCAP
13.107.3.128 TCP, UDP PCAP
103.17.76.14 HTTP, TCP, UDP PCAP
40.121.213.159 TCP, UDP PCAP
52.109.120.20 TCP PCAP
95.101.90.121 TCP PCAP
23.53.173.48 TCP PCAP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image