File: 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad
Metadata
| mail_Utljvm.js | |
| ASCII text, with very long lines, with CRLF line terminators | 3943 bytes |
| 2016-03-13 14:35:57 | |
| ea9be11f3267d14cdf3a88786e2d69c8 | |
| 6e21020b4bc4d8e07f00a29e01747f9cf36d4eae | |
| 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad | |
| 52ca6c89fd5ba6a55e4be98a5ebca5715b6e1b62973f04ddc0222684e7eb801b0cccce3fde5e76077315ef97d8d7cfbcca4643c9d746f26cfbdf9451ec1d01d5 | |
| N/A | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad.
Cyber threat intelligence reports associated with 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| ohelloguyzzqq.com | 192.210.144.130 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| 192.210.144.130 (ohelloguyzzqq.com) | /85.exe?1 | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" |
| "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!" |
| "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" |
| "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" |
| "\Sessions\1\BaseNamedObjects\RasPbFile" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad.
User comments about 38e77ed2d0c187b1bad0e9c9577e4244f70101a36808c2d0eee04339fdaf1aad.
