File: 697183c2cfabba0be06b636c6bfeb0df461675c03a0650678110cb8cc26d68f2

Metadata
File name:pdf_usps_label_4704168946081.pif
File type:PE32 executable (GUI) Intel 80386, for MS Windows
File size:36352 bytes
Analysis date:2015-05-18 21:00:26
MD5:c526d1064d622f445ad3f02769637e89
SHA1:3cc2d8124ce83717b3e0973c9d9c8fc336fd6630
SHA256:697183c2cfabba0be06b636c6bfeb0df461675c03a0650678110cb8cc26d68f2
SHA512:02b54dbd3b4c1c96acebca8aa12f4e6c086d0eb6b75726fa8bcc4e82b07b985ae29d22b03b09733f7903ea0649367e7e095f1991c970f428164cba4e08180ac4
SSDEEP:768:ziAz/QMcN1DChkB9Wq020QxW9ilBVp8a4KC830cBt:zxO6knTL0Qx+ilBD8a4KC8EcBt
IMPHASH:a6b4c971800734cafce837d488a6d445
Authentihash:N/A
Related resources
APTNotes
Cyber threat intelligence reports associated with 697183c2cfabba0be06b636c6bfeb0df461675c03a0650678110cb8cc26d68f2.
Loading...
Domains
Domains the malware sample communicates with.
DomainIP
93.185.4.9093.185.4.90
icanhazip.com23.253.254.67
Hosts
Hosts the malware sample communicates with.
212.92.6.123
93.185.4.90
68.70.242.203
216.51.193.145
96.46.103.232
23.253.254.67
73.22.119.204
107.161.207.151
216.245.211.242
96.46.99.183
96.40.19.168
87.255.64.223
195.228.219.230
96.46.100.49
66.215.30.118
93.119.102.70
176.223.153.138
HTTP Requests
HTTP requests the malware sample makes.
HostURLUser-Agent
23.253.254.67 (icanhazip.com)/Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
93.185.4.90/MAN4/l0WZKJWJou/0/61-SP1/0/LIBFIBEHJBFFMozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
93.185.4.90/MAN4/l0WZKJWJou/41/1/1/LIBFIBEHJBFFMozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
93.185.4.90/MAN4/l0WZKJWJou/41/1/1/LIBFIBEHJBFFMozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
AV Detections
AV detection names associated with the malware sample.
ALYacTrojan.GenericKD.2420454
AVGCrypt4.AHUO
AVwareWin32.Malware!Drop
Ad-AwareTrojan.GenericKD.2420454
AhnLab-V3Trojan/Win32.Upatre
AvastWin32:Malware-gen
AviraTR/Crypt.ZPACK.165975
Baidu-InternationalTrojan.Win32.KillAV.lmy
BitDefenderTrojan.GenericKD.2420454
CyrenW32/Upatre.VBYS-7665
ESET-NOD32a variant of Win32/Kryptik.DIRZ
EmsisoftTrojan.GenericKD.2420454 (B)
F-ProtW32/Upatre.BA
F-SecureTrojan.GenericKD.2420454
FortinetW32/AntiAV.DIRZ!tr
GDataTrojan.GenericKD.2420454
IkarusTrojan.Crypt
K7AntiVirusTrojan ( 004c28c91 )
K7GWTrojan ( 004c28c91 )
KasperskyTrojan.Win32.AntiAV.lmy
MalwarebytesTrojan.Upatre
McAfeeDownloader-FASG!C526D1064D62
McAfee-GW-EditionDownloader-FASG!C526D1064D62
MicroWorld-eScanTrojan.GenericKD.2420454
MicrosoftTrojan:Win32/Bagsu!rfn
NormanTroj_Generic_2.RMUZ
PandaTrj/Genetic.gen
Qihoo-360HEUR/QVM07.1.Malware.Gen
SophosTroj/Dyreza-FF
SymantecDownloader.Upatre!gen5
TencentWin32.Trojan.Antiav.Swao
TrendMicroTROJ_UPATRE.SMJV
TrendMicro-HouseCallTROJ_GEN.R0C1B01EJ15
VIPREWin32.Malware!Drop
nProtectTrojan.GenericKD.2420454
Mutants
Mutants created by the malware sample.
"IESQMMUTEX_0_208"
"Local\_!MSFTHISTORY!_"
"Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!"
"Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!"
"Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!"
"Local\WininetStartupMutex"
"Local\WininetConnectionMutex"
"Local\WininetProxyRegistryMutex"
"Local\ZonesCounterMutex"
"Local\ZoneAttributeCacheCounterMutex"
Registry keys
Registry keys created by the malware sample.
Comments
User comments about 697183c2cfabba0be06b636c6bfeb0df461675c03a0650678110cb8cc26d68f2.
NOTICE: We have updated our privacy terms and conditions in accordance to GDPR. By using our site, you acknowledge that you have read and understand our Privacy Policy. Your use of ThreatMiner’s Products and Services is subject to these policies and terms.