File: bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4
Metadata
| ELMIRJX.doc | |
| doc | 104960 bytes |
| Analyzed on May 25 2017 13:17:34 | |
| 98193b54b54ecf607143287e906ebc0c | |
| 5fb9ad29bfa3335d6bc1b9297eb3cdd30f4fea7d | |
| bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4 | |
| 1d40a4ebfd8bb5356cb599990a9a66ae854b689c452694f4d59cceec7fc793824b2ee8e94b2ff08a76be481e73004777973e216e7e433e12601b0d901a7894b8 | |
| N/A | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4.
Cyber threat intelligence reports associated with bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| dreamybean.de | 81.169.145.160 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| 81.169.145.160 (dreamybean.de) | /TrfHn4 | 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 22 4D 6F [.User-Agent |
| N/A | ||
| N/A | ||
| N/A |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_191" |
| "Local\c:!users!ynfkcwp!appdata!local!microsoft!windows!temporary internet files!content.ie5!" |
| "Local\ZoneAttributeCacheCounterMutex" |
| "RasPbFile" |
| "Local\WininetStartupMutex" |
| "Local\WininetConnectionMutex" |
| "Local\10MU_ACBPIDS_S-1-5-5-0-59580" |
| "Global\552FFA80-3393-423d-8671-7BA046BB5906" |
| "Local\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!cookies!" |
| "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" |
| "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" |
| "IESQMMUTEX_0_191" |
| "Local\ZonesLockedCacheCounterMutex" |
| "Local\ZonesCacheCounterMutex" |
| "Local\10MU_ACB10_S-1-5-5-0-59580" |
| "Local\WininetProxyRegistryMutex" |
| "Local\c:!users!ynfkcwp!appdata!local!microsoft!windows!history!history.ie5!" |
| "Local\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!ietldcache!" |
| "IESQMMUTEX_0_208" |
| "Local\ZonesCounterMutex" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4.
User comments about bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4.
