File: c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727
Metadata
| Post_Parcel_Case_id00-037632649#.js | |
| ASCII text | 2957 bytes |
| 2016-03-14 00:57:06 | |
| 0fb3cd12fb2bf4ac7abb909383e2eeb8 | |
| ae20b44821180b565cb46a5feb0f167a7157b224 | |
| c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727 | |
| 93dcf212b67e02d6a57dc8e4a6b90307629157ccfa095b4e656a992c1dfb3feba7747ef0c6f0c106770e8ef74c9a514262016ed50bbdb0ca26b278217774b934 | |
| N/A | |
| N/A | |
| N/A | |
APTNotes
Cyber threat intelligence reports associated with c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727.
Cyber threat intelligence reports associated with c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727.
Domains
Domains the malware sample communicates with.
Domains the malware sample communicates with.
| Domain | IP |
|---|---|
| ohelloguyff.com | 204.44.102.164 |
Hosts
Hosts the malware sample communicates with.
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
HTTP requests the malware sample makes.
| Host | URL | User-Agent |
|---|---|---|
| 204.44.102.164 (ohelloguyff.com) | /70.exe | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) |
AV Detections
AV detection names associated with the malware sample.
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Mutants created by the malware sample.
| "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" |
| "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!" |
| "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!" |
| "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" |
| "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" |
| "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" |
| "\Sessions\1\BaseNamedObjects\RasPbFile" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" |
| "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" |
Registry keys
Registry keys created by the malware sample.
Registry keys created by the malware sample.
Comments
User comments about c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727.
User comments about c66c6b7e2aabf4f6bec1f09c81acd876719be6ff958ff099cc8b0147ad297727.
