ID: Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version:"

Virginia Wiggins
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTPS Packets Code Manipulations Statistics Behavior Copyright Joe Security LLC 2018 Page 2 of 42

3 System Behavior Analysis iexplore.exe PID: 3376 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3432 Parent PID: 3376 General File Activities Registry Activities Analysis ssvagent.exe PID: 3500 Parent PID: 3432 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 42

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 13:58:58 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 4m 59s light browseurl.jbs ixed/monpa52z6q50jiyioz2wk4vk.php?rand=1 3InboxLightaspxn &fid &fid=1&fav.1&rand.13InboxLight.aspxn &fid &fid.1&fav.1& =thoma n= &fid=4#n= &fid=1&fav=1 Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@5/38@2/1 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: our.com/ /up datefixed/monpa52z6q50jiyioz2wk4vk.php? rand=13inboxlightaspx n &fid &fid=1&fav.1&ra nd.13inboxlight.aspxn &fid &fid. 1&fav.1& =thomas.U K.Greipel@daimler.com&.ran d=13inboxlight.aspx?n= &fid=4#n= & fid=1&fav=1 Real link is: ur.com/ /upd atefixed/monpa52z6q50jiyioz2wk4vk.php? rand=13inboxlightaspxn &fid &fid=1&fav.1&ran d.13inboxlight.aspxn &fid &fid.1 &fav.1& =thomas.uk.greipel@daimler.com&.rand =13InboxLight.aspx?n= &fid=4#n= &f id=1&fav=1 Copyright Joe Security LLC 2018 Page 4 of 42

Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found.

5 Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3432 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 5 of 42

Ransomware Miner Spreading malicious malicious malicious Evader

Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI,

automation may extend behavior Uses HTTPS for network communication,

for further analysis Signature Overview Networking Summary System

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 42

7 Click to jump to signature section Networking: Social media urls found in memory data Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 42

Behavior Graph ID: 58705 URL: https://dralifaour.com/3948478587557755757/updatefixed/mo.

8 Behavior Graph ID: URL: Startdate: 09/05/2018 Architecture: WINDOWS Score: 1 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values iexplore.exe started iexplore.exe Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious 1 20 dralifaour.com , 443, 49164, IOFLOOD-InputOutputFloodLLCUS United States started ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 13:59:46 API Interceptor 1963x Sleep call for process: iexplore.exe modified 13:59:47 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 3InboxLightaspxn &fid &fid=1&fav.1&rand.13InboxLight.aspxn &fid &fid.1&fav.1& =thomas.UK.Greipel@daimler.com&.rand=13InboxLight.aspx?n = &fid=4#n= &fid=1&fav=1 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Copyright Joe Security LLC 2018 Page 8 of 42

9 Detection Scanner Label Link dralifaour.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 9 of 42

$exe (PID: 3432 cmdline: '' SCODEF:3376 CREDAT:275457 /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3500 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.$

10 Startup System is w7 cleanup iexplore.exe (PID: 3376 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3432 cmdline: '' SCODEF:3376 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3500 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): B969535E714A80BA60CDA3D9334C DA3863F972F4A31DB672143F64E1AD935D28513B D425EAC1B6991FA4C15DF4F20EB64BB2F B1B1D79C6DAFD265B1BA599D 24D126FFB7AD3B94A211BC8717E8C77A7C315CC66EEADAFA6281EA7EE1EE5201A5B9429D834FD449E48E4388F E40F709462EA8BDAF66726C351DD Copyright Joe Security LLC 2018 Page 10 of 42

11 C:\Users\HERBBL~1\AppData\Local\Temp\~DF5569D7E69C29C9F3.TMP data Size (bytes): Entropy (8bit): D46DE8956D2F688872E50BDAF0CAC B80B80C10F301CF1A8FB43F A7B 0984A1882A0716C1148F6BD9C41F963ED9412DEEA2EB0680BC9C24F6E3D08D D39C721F81DB517DE3FAC840A08AD43AEDF84BABDDE8A293E0D9F8A0043A6E45EA74A95CF48E C 4CA4D26C170DDF0C8BA FE2D159B0 C:\Users\HERBBL~1\AppData\Local\Temp\~DFC0BC84DC7506DF32.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): CE48EE7D15D7FC7C2BAEB24E65 A60154A4CE4D154DAD5E DD2E514147DC B140FDCAC C5414D2E0ADF AEE51F3DAD5F FE5B CC56DCBCF FDA41F8621D089C0161B E E C691B0452E76C6E0CE1D1 8C58D6E6BD0B76A2E891A0A8FA768B99EEA C:\Users\HERBBL~1\AppData\Local\Temp\~DFFBC4900C690417AB.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): EB805EA9E14A19AB20EBD846920DA0 B86CCE04B2811ED3AC4CFC40804D1189E398D69D 3CBBF78A83A24DDB339E197316B8E73B46A21888CA74B9832CCE69163AFFC9CC 03115A035218E8CD6EDFA2CDD674CB1AF4DCD44D4FC4F76675CD810843C16FB5D4EE61172AE98F2938EB105F13 C9F0B86D69E86DCCF05167BDF D4D5AE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6509 bytes, 1 file DA4ABC8C9A1FCFA4161EFE06CB2935AF E33672FBA3E351EF2BB6F0C62DB1A5C3EEA0A1F9 C25B1A0AFC65B15A4B2278A85B519A C71BDA4D848D852CC25DB46 2E59E847EBFDD74F752CD6E974075EA69B5DAA7AA5CEA092DE9C5BB35BB CCEA7C7B041D7C30847EAB 0FF6FFB58E4E18217F7B9457E426188C07E1375F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA Copyright Joe Security LLC 2018 Page 11 of 42

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true 781D21D8FA90334B1124ABB8FAE2D451 ACC2C199307CD2B265ABF33698AAF09E7E8C5B24 60D51BF555D2792CAD001CE546E9AAE7E0D1E860B905E75356EB29F9C86CBAB3 F91F9FD6EA28001B1C A DC65C697FB25ACF62CC607613BDB663C9FBC0D9BD07D56C83D1 A9794EC97A B7D5A000649DAC82863F7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4405 Entropy (8bit): F49D05A12DAF7DC1437D8CCDB188A74 CC31C730E0CB60FF D781AD8F1F8DB788F B6CAF30D26C9B F0E345C3C5F343AE0D4378DE4FEECB0E9E5D9DA27C16 956F073E850CC D01450C632CDCA0CE7B449221FF81DA4C278785D1F1933A85C43FE97994CC7C67EBB 70E177ADA752BFDE76A88D061C7B047FB548C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 1026 Entropy (8bit): D897B37B4B93AB30F0FE38E8C F2349EF3CD198BC195CCEDF193DA8A58B DF877C76BA7DFF3848FFBB1C28F764062C553AD76EB74EEFAD1C3CF6820D8785 B2C75EF43F A921750AA397FFC502DAC47416BC43D475038AEF9F0087D97CAF7566C7B215A751D3CCF7B 83D185A55460E08FACEC A85D7D554 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 438 Entropy (8bit): FBE2877C83F4445A3327C518EDE5FD32 4E90C47F2925BFF2A99BA9E90ACC0CF2DC16169D E8862F66587E B204EA0898B6D84E2AF997D AF5FBE65745D 9339D5EB22411A68CE1DCE62E73FFBCB3F880F1B24C62A BF2FEE7DD8FCFEB774B0D9A3619B31DB37D BFFB9279F9DC4B4DB B221638A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Copyright Joe Security LLC 2018 Page 12 of 42

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F Size (bytes): 2640 Entropy (8bit): F258CEAB5E48FA E80DDD055D EDCC36232AA5EDE9455A16E7F883BB67 9EAA407978FD0EF8B51DB3CFCD25FF5A826270A815B101C566ED677A8456F54B C5E2E2D4A BEEC865238D234B61A96D16CEAA62D45D02F5FF5975F4939EEF19EE9B2F43AE10D9BA0 A0086B5291B342EC0EDA1C7006C1BC29110ED1D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): C8493D8D49B52AAD1BB04DF8000E43D 70ED367D7A247040F7A76C217B98B0ABB7CDC6EC 5D24BF97E1AC5C56AE1CC399B50A2CC8920CBC71B22B458E30617C75B1C7DFBB F05D4628E6EB1F9E621E644CE913AD21A C0B374B915696ED9E9F43E629C8FFE37FDFF410B9061AC 99952BD11040C355E5EFC2D7F2C19FCB642BB C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 27D76E6C048A3928C9FB58D2FCBAD521 A068F459099CE41A10D20253E615ABB7369D196E D700F3347A6ED8BE54D8B1EAB49C22E6A374FC161F7B41B6A205D0C14496F34B ABFA7E62F47AACEA292FDFDF4A05C EDF40F2AB108F8D74B32136D5681A8919A2B5BBAC0751B9CEE1 5B5AA6E459BCC3124A8AA27D81A5A3950F2E4CF Copyright Joe Security LLC 2018 Page 13 of 42

14 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{76D E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): B37D81C64D9AC00241EDC9263E86EE4 B90A4803E B8072E22D90B4D625A3F814D 3CADFE6EA7CD122190C47656F927E21004C39E105E9A F7F5E5D37C6E0 1D71835A849C03844FD84AD98B5C A7B77AFB8DF97C91291C3E0A849AF800EB2DC68B3C6C369CFD1 FCBA9F6032D6D6676C22377DDCF7D763EDF846 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{76D E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): DC4EC9FC552BF E71DB78D2C3D 4165AC185E31107F0AC0162B49C40FA AA0EE1F96D1FADD748E74773AB32B88FED7CEF7EE905CE4F1AF1FD3D B21686B5A3E89778D87F495556FF24069DB95747ED520C0E81D97FD05264AFB745CE537F6FE49585E68B4602F E056E70AE729E44A590C90636C93 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{809F E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E3B2C8F1D2BC8C0EACD636FBBF33 5D98D0276E1A99C2F361A44E82BDFB7B D 225A D60D5FE2F0B507E7F433071CF1C146D5CD6680A6CDA8B55E E0281E97F27DD4615E1E1FB651AA930E7107EA0B0B0471FC23F343297C953127DBB55F F83D094FCF2F F1C579AE74C76B498A012D9174A60E280BE39 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA1E0.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ErrorPageTemplate[1] Size (bytes): 2168 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators F4FE1CB77E758E1BA56B8A8EC20417C5 F4EDA06901EDB98633A686B11D02F4925F827BF0 8D B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F 62514AB345B6648C A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E BFAC A416C09733F24E B96843DC222B436 Copyright Joe Security LLC 2018 Page 14 of 42

15 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ErrorPageTemplate[1] C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\down[1] Size (bytes): 748 Entropy (8bit): PNG image data, 15 x 15, 8-bit colormap, non-interlaced C4F558C4C8B56858F15C09037CD6625A EE497CC061D6A7A59BB66DEFEA65F9A8145BA240 39E7DE847C9F731EAA72338AD B957859DE27B50B6474EC D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE AC191F8F F76 8F4840BCD5B62CB6A032EF292A8B0E52A44 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\invalidcert[1] Size (bytes): 3084 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators F927FC64C6CCF8F9E508B5C8510C8D26 9AAAD2E C151FF294A116D66D7286CC052 D1122EFA5A5D7CF93E9DA4CB8525CC7E6CCF50B9FA16C167A5D7E A5FA A70CE43D8497EF7D91D8C2C78DFB52FAE9AA1C39691D46D8EE3A2E65D82482E8F2916C39B3D85CE8B8F9A0647 FCCDC831C1FD6824FD300AA91818D0191AA4C50 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\green_shield[1] Size (bytes): 810 Entropy (8bit): PNG image data, 14 x 16, 8-bit colormap, non-interlaced C6452B941907E0F0865CA7CF9E59B97D F9A2C03D1BE04B53F2301D3D984D73BF BA122F4B39A33339FA9935BF656BB0B4B45CDDED78AFB16AAFD73717D BEB58C06C2C1016A7C7C8289D967EB7FFE D9205A37C6D97BD51B153F4A053E661AD4145F23F56CE0AEB DA101932B8ED64B1CD4178D127C9E2A20A1F58 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\iecompatviewlist[1].xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators CE5A2E8A386F7070BAA6799FB7C39E0D 70AE543F05CABCD2FBED9C95BF03182A C0654B0B4367B3A082D00BCECD1DB365D6A3D7B8747F0B059EB4D016E0D F54676DE8A245CB847D3337BA7C0136B9D773FDA9BEF52C5C156C8C4F4F212DE46796F08F F2FA1 6436E831E9E369BA0A6513EC6DFFD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\suggestions[1].en-US data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A Copyright Joe Security LLC 2018 Page 15 of 42

16 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\suggestions[1].en-US 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 9B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\httpErrorPagesScripts[1] Size (bytes): 8714 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators 3F57B781CB3EF114DD0B B7B CE6A63F996DF3A1CCCB81720E21204B825E0238C 46E019FA34465F4ED096A9665D1827B AD82E98BE01EDB1DDBC94D3AD 8CBF4EF582332AE7EA605F910AD6F8A4BC FA84F08943A72CAC2CF0FA32B6AF4C20C697E1FAC2C5 BA16B5A64A23AF0C11EEFBF69625B8F9F90C8FA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\invalidcert[1] Size (bytes): 5123 Entropy (8bit): HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators DE640A4BFEBAB60DA20EA8D35B E1FDF9A543B44A0B0C3F51379FBC0E59AB2EFAD8 E8EC4E22DDCC6E52E242331CB84DDB1EAC45E8ABD51F1892DE33DC279E0E F57AE5C E0030C4B44A1FAB7C7991F6CFF8FB0C40A40C35D6C26C76BE5EAE8E22C5CFC89EE066 81F08A157B63C0A55B3557C08D331A7EC4B7C7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\red_shield[1] Size (bytes): 810 Entropy (8bit): PNG image data, 14 x 16, 8-bit colormap, non-interlaced 006DEF2ACBD0D2487DFFC287B27654D6 C95647A113AFC5241BDB313F911BF338B9AEFFDC 4BD9F96D6971C7D37D03D7DEA4AF922420BB7C6DD46446F05B8E917C33CF9E4E 9DABF92CE2846D8D86E20550C749EFBC4A1AF23C2319E6CE65A00DC8CBC75AC95A CAB1536C A 8739B D0BA562F48F4D3C25104B059A04 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\urlblockindex[1].bin data Copyright Joe Security LLC 2018 Page 16 of 42

17 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\urlblockindex[1].bin Size (bytes): 16 Entropy (8bit): FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A 81AC13A69E49A6A2FE2FDD AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\background_gradient_red[1] JPEG image data, JFIF standard 1.01 Size (bytes): 868 Entropy (8bit): E78CF3C521402FC7352BDD5EA6 017EAF48983C31AE36B5DE5DE4DB36BF953B3136 FBC23311FB5EB53C73A7CA6BFC93E8FA3530B07100A128B4905F8FB7CB145B D382338F467D0374CCE3FF3C392833FE13AC595943E7C5F2AEE4DDB3AF DD5DDC716DD17AEF ED4C2A1AB7FE6E E36EE98A7D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\errorPageStrings[1] Size (bytes): 3470 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators 6B26ECFA58E37D4B5EC861FCDD3F04FA B69CD71F68FE35A9CE0D7EA17B5F1B2BAD9EA8FA 7F7D1069CA8A852C1C8EB36E1D988FE6A9C17ECB8EFF1F66FC5EBFEB A 1676D43B977C07A3F6A5473F12FD16E A1CB9771D0F189B EE79480C33A010F08DC521E57332EC4 C4D888D693C6A2323C97750E C3F4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\red_shield_48[1] Size (bytes): 4127 Entropy (8bit): PNG image data, 40 x 48, 8-bit/color RGBA, non-interlaced 7C588D6BB88D85C7040C6FFEF8D753EC 7FDD217323D2DCC4A25B024EAFD09AE34DA3BFEF 5E2CD0990D6D3B0B2345C75B890493B A8104DE59C A826E3E0 0A3ADD1FF681D C59CAFFDE B9A0F85828AB751E59FDF24403A4EF D158E6B8A4C59C5B DAF563535FF5F097F EA19A9B0DC4D C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\B6C2JPBS.txt Size (bytes): 78 ASCII text Entropy (8bit): E18EADB2B9827C55A47866E047BCC 2D5CD24B07B522D1FFAF96BA826B95D81047B71D 65466EDF0292A7B5B437D5E773F7C67B24A9E EDF36B5C8B11029C1A AAB8A1A3B3B771386CCD0187A9483F26620D886B2C608AE9D30FE77FB615DD04953E3647A9B6 518A426E8B E9FC79C6D598F5795C1 Copyright Joe Security LLC 2018 Page 17 of 42

18 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\CC5X6POG.txt Size (bytes): 199 ASCII text Entropy (8bit): E7DB961D33401D31F698F8D7ACD7A0 175E E84677DBA6377A6D8535E95CAA8C 24D8E95493D0B87CCC17A42C4A9E66F B4AE81CC8A0B2BCBF BE A1A324996FF0A32AFBE C4483D9C7BDAD95ABD43E4C3E6DCADDF07C3FA1D8C447A2B3C5C6BBFC9F0 56CB13A6D9275D96204A3B018AE2D6D31D33C199 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\OX2K064K.txt Size (bytes): 282 ASCII text Entropy (8bit): ABB1279A3696D4F1ABBD E57D7CBAFC4B0818D41B083D305BAE9534D8B26D CE54C81E985472BF16C477E0E6196DF3D5A B239B846E639081E5271E E6B2CEE336E171660AD0A084AFFF6DDA2576D2573EF01D3321C77A7A4C969511D5F8A53336A E9F 57F7031BE2EDE26212C9C3E9C7BF1EBABEC4A Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation dralifaour.com true 0%, virustotal, Browse unknown Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Copyright Joe Security LLC 2018 Page 18 of 42

19 IP Country Flag ASN ASN Name Malicious United States IOFLOOD- InputOutputFloodLLCUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: (HTTPS) 53 (DNS) TCP Packets Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: Copyright Joe Security LLC 2018 Page 19 of 42

20 Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: Copyright Joe Security LLC 2018 Page 20 of 42

21 Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: Copyright Joe Security LLC 2018 Page 21 of 42

22 Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: UDP Packets Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: Copyright Joe Security LLC 2018 Page 22 of 42

23 Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: May 9, :59: Copyright Joe Security LLC 2018 Page 23 of 42

24 Timestamp Port Dest Port IP Dest IP May 9, :59: May 9, :59: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: May 9, :00: ICMP Packets Timestamp IP Dest IP Checksum Code Type May 9, :00: d010 (Port unreachable) May 9, :00: d010 (Port unreachable) May 9, :00: d010 (Port unreachable) Destination Unreachable Destination Unreachable Destination Unreachable DNS Queries Timestamp IP Dest IP Trans ID OP Code Name Type Class May 9, :59: x13e2 Standard query (0) May 9, :59: xa1db Standard query (0) dralifaour.com A (IP address) IN (0x0001) dralifaour.com A (IP address) IN (0x0001) DNS Answers Timestamp IP Dest IP Trans ID Replay Code Name CName Address Type Class May 9, x13e2 No error (0) dralifaour.com A (IP address) IN (0x0001) 13:59: May 9, xa1db No error (0) dralifaour.com A (IP address) IN (0x0001) 13:59: HTTPS Packets Timestamp May 9, :59: Port Dest Port IP Dest IP Subject Issuer CN=dralifaour.com CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US Before Sun Apr 08 02:00: After Sun Jul 08 01:59: Raw [[ Version: V3 Subject: CN=dralifaour.com Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 2048 bits modulus: public exponent: Validity: [From: Sun Apr 08 02:00: , To: Sun Jul 08 01:59: ] Issuer: CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US SerialNumber: [ ac 531d0c31 Copyright Joe Security LLC 2018 Page 24 of 42

25 Timestamp Port Dest Port IP Dest IP Subject Issuer Before After 1848e1fe 08e5ff4b]Certificate Extensions: 10[1]: ObjectId: Raw Criticality=Extension unknown: DER encoded OCTET string =0000: F F2 00 F EE 4B BD B u..K..u0010: CE 60 BA E F AB E1 9E 66 A3 0F 7E 5F B0.`..Bi...f..._.0020: 72 D C4 7B 89 7A A8 FD CB A4 r...z...b.0030: AA C9 A C B8...F0D. fl.0040: D6 CC E DA F9 69 3C 7B 7E B3 55 4D 9D BB...)...i<...UM..0050: 64 6B 1B 41 B8 ED CA 0C E dk.a...wp.q3. y0060: F A 1B D6 FA F3 48 EF B7 A9 60 CD F1 9B.DS...H...` : AC E9 26 A9 2F 00 FC BB E 0C 7D 5B 2B 00..&./...'C>..[+.0080: DB 74 AF EE CB 29 EC B1 FE CA 3E 71 6D 2C w..t...)...>qm,0090: E5 B9 AA BB 36 F C7 5D 9D 4F 37 B6 1F...6..q..].O7..00A0: BF A4 AA C d...b...H00B0: F 8F C3 DB E 0B 6D 0F.!...aRh^.m00C0: B9 E3 A6 32 8B F7 01 AE 1F 3C F 0A 36 E <U./.6.00D0: C D EE B0 B1 0C 8F C F7.2.=..!...h...00E0: B D 20 A7 1D B F0 FA A0 09!..W8....B...00F0: E B6 5F 96^#.P._[2]: ObjectId: Criticality=AuthorityInfoAccess [ [ accessmethod: caissuers accesslocation: URIName: accessmethod: ocsp accesslocation: URIName: ObjectId: Criticality=AuthorityKeyIdentifier [KeyIdentifier [0000: 7E 03 5A B A7 7E 0A E1 B8 9D 08 EA 1D 8E..ZeAk : 1D 6A C7 65.j.e]][4]: ObjectId: Criticality=trueBasicConstraints:[ CA: PathLen: undefined][5]: ObjectId: Criticality=CRLDistributionPoints [ [DistributionPoint: [URIName: [6]: ObjectId: Criticality=CertificatePolicies [ [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1D A 2F 2F E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F comodo.com/CPS]] ] [CertificatePolicyId: [ ][] ]][7]: ObjectId: Criticality=ExtendedKeyUsages [ serverauth clientauth][8]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][9]: ObjectId: Criticality=SubjectAlternativeName [ DNSName: dralifaour.com DNSName: autodiscover.dralifaour.com DNSName: cpanel.dralifaour.com DNSName: mail.dralifaour.com DNSName: webdisk.dralifaour.com DNSName: webmail.dralifaour.com][10]: ObjectId: Criticality=SubjectKeyIdentifier [KeyIdentifier [0000: 90 F0 2D E A 76 BB 47 E4 AC 63 F3 52 E7..-. (..v.g..c.r.0010: B9 4B 7E F5.K..]]] Algorithm: [SHA256withRSA] Signature:0000: 4F 8C 46 1B 29 9B B3 84 2E 26 4B EA 8F 7E O.F.)..7...&K : CC 1F A4 FA 21 AD 28 2C 38 D7 B0 29 6E 79...!.(,8..)ny0020: EF 16 C5 37 0A CD B4 DA E D0 u n7r.0030: BC 97 CC 3B 77 C0 14 FD 1F C C ;w...q : 1F CE CE AA 07 BB 9B C B4 5A CE BF 26 C6...c..Z..&.0050: 5B 2F BE 64 DA A0 2C E A4 37 CD 07 [/.d..,..! : 66 5C C B6 E6 2A AF 91 D1 B4 8C F2 f\.uv..*...b..0070: 77 5C 7F 4E 5B EB D8 7D C 9F w\.n[bx...<.0080: C3 2C 4C 98 DF C4 AA 60 CC DA 5A A6 48 A0 AE 9B.,L...`..Z.H : F FC 4D F6 F6 2E FF 5E CF 1D CA E f..M...^...1h00A0: F6 39 E7 47 CC D1 3D A3 7F A E6.9.G.0...=.."E*.00B0: 94 7C FC E2 79 FE BE FB BA A2 1E..1...y...00C0: 7C CA E6 01 A B E0 89 D c%...S.k...Vt00D0: CD 1E 4F A CF 27 EE DF 36 FB C..O.0".'..6..!..00E0: 5E 85 1B E5 FF C EC 2D F ^ &9?.W.00F0: 3F B2 C2 9A 2C 4C F4 8C A8 7F 02 1E BD 3B?...,L...;] Copyright Joe Security LLC 2018 Page 25 of 42

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version:

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: ID: 45097 Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature