Resubmissions
20/02/2024, 16:33 UTC
240220-t2xz7sbd71 3Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
20/02/2024, 16:33 UTC
General
-
Target
Help/nvcpl/nv3deng.chm
-
Size
157KB
-
MD5
3ecd51de3a504eec21d70ccf865d43dd
-
SHA1
e36dc69365c8316509bde90bcd85379e088689cb
-
SHA256
1d80c40950a02fe124d5450f0f2a4b177a497607575b4b13eb06debf958b6cea
-
SHA512
7d7753c86f808440641f1d8aef255f787d23eb0af0aea886f0f8d85d994dc8a839f5df2f182e934c3508acbfa06de4a0d430df9076f141084fb1fab53f5d6490
-
SSDEEP
3072:TrTTUcvjPGlZ2LByOsOKYRprh/tIM10HcYLM127AbK2G51wAe:Tr8rZ3lMpRtjYLM1BLm+Ae
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\hh.exe"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\Help\nvcpl\nv3deng.chm1⤵
- Suspicious use of SetWindowsHookEx
Network
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse -
DNS201.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request201.201.50.20.in-addr.arpaIN PTRResponse
-
DNS201.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request201.201.50.20.in-addr.arpaIN PTR
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa
DNS Request
201.201.50.20.in-addr.arpa
DNS Request
201.201.50.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa