Overview
overview
3Static
static
1dheater-0.4.3.zip
windows7-x64
1dheater-0.4.3.zip
windows10-2004-x64
1dheater-0....ragerc
windows7-x64
3dheater-0....ragerc
windows10-2004-x64
3dheater-0....ignore
windows7-x64
3dheater-0....ignore
windows10-2004-x64
3dheater-0....ignore
windows7-x64
3dheater-0....ignore
windows10-2004-x64
3dheater-0....ci.yml
windows7-x64
3dheater-0....ci.yml
windows10-2004-x64
3dheater-0....lintrc
windows7-x64
3dheater-0....lintrc
windows10-2004-x64
3dheater-0....erfile
windows7-x64
1dheater-0....erfile
windows10-2004-x64
1dheater-0....SE.txt
windows7-x64
1dheater-0....SE.txt
windows10-2004-x64
1dheater-0....EST.in
windows7-x64
3dheater-0....EST.in
windows10-2004-x64
3dheater-0....DME.md
windows7-x64
3dheater-0....DME.md
windows10-2004-x64
3dheater-0....25.pem
windows7-x64
3dheater-0....25.pem
windows10-2004-x64
3dheater-0....48.pem
windows7-x64
3dheater-0....48.pem
windows10-2004-x64
3dheater-0....75.pem
windows7-x64
3dheater-0....75.pem
windows10-2004-x64
3dheater-0....72.pem
windows7-x64
3dheater-0....72.pem
windows10-2004-x64
3dheater-0....25.pem
windows7-x64
3dheater-0....25.pem
windows10-2004-x64
3dheater-0....96.pem
windows7-x64
3dheater-0....96.pem
windows10-2004-x64
3Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 15:16 UTC
Static task
static1
Behavioral task
behavioral1
Sample
dheater-0.4.3.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dheater-0.4.3.zip
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
dheater-0.4.3/.coveragerc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
dheater-0.4.3/.coveragerc
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
dheater-0.4.3/.dockerignore
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
dheater-0.4.3/.dockerignore
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
dheater-0.4.3/.gitignore
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
dheater-0.4.3/.gitignore
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
dheater-0.4.3/.gitlab-ci.yml
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
dheater-0.4.3/.gitlab-ci.yml
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
dheater-0.4.3/.pylintrc
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
dheater-0.4.3/.pylintrc
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
dheater-0.4.3/Dockerfile
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
dheater-0.4.3/Dockerfile
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
dheater-0.4.3/LICENSE.txt
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
dheater-0.4.3/LICENSE.txt
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
dheater-0.4.3/MANIFEST.in
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
dheater-0.4.3/MANIFEST.in
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
dheater-0.4.3/README.md
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
dheater-0.4.3/README.md
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
dheater-0.4.3/data/dhparam-ffdhe-2048-openssl-225.pem
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
dheater-0.4.3/data/dhparam-ffdhe-2048-openssl-225.pem
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
dheater-0.4.3/data/dhparam-ffdhe-2048.pem
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
dheater-0.4.3/data/dhparam-ffdhe-2048.pem
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
dheater-0.4.3/data/dhparam-ffdhe-3072-openssl-275.pem
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
dheater-0.4.3/data/dhparam-ffdhe-3072-openssl-275.pem
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
dheater-0.4.3/data/dhparam-ffdhe-3072.pem
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
dheater-0.4.3/data/dhparam-ffdhe-3072.pem
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
dheater-0.4.3/data/dhparam-ffdhe-4096-openssl-325.pem
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
dheater-0.4.3/data/dhparam-ffdhe-4096-openssl-325.pem
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
dheater-0.4.3/data/dhparam-ffdhe-4096.pem
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
dheater-0.4.3/data/dhparam-ffdhe-4096.pem
Resource
win10v2004-20240709-en
General
-
Target
dheater-0.4.3.zip
-
Size
34KB
-
MD5
b962ca833d9935d9e8a64e2cd4ded8c3
-
SHA1
a15b0ba46a3d7394d8badca1753b71510361f0ae
-
SHA256
b7111d51e5a77bca18ad278cee2b990937ab9e23d58b60f7d6f16093a0971906
-
SHA512
5e7d67ea8be26c165bd0d77368f24f4d2e52a5fbc9728c200d1476069f7d98f946c24a60fbbca67a3081ea10ad2a9d7ee0f4021675fd511e7e3a1b9d33b9c57e
-
SSDEEP
768:kaX7kkG55InOSSV49fDPheMZeHJcy1KbDJyUksg1k+m:ZqIngsbPKJsbVyU41kj
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3D2D779D6CA46797188163276D1F667F; domain=.bing.com; expires=Wed, 06-Aug-2025 15:17:16 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 558AE6F922A94E448CCA165E53BA65F1 Ref B: LON04EDGE0819 Ref C: 2024-07-12T15:17:16Z
date: Fri, 12 Jul 2024 15:17:16 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3D2D779D6CA46797188163276D1F667F
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=_rqgpp3LZs3WI_qmWmDWfN58ykTBZb-kAnA0ZS5q6nw; domain=.bing.com; expires=Wed, 06-Aug-2025 15:17:16 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DFC099CFE8D84FAF880DA2072C8863A0 Ref B: LON04EDGE0819 Ref C: 2024-07-12T15:17:16Z
date: Fri, 12 Jul 2024 15:17:16 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3D2D779D6CA46797188163276D1F667F; MSPTC=_rqgpp3LZs3WI_qmWmDWfN58ykTBZb-kAnA0ZS5q6nw
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BAC119F56B744D22895D117404E79C21 Ref B: LON04EDGE0819 Ref C: 2024-07-12T15:17:16Z
date: Fri, 12 Jul 2024 15:17:16 GMT
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request122.10.44.20.in-addr.arpaIN PTRResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=tls, http22.0kB 10.7kB 22 20
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=95f1e05cd0b34d6c9ece1a0f5f76a493&localId=w:A55461EC-E2C0-7E26-6404-F1FD6509940B&deviceId=6966568319254816&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
107.12.20.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
31.243.111.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
122.10.44.20.in-addr.arpa