Back to Malware Drops
5e822125411645387716eb270150e78b05c32036cfe29322002800bae73d5810
MD5f119ccfb6356d8cd819bf80fce70f6ea
SSDEEP1536:2wtzpoZAcuRXkdsyQrUnKOM/LINU6NrdRh50LUWGF2wYCD4zUAd6LT35t13XEsFN:AuRX9rPVp6TF2w94zUHJF5XkKnwA1
File Typeunknown
Size193.5 KB
Sources1
Downloads0
First SeenJun 18, 2018
Last SeenJun 18, 2018
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Jun 18, 2018, 3:35:57 PMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (11)
- cfl[.]dropboxstatic[.]com
- dbxlocal[.]dropboxstatic[.]com
- dropbox[.]com
- flash[.]dropboxstatic[.]com
- mail[.]com
- marketing[.]dropbox[.]com
- ogp[.]me
- www[.]dropbox[.]com
- www[.]dropboxstatic[.]com
- www[.]google[.]com
- www[.]w3[.]org
email (8)
- ajax-loading-small@2x-vflAxdZTP[.]gif
- dropbox_files@2x-vflABjXqu[.]png
- error_404@2x-vflUJcZsh[.]png
- glyph_m1@2x-vflA6lTFZ[.]png
- header_logo_shmodel@2x-vflvJX68X[.]png
- insert@2x-vflTxG2RJ[.]png
- twitter-card-glyph_m1@2x-vflrCAzPX[.]png
- you@mail[.]com
url (21)
- hxxp://ogp[.]me/ns/fb#
- hxxps://cfl[.]dropboxstatic[.]com/static/
- hxxps://cfl[.]dropboxstatic[.]com/static/compiled/js/alameda_bundle/alameda_bundle[.]min-vfl5tPPnr[.]js
- hxxps://cfl[.]dropboxstatic[.]com/static/css/accessibility-vflMYBl-j[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/components/button-vfl-_t7Pp[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/components/exp_cards-vflJsYU3g[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/components/login_form-vflkagWPj[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/components/login_or_register-vflAJk0Kd[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/dropbox/2015/layout-vflvc3veE[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/dropbox/2015/pages/index-vflf_Uzj-[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/file_preview-vfllUSAzb[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/font_paper_atlas_grotesk-vflEbKJso[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/freshbutton-vflIywrek[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/bright_modal-vfltS1uv-[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/compact_form-vflfQZ6wi[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/shared_link_signup_modals-vflf9-K3u[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/legacy_packages/components-vflbDMbD3[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/login_or_register-vfl9esD0O[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/maestro_layout-vflwIfhrd[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/main-vflJweEww[.]css
- hxxps://cfl[.]dropboxstatic[.]com/static/css/preview_flexbox_layout-vflQUUZaq[.]css