Back to Malware Drops

5e822125411645387716eb270150e78b05c32036cfe29322002800bae73d5810

MD5f119ccfb6356d8cd819bf80fce70f6ea
SSDEEP1536:2wtzpoZAcuRXkdsyQrUnKOM/LINU6NrdRh50LUWGF2wYCD4zUAd6LT35t13XEsFN:AuRX9rPVp6TF2w94zUHJF5XkKnwA1
File Typeunknown
Size193.5 KB
Sources1
Downloads0
First SeenJun 18, 2018
Last SeenJun 18, 2018
Download sample (.zip, password: infected)

Live malware — handle only in an isolated analysis environment.

Originating Attacks

Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.

Indicators of Compromise

Values are defanged (e.g. hxxp://, [.]) — not live links.

domain (11)

  • cfl[.]dropboxstatic[.]com
  • dbxlocal[.]dropboxstatic[.]com
  • dropbox[.]com
  • flash[.]dropboxstatic[.]com
  • mail[.]com
  • marketing[.]dropbox[.]com
  • ogp[.]me
  • www[.]dropbox[.]com
  • www[.]dropboxstatic[.]com
  • www[.]google[.]com
  • www[.]w3[.]org

email (8)

  • ajax-loading-small@2x-vflAxdZTP[.]gif
  • dropbox_files@2x-vflABjXqu[.]png
  • error_404@2x-vflUJcZsh[.]png
  • glyph_m1@2x-vflA6lTFZ[.]png
  • header_logo_shmodel@2x-vflvJX68X[.]png
  • insert@2x-vflTxG2RJ[.]png
  • twitter-card-glyph_m1@2x-vflrCAzPX[.]png
  • you@mail[.]com

url (21)

  • hxxp://ogp[.]me/ns/fb#
  • hxxps://cfl[.]dropboxstatic[.]com/static/
  • hxxps://cfl[.]dropboxstatic[.]com/static/compiled/js/alameda_bundle/alameda_bundle[.]min-vfl5tPPnr[.]js
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/accessibility-vflMYBl-j[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/components/button-vfl-_t7Pp[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/components/exp_cards-vflJsYU3g[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/components/login_form-vflkagWPj[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/components/login_or_register-vflAJk0Kd[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/dropbox/2015/layout-vflvc3veE[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/dropbox/2015/pages/index-vflf_Uzj-[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/file_preview-vfllUSAzb[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/font_paper_atlas_grotesk-vflEbKJso[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/freshbutton-vflIywrek[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/bright_modal-vfltS1uv-[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/compact_form-vflfQZ6wi[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/growth/shared_link_signup_modals-vflf9-K3u[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/legacy_packages/components-vflbDMbD3[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/login_or_register-vfl9esD0O[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/maestro_layout-vflwIfhrd[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/main-vflJweEww[.]css
  • hxxps://cfl[.]dropboxstatic[.]com/static/css/preview_flexbox_layout-vflQUUZaq[.]css