Edit tour
Windows
Analysis Report
Grid 3.exe
Overview
General Information
| Sample Name: | Grid 3.exe |
| Analysis ID: | 1319994 |
| MD5: | 06844e65a7a827a949c5e6a236a6c8de |
| SHA1: | d477de3fe8e271afbb8be7fd22bc2cbb54c6e6cd |
| SHA256: | dc7900304965f4d32aed8b701a884ff2549e40d7d869f4de3900c71f872be353 |
| Infos: |  |
 | |
Detection
| Score: | 36 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Creates an autostart registry key pointing to binary in C:\Windows
Yara detected Generic Downloader
Uses 32bit PE files
Found inlined nop instructions (likely shell or obfuscated code)
Queries the volume information (name, serial number etc) of a device
DLL planting / hijacking vulnerabilities found
Sample file is different than original file name gathered from version info
Allocates memory with a write watch (potentially for evading sandboxes)
Drops PE files
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
Creates a process in suspended mode (likely to inject code)
Contains long sleeps (>= 3 min)
Enables debug privileges
Classification
Analysis Advice
| Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox |
| Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") |
- System is w10x64_ra
Grid 3.exe (PID: 5628 cmdline: C:\Users\u ser\Deskto p\Grid 3.e xe MD5: 06844E65A7A827A949C5E6A236A6C8DE) - ssUpdate.exe (PID: 2100 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\Smartbo x Update\s sUpdate.ex e" Deploym entMode="I nstall" In stallation Id="Grid 3 MD5: 2BDEC611319F5BB269337BCBFF6346DE)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security |
⊘No Sigma rule has matched
⊘No Snort rule has matched
- • Privilege Escalation
- • Compliance
- • Software Vulnerabilities
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Boot Survival
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | DLL: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_03550F90 | |
| Source: | Code function: | 0_2_03550FA0 | |
| Source: | Code function: | 0_2_03550A69 | |
| Source: | Code function: | 0_2_03550AFD | |
Networking |   |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_03555A60 | |
| Source: | Code function: | 0_2_03550AFD | |
| Source: | Code function: | 1_2_00007FFBF72566F3 | |
| Source: | Code function: | 1_2_00007FFBF725A5B8 | |
| Source: | Code function: | 1_2_00007FFBF7262BF5 | |
| Source: | Code function: | 1_2_00007FFBF7261496 | |
| Source: | Code function: | 1_2_00007FFBF72530A8 | |
| Source: | Code function: | 1_2_00007FFBF725BF43 | |
| Source: | Code function: | 1_2_00007FFBF725D60D | |
| Source: | Code function: | 1_2_00007FFBF7255E80 | |
| Source: | Code function: | 1_2_00007FFBF725A66D | |
| Source: | Code function: | 1_2_00007FFBF725C270 | |
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Classification label: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_089B2FF6 | |
| Source: | Code function: | 0_2_089B4F27 | |
| Source: | Code function: | 0_2_089B3088 | |
| Source: | Code function: | 0_2_03551402 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
Boot Survival | |
|---|
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Registry value created or modified: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | 2 Command and Scripting Interpreter | 11 Registry Run Keys / Startup Folder | 12 Process Injection | 1 Masquerading | OS Credential Dumping | 1 Process Discovery | Remote Services | 1 Archive Collected Data | Exfiltration Over Other Network Medium | 1 Encrypted Channel | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Scheduled Task/Job | 1 DLL Search Order Hijacking | 11 Registry Run Keys / Startup Folder | 1 Disable or Modify Tools | LSASS Memory | 31 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | 1 DLL Search Order Hijacking | 31 Virtualization/Sandbox Evasion | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | 12 Process Injection | NTDS | 12 System Information Discovery | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | Remote System Discovery | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings | |
| Replication Through Removable Media | Launchd | Rc.common | Rc.common | 1 DLL Search Order Hijacking | Cached Domain Credentials | System Owner/User Discovery | VNC | GUI Input Capture | Exfiltration Over C2 Channel | Multiband Communication | Jamming or Denial of Service | Abuse Accessibility Features |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 5% | ReversingLabs | |||
| 3% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 3% | ReversingLabs | |||
| 0% | Virustotal | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 1% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
⊘No contacted domains info
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| low | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| low | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| low | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
⊘No contacted IP infos
| Joe Sandbox Version: | 38.0.0 Ammolite |
| Analysis ID: | 1319994 |
| Start date and time: | 2023-10-05 10:18:58 +02:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 7m 15s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowsinteractivecookbook.jbs |
| Analysis system description: | Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip) |
| Number of analysed new started processes analysed: | 14 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample file name: | Grid 3.exe |
| Detection: | SUS |
| Classification: | sus36.troj.winEXE@3/28@0/0 |
| EGA Information: |
|
| HCA Information: | Failed |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): RuntimeBroker.e xe, SIHClient.exe, SgrmBroker. exe, backgroundTaskHost.exe, u socoreworker.exe, svchost.exe - Excluded domains from analysis
(whitelisted): fs.microsoft.c om - Execution Graph export aborted
for target ssUpdate.exe, PID 2100 because it is empty - Report size getting too big, t
oo many NtAllocateVirtualMemor y calls found. - Report size getting too big, t
oo many NtOpenKeyEx calls foun d. - Report size getting too big, t
oo many NtProtectVirtualMemory calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found.
⊘No simulations
⊘No context
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\Smartbox Update\ControlzEx.dll | Get hash | malicious | Browse | |||
| C:\Users\user\AppData\Local\Temp\Smartbox Update\Ionic.Zip.Reduced.dll | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | Njrat | Browse | |||
| Get hash | malicious | Njrat | Browse | |||
| C:\Users\user\AppData\Local\Temp\Smartbox Update\Newtonsoft.Json.dll | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | RedLine | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | AgentTesla | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Browse |
| Process: | C:\Users\user\AppData\Local\Temp\Smartbox Update\ssUpdate.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 2251 |
| Entropy (8bit): | 5.170063072895009 |
| Encrypted: | false |
| SSDEEP: | 48:pCF6+CFnDzFYCF3C+F3gKFY0vFj0FwVpFDToOfFSCFuaFnaFRFmFqLF0fF/FARF/:46+GlYG3t39Y0dj883NtSGuOOjyWwNAL |
| MD5: | 0CEAE5FB338A48DC3AF3364A0ABC07AD |
| SHA1: | 37180819F4EB37ABEF6C1A2456B9EBB37A5336BC |
| SHA-256: | 146312E1C7B9803D6D634B8317763C11094430F9EB9808EF0F4786A79AD5E082 |
| SHA-512: | F6AE92F9081AF143A5C59FFDA394976FAC7530BD79E54B3E6D9E1581340B2E838704F7B0ECDA65112730488CF6B552BB1E3347027EF84460C9426A7EC3F3BFAD |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 365 |
| Entropy (8bit): | 5.094259393040409 |
| Encrypted: | false |
| SSDEEP: | 6:qrpsvknsfAjo6/sypfkhVTs0RLYtKkhXi1gvGuSADQJAeE56/YHRLYI0Msy:IBntMBhci1gvGdPgULy |
| MD5: | FF69D2C903F474E927EF94834EC010F2 |
| SHA1: | 0F504E36AE38F4916C019BEE59898260EEE27B3D |
| SHA-256: | 532E7B72C5A45D428ABBE89F0E1E653237EEA0D8D9F9A9C66D9A3CEC78950F9C |
| SHA-512: | D90C282B072C7F724AE67A7D6D3D7A80E4058596878A29645C0A03267182200E502078740BFBEA8C2BD21D5E578699FB58E22B7571A3CCD7B00FCD207F98800E |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 180224 |
| Entropy (8bit): | 6.229484855760191 |
| Encrypted: | false |
| SSDEEP: | 3072:yE0EAPzbErGWsOMpgV0Dc6RdUdF0HQszXAfZMdFtp04b9Y8B3m1k7pq7FLFa2u:yE0EAPMrGWsWDWidF0HQszCZ2Ftppb9q |
| MD5: | 5CF2837021516334344629CB679D40B5 |
| SHA1: | 92D9304196ADBA968C05C4D120387E464391B792 |
| SHA-256: | 55CAE0AF8517AC2D787B210AC6F79C9AAC7F58035B69FAAF620A90F33E2676FC |
| SHA-512: | 200EF0B7A3F6F7907A355C4DE88F21783D535355BC1A71AE6B463C25B8D9AC84940380E1E71927247AF6D5E9B9621A3CEFA841A705B7179D8AA5A3904AC27924 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 312832 |
| Entropy (8bit): | 4.100547518599601 |
| Encrypted: | false |
| SSDEEP: | 3072:3QFtDmSPxL/9wj0H+AlmIG+7N9nlEtSqBE2Ef+oipE/ST4SGit5:3QF5lt/9wjq5ky9mQqBE2Efl/lk |
| MD5: | 592DE6D3906C1F8EC419C14D953CDF2A |
| SHA1: | 03A726DF6B4E553FDD8A4D853FF6289FB27AD10C |
| SHA-256: | 0DD32D717D517F3F0BF5D370F627C1CEBAE7CA27B63FBBB150863EC3F238B9D9 |
| SHA-512: | B39602A26E352E76266323BA4A198BB06AE9891E12DCAD38B3860399D83628D5A303E05648A565B8FEB1B31C70357B4F300828DF2C9E22C630C614C6E6D81112 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 253440 |
| Entropy (8bit): | 5.820021239165709 |
| Encrypted: | false |
| SSDEEP: | 3072:nrI52ReHNdAFnfPPShREuMPb9YlVVRxpop2i0KKCXrXSbS4KcMy8ZZL5QlcSCSLw:yNdA+Myl7TpNiWCL4EycZb4 |
| MD5: | 7C359500407DD393A276010AB778D5AF |
| SHA1: | 4D63D669B73ACACA3FC62EC263589ACAAEA91C0B |
| SHA-256: | A4009288982E4C30D22B544167F72DB882E34F0FDA7D4061B2C02C84688C0ED1 |
| SHA-512: | 88A25138D0A491E5EE27499206E05B8C501DA0C73AD2B3E23D70E810A09BFC1B701817DE7F22C9F0B9F81F90235FE5EEADD112773035A11F01706EAC364B34BC |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: | |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1097216 |
| Entropy (8bit): | 6.200315447031076 |
| Encrypted: | false |
| SSDEEP: | 24576:mEAVf5dAgAgAgyjev4ICwQGZDHSxV/wvHG:md6ev4GQGZexV/UG |
| MD5: | 9E0CA1AC087B5388D27CAC68FEF292A6 |
| SHA1: | 1CAD41FBD7A7ACC967E4CC1F358ABEAAC9FD24CC |
| SHA-256: | F2859D100F0A59A0B21CB448B54150050626057F98F9995FC39ACF0DD0C56BC0 |
| SHA-512: | B65179B99014F42DB84E92B6DF0FC5DFF3AD6D5556B9383894FCBA09A48B27E4330DB8938F8118C8189B4238958734E14907A9348D1D850825D88783869DE6A1 |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1478144 |
| Entropy (8bit): | 4.220762561055877 |
| Encrypted: | false |
| SSDEEP: | 6144:xluaSrCanlJAXLzFkPkOMr8CwjF3rFkQjmsO5O+VC2QC8n4upPoYDH+T+uPMg7yy:C4kMx4t3BjcrPukVXYPJfvanKoLPo |
| MD5: | 2C6D047C1A82F8B532F288A49D01F0B3 |
| SHA1: | 2F126EDFA72227AA8B095C8B996B0ADD8F1E2213 |
| SHA-256: | 780541ABE3BA5D8E8E2072C1E294516E61355E7BB38E386AD0948857B8256CBC |
| SHA-512: | 2FB8A6C908B292ECFB4BA6FABC71D7699E48791F53C1466B05ACC0C3CF082695925DF44608833F28CF9D8B96C1E9D4DBFC109F3DB23AEDFFAAAC21DF8F7C4256 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 295801 |
| Entropy (8bit): | 4.546954749487013 |
| Encrypted: | false |
| SSDEEP: | 6144:+ktMqaIU0xp/utFeBiRed7dEPnGy2/4w/fuxexst:RUApi |
| MD5: | 202180CB9296C56F74B472DC4FBFD101 |
| SHA1: | 5BC26DA38586F2BFBE86D2824872FAEE177F0575 |
| SHA-256: | E90A6F9F1A642D9473C1DFEA9B4B103D76541E86F805E4445E4F185E993F4C1E |
| SHA-512: | 1BB2F2139AA6657C6039F8711B490A27D7ABD08ECF4EAE8CBEEE16EECF963E70B15FFF7BA4A8EE0DA5DC08127B3F33BD0B3C4A194E82945E323787AC48AA7DB1 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 291840 |
| Entropy (8bit): | 5.78437836503616 |
| Encrypted: | false |
| SSDEEP: | 6144:5z5bthkBm9LrNrHhufax3e9yVB9/4pQeXrcSGiI8vI7/tf:53T0fTKWn74 |
| MD5: | F5A3877D553F4D94AF799A55D01DD23B |
| SHA1: | 1178A763C8B9C0092BD785E25C94FE682C61B631 |
| SHA-256: | 5A62D57159E42A08E629A145581BA40CCB8F1FDEBFA32ED28E1D970BFC797C26 |
| SHA-512: | 94E783E344D85DDC05C8144E3DC69A0518CCDD38603A11F0860471C23B1E74203A6DC58314A00D9BF833DC59F6799F513D46A53062EA4EE397FC3055E03A8DF8 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 675240 |
| Entropy (8bit): | 5.939568165683378 |
| Encrypted: | false |
| SSDEEP: | 12288:4uLQZbq16LMLq42433d25X8STJmMRv0niBXh8KOBAj0W:4z/LMLq42t5X8STJmMRv0nQHOBAjx |
| MD5: | D827DD8A8C4B2A2CFA23C7F90F3CCE95 |
| SHA1: | 26C78DAD612AFF904F216F19F49089F84CC77EB8 |
| SHA-256: | B66749B81E1489FCD8D754B2AD39EBE0DB681344E392A3F49DC9235643BDBD06 |
| SHA-512: | 9CE24C4497FE614B78B3F2F985CAFB817D52F21D090AA23FD87F1A3478135ABE95E0ABE3557DD3F12A5B3F4C9A09E8337169988314C12C51B4951317E0569787 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 250244 |
| Entropy (8bit): | 5.05857526121953 |
| Encrypted: | false |
| SSDEEP: | 3072:IVzKtmddkMrnvoedEJNGv7sX7gq883MbRaFZF7l0ZXZWXJ08YAMRFCvedrREjz:uzDXwedEJhndX7l4cJEAeAvm2 |
| MD5: | 723488E359FD75C971EE5FBB65E50F54 |
| SHA1: | C69442ABD1A9476E2BFDDC25DD128E41BD75B738 |
| SHA-256: | B58A95BC477D69E02D22F877476E9C69C8E1CF0EB2B96B6CF2BC83AF798C4C90 |
| SHA-512: | AAA7A0E54BF6542562ECADF25628170F1B513281B1AFEB7DCFA9A0C8A833BCB035CEFF4591996598876F2292B95DC52B4FFA946BD6562D23AE422065776A7D81 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 699263 |
| Entropy (8bit): | 4.633228934474069 |
| Encrypted: | false |
| SSDEEP: | 6144:XqqUEknRikaaG0rH3jGHdl0/IYHtpgVIeR0R+CRFo9TA82mIKj+sJjoqoyO185Qy:DUE |
| MD5: | 479550F04AE5BADDE08753E3F29E4FFE |
| SHA1: | 0E9BE68EB76DB29A2448292AFBADF6A7FDE952A0 |
| SHA-256: | BFB2B3619BB456629CB3B3BB321FF751D06E1C04C8749E2114E85F4578EFD4B0 |
| SHA-512: | C3FA8423D96704CA61740C0A7ADC12E2C6170023BF026CD63EA3A3E0D2E9882273BA3ACE69EBB72DD22D3A5833161560A89282F3925FF12E11A5417CEE5B247A |
| Malicious: | false |
| Preview: |
C:\Users\user\AppData\Local\Temp\Smartbox Update\SensorySoftware.Deployment.Client.Model.Desktop.dll 
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 116224 |
| Entropy (8bit): | 5.9042293094465315 |
| Encrypted: | false |
| SSDEEP: | 1536:BdO3xYLjBjX15/nZwl8KBo6TlsjlaX9RuO8GMSFB1CNj0hSaI:BcK3BjXGqQyjl29YYX1CNj0hSX |
| MD5: | E0202581A4B045130B2806EC32B910F5 |
| SHA1: | AB372290F196EA6F3E595D1BD0DB0705C4695EEE |
| SHA-256: | BB9CCC68B7D0D957759868BEB60E5FAAB53D8C09C8FD93E15E5C23F02D2EA0B9 |
| SHA-512: | 7BCD873DBF30F6B8C05409AF586452B04E33F402622B2448ACD4FCFD92F08F98461B2AEEC92BA5C07CCF18EF49BCAD5C2AE20986C31EA18EAA6277C26A7C9CE0 |
| Malicious: | true |
| Yara Hits: |
|
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 302592 |
| Entropy (8bit): | 3.995557313729345 |
| Encrypted: | false |
| SSDEEP: | 3072:xjxKkdjv0uzE3NAUTW5TxHwQuADbgGpP5:xjxKkdjcuzESHWADbgCP5 |
| MD5: | 061DA78D7E2FE12CB7D0BC622E0C46D4 |
| SHA1: | 7314D107B147CB5DFAC4D3C91BF9CEF406343F8D |
| SHA-256: | 43FF080F9FD9894696938065E808BDC4031234CC4CD092D05A7D3F01A34A705C |
| SHA-512: | 8729E7D255ABA1DC3E0B8F5812C8F8B44B3502CA93FBB6E55511100A5B1385CC9916263340B50010E581056EE555D5A9C17ACE35B12D86BD5C21682DF36A80C9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 47616 |
| Entropy (8bit): | 5.855268233794137 |
| Encrypted: | false |
| SSDEEP: | 768:WGIVDyExHg1iwum3KFa1WmK4QeKA/+gaEsog99Q0bjzQoIzwGXq:5JYHg1iLpYWc9aEsog99jnz9GXq |
| MD5: | 81AE367B169BC9869A4E97312A15DBBB |
| SHA1: | BA8A0A0A9C51885AFFE9CFFDCCF16AC30D12006D |
| SHA-256: | 737DBD1BF3BFD43057AF93E3B0FABBE3014820FBBDF0EE578D0E3485A077F949 |
| SHA-512: | 32A3DF204593614E60B1197E9939751BCC08A9A1113AEA5FF7E5E654EA4997986CBBAA38F968F6E336B9276517BAFFAD2E3BB07B2318DC910BD4F28BF87EE157 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 148992 |
| Entropy (8bit): | 3.819134144471349 |
| Encrypted: | false |
| SSDEEP: | 1536:0c48+874o9nVJE3xGr2g10EyBLPPsGJoLuhaTdf:W8+s9XE32yBLpJoSh |
| MD5: | CCA957EFFA716D902344D23F4D2B7C5F |
| SHA1: | A2437CCC7DB6555A3772A76DC9E998F56B129F6D |
| SHA-256: | B897F4ACFAEFAF4D91DDDF2EC7EF87B181BC6B4300E98349BD480D7CD041EEB1 |
| SHA-512: | 777589601B9422FFADE17FD4EBE4F78104325B9945C1AA4E655BB5A45072B4585B2A71C6C1D886C512796B5B43AFB9BFF115B4719A7DE3F70BA6F1C0B6D5799E |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 150528 |
| Entropy (8bit): | 6.13074769209297 |
| Encrypted: | false |
| SSDEEP: | 3072:VoBZBqTW4YPY4k2d2Kl0A31GND1tPxO38bMoCp8MHa8xht:iBZBT4YPk2dRl0N4C0 |
| MD5: | 9DFF44BB59B69A941F4F2EBF190D8C4F |
| SHA1: | 132AEDCB8877F2453B15D95681EF9776B21EA127 |
| SHA-256: | E8387FACAEBA761831CBA4E71D9AA707C1279506841D96E6A5D173A963C9F529 |
| SHA-512: | 93EF6E80108CBE78F3A639F1599E17C2DFF57C4CF29FB932987147EE8B8F3EE0F67EF4FC71783F4862E8F49B7BE634C604B66D97756E13512A8D0414F7B6DF34 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 431616 |
| Entropy (8bit): | 3.9696692876160005 |
| Encrypted: | false |
| SSDEEP: | 3072:QSxePb5WB1FRuO/80GLRB5PBoBAFGx8geQEAZm/wP6DrAVikCE0:tbQMI88VASq6DrAVikC3 |
| MD5: | 938941E58BB51C7F48B6F8D60751C3E6 |
| SHA1: | 78564D708297912636DA34210AD38A78C0CDD053 |
| SHA-256: | 875178DAAB76E668A3575ABD9F9EAF78F9090F64A8672706BA8782ACEC19E74A |
| SHA-512: | C48FE2E092106DE05F3E5554A744510F8D2212AD7AE71A35FC5A3E50913CBCC4F35FA0ACE0291636BB56CE85B37D75517188E5A082EA348FF47C3ECFD1E7246F |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 163328 |
| Entropy (8bit): | 6.043390913497446 |
| Encrypted: | false |
| SSDEEP: | 3072:fiqduShJxyDiplKs6nFnwURob0p6H0ag:6GuskFlnhw0 |
| MD5: | 283AEF9F4ACEC76EB842FCE568BAE08C |
| SHA1: | 80D522A2FF37B56D109D367A049BBAD685C7665C |
| SHA-256: | DDC476C48F5A9A4BA1AC1FB222AB108DEDD6FCBFD39878E7B0C75B2623050B97 |
| SHA-512: | BCE8E084D33DB85FCA2AE5F6834EB1D5E99ECC68B838E60E11B1DAA0B362066CE8BD71D202BA6A1F869E6887C816CA30FED598A37D0F3D99AB6964F975657C2C |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 454144 |
| Entropy (8bit): | 3.896951628367518 |
| Encrypted: | false |
| SSDEEP: | 3072:+2F0ZdGBdQUqhQR8qHFMv0Ghmibk9UxHnjURlQAZ4lSUKVIQs4da/c:+2QdGBfXCqHa8z9UpnjU1Z4lQFda/c |
| MD5: | 791998C5E1CE2E4B25C1BB50E91D6998 |
| SHA1: | 24567636EEFDAC9616836B853CDB9CCBD780225C |
| SHA-256: | 9AFB677B6F8AAC880C905FBA3CAD4C0355113DF4FDEFF695688DF72D874610CD |
| SHA-512: | C29591556031745FBA9B6C19A7529CF156DF539858DFF9BE0FCFC0E5ABE3F74A85B15A90AAC44CAB666EE5FA3E29694AA2D2E1D89F1354F42911FFBC7138ADF2 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 31232 |
| Entropy (8bit): | 5.60559578012225 |
| Encrypted: | false |
| SSDEEP: | 384:SNo1OmR1fvh3sWcQ8v6M9bDiBlSeKk5znq+rtkSI3+M3rckKaj8Bazs3iLqim0o4:DZh3fcQCV8ce/zq+xXK+M3UgUim9qZ |
| MD5: | 3933006D8C9FCE74F7DE5357C97A69AA |
| SHA1: | C0BB904E223373F5452080E2551AC0CA0645A5F9 |
| SHA-256: | AFCE5B9C4C08332A2E17E7D9CF954938E8DCFD74588BC1FD0D24AB8E631A6238 |
| SHA-512: | 8C5B0D4471041BA059C59E4229E3A9E93E9990951D722E0FAE72086B64A849077555DEB73ABC4FA4D5F950C1FD722A22756EC3B068A0FB63AB2017C736325AAF |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 87552 |
| Entropy (8bit): | 3.432670271471145 |
| Encrypted: | false |
| SSDEEP: | 384:Z4ZZlSfAc/I8bpZmg2pQhE4KVt2h8KQ982BPD9nOOpsidNdSy5b22bCjApPPyQil:Z43lSLQUy9fsuNYyNpc3qISdPp8J7m |
| MD5: | 46CC175B6D46D615F144202EC9473A1B |
| SHA1: | 284EB1306FBEA0D073A70C5ED1557BC14D5FB307 |
| SHA-256: | 18C05244F7F29CBD2453FB8A005CD3E41826E28330E9684C0C5F705A479A46C3 |
| SHA-512: | B1AE6518B0A613234B055B91FC804BD6D613A1DBF25157A1E4C24C90BC9A2F93A0B67D0C43FF07240BA626F3695D88B0A17128B79198C4F70EFFB27DFDDC06C8 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 37260 |
| Entropy (8bit): | 4.45260822141674 |
| Encrypted: | false |
| SSDEEP: | 384:mr4Lel36KhH8qJu/7m6JpK4r6+IaihzMXFsfU2C9jUd+tGJG00NzNSM4/4WS7TCx:O+qHfnXnsYD13 |
| MD5: | 2DD128909AAD5A68B845C725A27F91EF |
| SHA1: | CBD0797745A8A565B914B8C0D9FC1089AD1EACA9 |
| SHA-256: | 2387E86F5FCCFE6ACFB224BBE0A4CBD87ABF48AFB67154B96792917FF88F0981 |
| SHA-512: | 016CB0199B25ECDA06E8C8B29AEDA8429E096E400D195E4AA461D0B8F997D38883A2F93911FA85600FE2BEEC6DC27D82DC129C32990DCF20B2DD2371A780BE19 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 55904 |
| Entropy (8bit): | 6.299047178318044 |
| Encrypted: | false |
| SSDEEP: | 1536:BYQaIZaEmaOQxn6JxKjtlMZAnuETAV+w4:aIhOQcSLAj4 |
| MD5: | 580244BC805220253A87196913EB3E5E |
| SHA1: | CE6C4C18CF638F980905B9CB6710EE1FA73BB397 |
| SHA-256: | 93FBC59E4880AFC9F136C3AC0976ADA7F3FAA7CACEDCE5C824B337CBCA9D2EBF |
| SHA-512: | 2666B594F13CE9DF2352D10A3D8836BF447EAF6A08DA528B027436BB4AFFAAD9CD5466B4337A3EAF7B41D3021016B53C5448C7A52C037708CAE9501DB89A73F0 |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1118920 |
| Entropy (8bit): | 7.899678401653382 |
| Encrypted: | false |
| SSDEEP: | 24576:Jz9m04PLdUcyezFSjaggwdRTw28Z4Qn+dwVY0YbxYRyUwuGqq:59m04DGexmLTQn+dwZYMyXd |
| MD5: | CA41DBA55A727F01104871B160CD5B1D |
| SHA1: | 5B71B20A455F6EEAB79DD1EDCAB0BA66AD0D2208 |
| SHA-256: | BD173D14A371E6786C4AE90BE1F2C560458D672BA4CBEB3CF55BEBFEF2E2778A |
| SHA-512: | 90A3A5A57EA8A6508EEE0D129303C7CB012AABF651DD9A6BEFC20DA3BBDB09FC47FD087645051D3D45BFF909DFC6E6039C22C4816FBC793A847E81701248639E |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 426848 |
| Entropy (8bit): | 5.944329543937919 |
| Encrypted: | false |
| SSDEEP: | 3072:20mbyiCo9bQjA4KRIQS6gdhAykm0g4E354n1bgk1CcKqLF2mHTmlxG6O:fmuiCo9bSfHF4nJJKkFAlxGH |
| MD5: | 2BDEC611319F5BB269337BCBFF6346DE |
| SHA1: | AF345CF69B5ABDAC4F336EC09CDD95CCB09C307D |
| SHA-256: | 7782FC7BA9AE6FED274B22EC75C517DE28B3EAE87ABE46B3E9D3410DB0F2B60A |
| SHA-512: | EB03B4DB161E2359C878BF0496796FC7638B96E2F123C547C2B3F7DEC755DD6787AEECDF068853E28AF918848A208C0BD031A625670D4908A75DC702FFFFBBEA |
| Malicious: | true |
| Antivirus: |
|
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 46136 |
| Entropy (8bit): | 7.472919026041486 |
| Encrypted: | false |
| SSDEEP: | 768:3TwkgqeQ0TwRYtvWelNa/BoVl9xsBOCw+cKip9a0L9LIM72mHgkD:BgzQKvtee77VlR+cKc9LF2mHfD |
| MD5: | 051CE1836FBEF0E2CAC7EF77CFD8A9F0 |
| SHA1: | A88C44182921345C8125EB2D2731507B1FC4334F |
| SHA-256: | A581BF78DB567A05B27991A9F9E4B18CC54F4E22CABC8376341F4EFC192D801C |
| SHA-512: | C1001DD2A2A5FE70AEA30CBB8433F350A336A8C13C95551C46344CB258446F5E52046485121928EBF6BEB87EA74481178BDDAFB0AD7100988210E707676FF1AB |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\Grid 3.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 126464 |
| Entropy (8bit): | 4.034806775846315 |
| Encrypted: | false |
| SSDEEP: | 768:JGueyqxF0cT9Xkuklr4aNArtZXHcvF0OnLf9D29KaNkcAsIFLwFkp0RQhCHu1U1N:5/xIOTpCQUHXoutigMK |
| MD5: | 2A369C7E6FF1F2B5B3E9D507D8A9DD29 |
| SHA1: | 84C5811252EA262094E5E52B1B08B3A51B2BCC5C |
| SHA-256: | BA075D2ADB867052513EC0A0963C6819CA6250AB82FEDFE77CF3F8F2A587DC1B |
| SHA-512: | 7FCA8E202268E97B5078910FE06385A31480BBF5BD7439F20404F3AC0BF92DDE36D774EFB0F7D523165632E55850F1939A410EB7D094D2B97792642E7A0D1AC8 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.099378870708456 |
| TrID: |
|
| File name: | Grid 3.exe |
| File size: | 18'771'680 bytes |
| MD5: | 06844e65a7a827a949c5e6a236a6c8de |
| SHA1: | d477de3fe8e271afbb8be7fd22bc2cbb54c6e6cd |
| SHA256: | dc7900304965f4d32aed8b701a884ff2549e40d7d869f4de3900c71f872be353 |
| SHA512: | 0a7c88601b40e9bb894fbeb8ad61b3a88dc996dc56a350119624084e34c82a5f975828a113b85ff722a8cec5ced4ff019bd5c80003b58416a7ae2b2cd3e84aa3 |
| SSDEEP: | 393216:dlMUa/hAoeZzUzZi7G5VyoozBiEuix0cxKLLs/w:vMEr2zDK3kEM4KLLs4 |
| TLSH: | 8017D0307286C676D8EA05B14CBEF75AE77DAA35072550C77294AE6C1C712C23B327A3 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............eo..eo..eo......eo...k..eo...l..eo...j..eo...k..eo...n..eo..en.Udo.s.l..eo.s.f..go.s.o..eo.s....eo.s.m..eo.Rich.eo........ |
 | |
| Icon Hash: | 3229b9626db1681c |
| Entrypoint: | 0x8db760 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x6491FD80 [Tue Jun 20 19:26:56 2023 UTC] |
| TLS Callbacks: | 0x8dad70, 0x8db410 |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 2f5964c100770a6753ead4074154a4f9 |
| Signature Valid: | true |
| Signature Issuer: | CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB |
| Signature Validation Error: | The operation completed successfully |
| Error Number: | 0 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | D14905A727F8B022A010C2D06FF946EB |
| Thumbprint SHA-1: | 962E92260341B77930B8C04623C898D9AC6B1437 |
| Thumbprint SHA-256: | 205BA276FED9B6C8FAEDC2ED2F8A3A3B08A6FD7C1CF540167627E9A06DE411DF |
| Serial: | 0091AABFC781EE5937451512A8D1743A43 |
| Instruction |
|---|
| call 00007F520462A2A6h |
| jmp 00007F5204629CBDh |
| push ebp |
| mov ebp, esp |
| sub esp, 00000324h |
| push ebx |
| push 00000017h |
| call dword ptr [00936310h] |
| test eax, eax |
| je 00007F5204629E57h |
| mov ecx, dword ptr [ebp+08h] |
| int 29h |
| push 00000003h |
| call 00007F5204629FFFh |
| mov dword ptr [esp], 000002CCh |
| lea eax, dword ptr [ebp-00000324h] |
| push 00000000h |
| push eax |
| call 00007F520462D014h |
| add esp, 0Ch |
| mov dword ptr [ebp-00000274h], eax |
| mov dword ptr [ebp-00000278h], ecx |
| mov dword ptr [ebp-0000027Ch], edx |
| mov dword ptr [ebp-00000280h], ebx |
| mov dword ptr [ebp-00000284h], esi |
| mov dword ptr [ebp-00000288h], edi |
| mov word ptr [ebp-0000025Ch], ss |
| mov word ptr [ebp-00000268h], cs |
| mov word ptr [ebp-0000028Ch], ds |
| mov word ptr [ebp-00000290h], es |
| mov word ptr [ebp-00000294h], fs |
| mov word ptr [ebp-00000298h], gs |
| pushfd |
| pop dword ptr [ebp-00000264h] |
| mov eax, dword ptr [ebp+04h] |
| mov dword ptr [ebp-0000026Ch], eax |
| lea eax, dword ptr [ebp+04h] |
| mov dword ptr [ebp-00000260h], eax |
| mov dword ptr [ebp-00000324h], 00010001h |
| mov eax, dword ptr [eax-04h] |
| push 00000050h |
| mov dword ptr [ebp-00000270h], eax |
| lea eax, dword ptr [ebp-58h] |
| push 00000000h |
| push eax |
| call 00007F5204629E8Ah |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x672510 | 0xc4 | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x6725d4 | 0x168 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x69a000 | 0x13c8a4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x11e4190 | 0x2d50 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x7d7000 | 0x4164c | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x604b08 | 0x54 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x604b80 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x53b9c0 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x536000 | 0x724 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x672408 | 0x60 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x533e9a | 0x534000 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .CLR_UEF | 0x535000 | 0x44 | 0x200 | False | 0.134765625 | data | 0.9617583915731932 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x536000 | 0x13ecd4 | 0x13ee00 | False | 0.3648844815758526 | data | 5.069983415775223 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x675000 | 0x12abc | 0x5400 | False | 0.2623697916666667 | Matlab v4 mat-file (little endian) \377\377\377\377, numeric, rows 0, columns 0 | 3.7060473110165457 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .didat | 0x688000 | 0x1c | 0x200 | False | 0.0546875 | data | 0.25996289920834015 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| _RDATA | 0x689000 | 0x10f10 | 0x11000 | False | 0.16291360294117646 | data | 5.364619170209927 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .rsrc | 0x69a000 | 0x13c8a4 | 0x13ca00 | False | 0.4193613057639163 | data | 6.449520375621085 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x7d7000 | 0x4164c | 0x41800 | False | 0.5932654460877863 | data | 6.67297548648758 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x69a2cc | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 192 | 0.5371621621621622 | ||
| RT_ICON | 0x69a3f4 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 640 | 0.33602150537634407 | ||
| RT_ICON | 0x69a6dc | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2688 | 0.332089552238806 | ||
| RT_ICON | 0x69b584 | 0x1e52 | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | 0.9545220304045349 | ||
| RT_ICON | 0x69d3d8 | 0x82d8 | PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced | 0.8195903988535944 | ||
| RT_RCDATA | 0x6a56b0 | 0x24 | data | 1.1944444444444444 | ||
| RT_RCDATA | 0x6a56d4 | 0x130ba8 | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | 0.41280174255371094 | ||
| RT_GROUP_ICON | 0x7d627c | 0x4c | data | 0.8157894736842105 | ||
| RT_VERSION | 0x7d62c8 | 0x3f0 | SysEx File - OctavePlateau | 0.3373015873015873 | ||
| RT_MANIFEST | 0x7d66b8 | 0x1ea | XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators | 0.5489795918367347 |
| DLL | Import |
|---|---|
| KERNEL32.dll | RaiseException, FreeLibrary, RaiseFailFastException, GetExitCodeProcess, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, AddVectoredExceptionHandler, MultiByteToWideChar, GetTickCount, GetCurrentProcessId, FlushInstructionCache, QueryPerformanceFrequency, QueryPerformanceCounter, InterlockedPushEntrySList, InterlockedFlushSList, InitializeSListHead, GetTickCount64, DuplicateHandle, QueueUserAPC, WaitForSingleObjectEx, SetThreadPriority, GetThreadPriority, ResumeThread, GetCurrentThreadId, TlsAlloc, GetCurrentThread, CreateThread, GetModuleHandleW, WaitForMultipleObjectsEx, SignalObjectAndWait, SetThreadStackGuarantee, VirtualQuery, WriteFile, GetStdHandle, GetConsoleOutputCP, MapViewOfFileEx, UnmapViewOfFile, GetStringTypeExW, SetEvent, GetCurrentProcessorNumber, GlobalMemoryStatusEx, CreateIoCompletionPort, PostQueuedCompletionStatus, GetQueuedCompletionStatus, InterlockedPopEntrySList, GetCurrentProcessorNumberEx, ExitProcess, Sleep, CreateMemoryResourceNotification, GetProcessAffinityMask, SetThreadIdealProcessorEx, GetThreadIdealProcessorEx, GetLargePageMinimum, VirtualUnlock, ResetWriteWatch, GetWriteWatch, GetLogicalProcessorInformation, SetThreadGroupAffinity, SetThreadAffinityMask, IsProcessInJob, QueryInformationJobObject, K32GetProcessMemoryInfo, VirtualAlloc, VirtualFree, VirtualProtect, SleepEx, SwitchToThread, CloseThreadpoolTimer, CreateThreadpoolTimer, SetThreadpoolTimer, ReadFile, GetFileSize, GetEnvironmentVariableW, SetEnvironmentVariableW, CreateEventW, ResetEvent, CreateSemaphoreExW, ReleaseSemaphore, CreateMutexW, ReleaseMutex, WaitForSingleObject, SuspendThread, SetThreadContext, GetEnabledXStateFeatures, InitializeContext, CopyContext, SetXStateFeaturesMask, WerRegisterRuntimeExceptionModule, GetSystemDefaultLCID, GetUserDefaultLCID, OutputDebugStringA, RtlUnwind, HeapAlloc, HeapFree, GetProcessHeap, HeapCreate, HeapDestroy, GetEnvironmentStringsW, FreeEnvironmentStringsW, FormatMessageW, GetACP, LCMapStringEx, LocalFree, VerSetConditionMask, VerifyVersionInfoW, IsWow64Process, QueryThreadCycleTime, VirtualAllocExNuma, GetNumaProcessorNodeEx, GetNumaHighestNodeNumber, GetSystemTimes, GetSystemTimeAsFileTime, GetModuleFileNameW, CreateProcessW, GetCPInfo, LoadLibraryExW, CreateFileW, GetFileAttributesExW, GetTempPathW, GetCurrentDirectoryW, GetFullPathNameW, LoadLibraryExA, OpenEventW, ExitThread, HeapReAlloc, CreateNamedPipeA, WaitForMultipleObjects, DisconnectNamedPipe, CreateFileA, CancelIoEx, GetOverlappedResult, ConnectNamedPipe, FlushFileBuffers, SetFilePointer, CreateFileMappingW, MapViewOfFile, GetActiveProcessorGroupCount, GetSystemTime, SetConsoleCtrlHandler, GetLocaleInfoEx, GetUserDefaultLocaleName, LoadLibraryW, CreateDirectoryW, RemoveDirectoryW, GetFileSizeEx, FindFirstFileExW, FindNextFileW, FindClose, LoadLibraryA, InitializeCriticalSectionAndSpinCount, CloseHandle, TlsSetValue, TlsGetValue, GetSystemInfo, GetCurrentProcess, ReadProcessMemory, OutputDebugStringW, IsDebuggerPresent, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetCommandLineW, GetProcAddress, GetModuleHandleExW, SetErrorMode, FlushProcessWriteBuffers, SetLastError, DebugBreak, GetLastError, GetThreadContext, WideCharToMultiByte, DecodePointer, InitializeCriticalSectionEx, IsProcessorFeaturePresent, EncodePointer, TlsFree, InitializeConditionVariable, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableSRW, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, GetExitCodeThread, GetStringTypeW, CreateFileMappingA |
| ADVAPI32.dll | RegGetValueW, SetKernelObjectSecurity, GetSidSubAuthorityCount, GetSidSubAuthority, GetTokenInformation, DeregisterEventSource, ReportEventW, RegisterEventSourceW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, EventRegister, AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValueW, SetThreadToken, RevertToSelf, OpenThreadToken, EventWriteTransfer, EventWrite |
| ole32.dll | CoTaskMemAlloc, CoTaskMemFree, CoWaitForMultipleHandles, IIDFromString, CLSIDFromProgID, CoGetMarshalSizeMax, CoCreateGuid, CoUnmarshalInterface, CoGetObjectContext, CoGetContextToken, CoGetClassObject, CoCreateFreeThreadedMarshaler, CreateStreamOnHGlobal, CoUninitialize, CoInitializeEx, CoMarshalInterface, CoRegisterInitializeSpy, CoRevokeInitializeSpy, CoReleaseMarshalData, StringFromGUID2 |
| OLEAUT32.dll | SafeArrayAllocDescriptorEx, GetRecordInfoFromTypeInfo, SafeArraySetRecordInfo, SafeArrayAllocData, SafeArrayGetElemsize, VarCyFromDec, SysAllocStringByteLen, SafeArrayCreateVector, SafeArrayPutElement, LoadRegTypeLib, CreateErrorInfo, SysStringByteLen, SysFreeString, GetErrorInfo, VariantInit, SetErrorInfo, VariantClear, VariantChangeTypeEx, VariantChangeType, SafeArrayGetVartype, LoadTypeLibEx, QueryPathOfRegTypeLib, SafeArrayDestroy, SafeArrayGetLBound, SafeArrayGetDim, SysAllocStringLen, SysAllocString, SysStringLen |
| USER32.dll | LoadStringW, MessageBoxW |
| SHELL32.dll | ShellExecuteW |
| api-ms-win-crt-string-l1-1-0.dll | strcmp, iswupper, towlower, isalpha, isdigit, wcstok_s, strnlen, _wcsnicmp, iswascii, towupper, wcscat_s, strlen, wcscpy_s, wcsncat_s, strncat_s, iswspace, wcsncpy_s, strcspn, _wcsicmp, strcpy_s, isupper, strcat_s, strncpy_s, _wcsdup, _strnicmp, strncmp, islower, toupper, strtok_s, isspace, _strdup, __strncnt, _stricmp, wcsnlen, tolower, wcsncmp |
| api-ms-win-crt-stdio-l1-1-0.dll | fclose, _wfopen, _flushall, fseek, __stdio_common_vswprintf, __stdio_common_vfwprintf, __p__commode, fgets, _set_fmode, fputws, fputwc, __stdio_common_vsscanf, _get_stream_buffer_pointers, ftell, _fseeki64, fread, fsetpos, ungetc, _fileno, _dup, fgetpos, _setmode, setvbuf, _wfsopen, __stdio_common_vfprintf, fopen, fwrite, __stdio_common_vsnwprintf_s, __stdio_common_vsprintf_s, fgetc, __acrt_iob_func, fflush, fputs, fputc, __stdio_common_vsnprintf_s |
| api-ms-win-crt-runtime-l1-1-0.dll | terminate, _errno, _beginthreadex, _invalid_parameter_noinfo_noreturn, _controlfp_s, _invalid_parameter_noinfo, _register_thread_local_exe_atexit_callback, _c_exit, __p___wargv, __p___argc, abort, exit, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, _wcserror_s, _configure_wide_argv, _initialize_wide_environment, _get_initial_wide_environment, _initterm, _initterm_e, _exit |
| api-ms-win-crt-convert-l1-1-0.dll | atol, strtoull, atoi, _itow_s, _wtoi, _ltow_s, wcstoul, strtoul, _wcstoui64 |
| api-ms-win-crt-heap-l1-1-0.dll | free, realloc, calloc, malloc, _set_new_mode |
| api-ms-win-crt-utility-l1-1-0.dll | qsort |
| api-ms-win-crt-math-l1-1-0.dll | __libm_sse2_asin, __libm_sse2_acos, _CItanh, _CIsinh, _CIfmod, _CIcosh, _CIatan2, __libm_sse2_atan2, __libm_sse2_cos, log2, atanh, acosh, cbrt, __libm_sse2_exp, asinhf, atanhf, cbrtf, acoshf, log2f, ceil, floor, __libm_sse2_log, _isnan, __libm_sse2_log10, __libm_sse2_pow, __libm_sse2_sin, __libm_sse2_tan, _fdopen, _libm_sse2_acos_precise, _libm_sse2_asin_precise, trunc, truncf, ilogb, ilogbf, _finite, _libm_sse2_atan_precise, _libm_sse2_cos_precise, _copysign, modf, _libm_sse2_tan_precise, frexp, _libm_sse2_exp_precise, _libm_sse2_log10_precise, __libm_sse2_atan, fma, _libm_sse2_log_precise, _libm_sse2_sqrt_precise, _libm_sse2_sin_precise, asinh, fmaf, _libm_sse2_pow_precise, __setusermatherr |
| api-ms-win-crt-time-l1-1-0.dll | wcsftime, _gmtime64_s, _time64 |
| api-ms-win-crt-environment-l1-1-0.dll | getenv |
| api-ms-win-crt-locale-l1-1-0.dll | _configthreadlocale, _unlock_locales, __pctype_func, ___lc_locale_name_func, ___lc_codepage_func, ___mb_cur_max_func, _lock_locales, localeconv, setlocale |
| api-ms-win-crt-filesystem-l1-1-0.dll | _lock_file, _unlock_file, _wremove, _wrename |
| Name | Ordinal | Address |
|---|---|---|
| CLRJitAttachState | 3 | 0xa80d34 |
| DotNetRuntimeInfo | 4 | 0xa76540 |
| MetaDataGetDispenser | 5 | 0x88bfa0 |
| g_CLREngineMetrics | 2 | 0xa75f64 |
| g_dacTable | 6 | 0x94e7b0 |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 10:20:04 |
| Start date: | 05/10/2023 |
| Path: | C:\Users\user\Desktop\Grid 3.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x410000 |
| File size: | 18'771'680 bytes |
| MD5 hash: | 06844E65A7A827A949C5E6A236A6C8DE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 10:20:06 |
| Start date: | 05/10/2023 |
| Path: | C:\Users\user\AppData\Local\Temp\Smartbox Update\ssUpdate.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x18d209b0000 |
| File size: | 426'848 bytes |
| MD5 hash: | 2BDEC611319F5BB269337BCBFF6346DE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | .Net C# or VB.NET |
| Antivirus matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
Execution Coverage
Dynamic/Packed Code Coverage
Signature Coverage
| Execution Coverage: | 5.1% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 0% |
| Total number of Nodes: | 82 |
| Total number of Limit Nodes: | 4 |
Graph
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
