Create Interactive Tour

Windows Analysis Report
lnstaller_2024.008.20535_win64_86.exe

Overview

General Information

Sample name:	lnstaller_2024.008.20535_win64_86.exe
Analysis ID:	1413381
MD5:	a0543af2a8b551d1bf5b89ddedae4180
SHA1:	3c89b4550bbd1f85c8080cbebabfd9f16c6fa836
SHA256:	9419b1e9fa5741f629f61094811a4936beb2acd76bbad083ec75c7e50de9b02b
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Installs new ROOT certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Tries to load missing DLLs

Uses 32bit PE files

Classification

Process Tree

System is w7x64

lnstaller_2024.008.20535_win64_86.exe (PID: 172 cmdline: "C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe" MD5: A0543AF2A8B551D1BF5B89DDEDAE4180)

cleanup

Sigma Signatures

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe, ProcessId: 172, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: lnstaller_2024.008.20535_win64_86.exe

ReversingLabs: Detection: 29%

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.166.193.143:443 -> 192.168.2.22:49168 version: TLS 1.2

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: www.legal-tools.org

Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://192.168.1.1
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://desktop.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://desktop.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://desktop.ssuiteoffice.comBhttps://homepage.ssuiteoffice.com
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://dune.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://dune.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://grabby.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://grabby.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://groot.ssuiteoffice.com/#gsc.tab=0&gsc.sort=&gsc.q=U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://groot.ssuiteoffice.com6https://tv.ssuiteoffice.com6https://www.majorgeeks.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://homepage.ssuiteoffice.com/wallpaper/dark/D59.jpg
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://office.ssuiteoffice.com
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://office.ssuiteoffice.com/SSuite-Unit-Conversions.html
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://office.ssuiteoffice.com/SSuite-Unit-Conversions.htmlU
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://opmmarket.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://opmmarket.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://ps.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://ps.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://spartan.ssuiteoffice.com
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://spartan.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://spartan.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://speed.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://speed.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://todo.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://todo.ssuiteoffice.com/U
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.domain.com
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.legal-tools.org/
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.legal-tools.org/4
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.legal-tools.org/tutorials
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/&NetSurferUpdate.txt
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGames
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGamesU
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/categories/webapps.htmU
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/donate.htm
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/freedownloads.htm
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/images/screenshots/MediaPlayerBackground.jpg
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.com/interlude.htmlU
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: https://www.ssuiteoffice.comU

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443

Source: unknown

HTTPS traffic detected: 188.166.193.143:443 -> 192.168.2.22:49168 version: TLS 1.2

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe

Memory allocated: 770B0000 page execute and read and write

Jump to behavior

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: invalid certificate

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: Number of sections : 12 > 10

Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000000.336110497.0000000000961000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNetSurfer - Galaxy ClassP vs lnstaller_2024.008.20535_win64_86.exe
Source: lnstaller_2024.008.20535_win64_86.exe	Binary or memory string: OriginalFilenameNetSurfer - Galaxy ClassP vs lnstaller_2024.008.20535_win64_86.exe

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Section loaded: gpapi.dll	Jump to behavior

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: lnstaller_2024.008.20535_win64_86.exe

ReversingLabs: Detection: 29%

Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: application/vnd.groove-help
Source: lnstaller_2024.008.20535_win64_86.exe	String found in binary or memory: "application/x-install-instructions

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: lnstaller_2024.008.20535_win64_86.exe

Static file information: File size 20215710 > 1048576

Source: lnstaller_2024.008.20535_win64_86.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x39ee00
Source: lnstaller_2024.008.20535_win64_86.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x199000
Source: lnstaller_2024.008.20535_win64_86.exe	Static PE information: Raw size of .debug is bigger than: 0x100000 < 0xdac3ee

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: More than 200 imports for user32.dll

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lnstaller_2024.008.20535_win64_86.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: lnstaller_2024.008.20535_win64_86.exe	Static PE information: section name: .didata
Source: lnstaller_2024.008.20535_win64_86.exe	Static PE information: section name: .debug

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe TID: 1424

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000000.336110497.0000000001361000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @Idassignednumbers@IdPORT_vmnet
Source: lnstaller_2024.008.20535_win64_86.exe, 00000000.00000000.336110497.0000000001361000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: @Idassignednumbers@IdPORT_vmnet$@Idassignednumbers@IdPORT_genrad_mux

Source: lnstaller_2024.008.20535_win64_86.exe

Binary or memory string: @Winapi@Windows@DOF_PROGMAN

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Modify Registry	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lnstaller_2024.008.20535_win64_86.exe	29%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
https://www.ssuiteoffice.com/donate.htm	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.comU	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/images/screenshots/MediaPlayerBackground.jpg	0%	Avira URL Cloud	safe
https://desktop.ssuiteoffice.comBhttps://homepage.ssuiteoffice.com	0%	Avira URL Cloud	safe
https://www.legal-tools.org/4	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/&NetSurferUpdate.txt	0%	Avira URL Cloud	safe
https://groot.ssuiteoffice.com6https://tv.ssuiteoffice.com6https://www.majorgeeks.com/U	0%	Avira URL Cloud	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://www.ssuiteoffice.com/freedownloads.htm	0%	Avira URL Cloud	safe
https://todo.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://192.168.1.1	0%	Avira URL Cloud	safe
https://www.legal-tools.org/tutorials	0%	Avira URL Cloud	safe
https://todo.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGamesU	0%	Avira URL Cloud	safe
https://speed.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://opmmarket.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://desktop.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/interlude.htmlU	0%	Avira URL Cloud	safe
https://ps.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://grabby.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://homepage.ssuiteoffice.com/wallpaper/dark/D59.jpg	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/categories/webapps.htmU	0%	Avira URL Cloud	safe
https://dune.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://groot.ssuiteoffice.com/#gsc.tab=0&gsc.sort=&gsc.q=U	0%	Avira URL Cloud	safe
https://spartan.ssuiteoffice.com	0%	Avira URL Cloud	safe
https://desktop.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://grabby.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://spartan.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://office.ssuiteoffice.com	0%	Avira URL Cloud	safe
https://speed.ssuiteoffice.com/U	0%	Avira URL Cloud	safe
https://www.legal-tools.org/	0%	Avira URL Cloud	safe
https://dune.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://spartan.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://office.ssuiteoffice.com/SSuite-Unit-Conversions.html	0%	Avira URL Cloud	safe
https://office.ssuiteoffice.com/SSuite-Unit-Conversions.htmlU	0%	Avira URL Cloud	safe
https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGames	0%	Avira URL Cloud	safe
https://opmmarket.ssuiteoffice.com/	0%	Avira URL Cloud	safe
https://ps.ssuiteoffice.com/U	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.legal-tools.org	188.166.193.143	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ssuiteoffice.com/images/screenshots/MediaPlayerBackground.jpg	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.comU	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://groot.ssuiteoffice.com6https://tv.ssuiteoffice.com6https://www.majorgeeks.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://todo.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.legal-tools.org/4	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ssuiteoffice.com/donate.htm	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://desktop.ssuiteoffice.comBhttps://homepage.ssuiteoffice.com	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/&NetSurferUpdate.txt	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/freedownloads.htm	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://192.168.1.1	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.legal-tools.org/tutorials	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://todo.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGamesU	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://opmmarket.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://ps.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://speed.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/interlude.htmlU	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.domain.com	lnstaller_2024.008.20535_win64_86.exe	false		high
http://www.diginotar.nl/cps/pkioverheid0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://desktop.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://grabby.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://homepage.ssuiteoffice.com/wallpaper/dark/D59.jpg	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://dune.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/categories/webapps.htmU	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://groot.ssuiteoffice.com/#gsc.tab=0&gsc.sort=&gsc.q=U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://spartan.ssuiteoffice.com	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://desktop.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://grabby.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://office.ssuiteoffice.com	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://spartan.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://dune.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://speed.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.legal-tools.org/	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spartan.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://office.ssuiteoffice.com/SSuite-Unit-Conversions.htmlU	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://www.ssuiteoffice.com/categories/webapps.htm#OnlineGames	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	lnstaller_2024.008.20535_win64_86.exe, 00000000.00000002.466482316.0000000001C74000.00000004.00000020.00020000.00000000.sdmp	false		high
https://office.ssuiteoffice.com/SSuite-Unit-Conversions.html	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://opmmarket.ssuiteoffice.com/	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown
https://ps.ssuiteoffice.com/U	lnstaller_2024.008.20535_win64_86.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.166.193.143	www.legal-tools.org	Netherlands		14061	DIGITALOCEAN-ASNUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1413381
Start date and time:	2024-03-21 18:10:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lnstaller_2024.008.20535_win64_86.exe
Detection:	MAL
Classification:	mal52.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 23.221.227.5, 23.221.227.15, 23.221.227.47, 23.221.227.17, 23.221.227.4, 23.221.227.21, 23.221.227.54, 23.221.227.7, 23.221.227.20, 104.102.251.17, 104.102.251.89, 104.102.251.73
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lnstaller_2024.008.20535_win64_86.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	http://pay8-2v-9jkc4ukd3-ekontetevi-gmailcom.vercel.app	Get hash	malicious	Unknown	Browse	164.90.175.140
	GZ54fm8Mu4.xlsx	Get hash	malicious	Unknown	Browse	165.22.16.55
	GZ54fm8Mu4.xlsx	Get hash	malicious	Unknown	Browse	165.22.16.55
	http://pay8-2v-9jkc4ukd3-ekontetevi-gmailcom.vercel.app	Get hash	malicious	Unknown	Browse	167.172.7.42
	http://162.243.131.16	Get hash	malicious	Unknown	Browse	162.243.131.16
	http://ipfs.io	Get hash	malicious	Unknown	Browse	134.122.57.34
	LmRWdFDFaQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	139.59.86.203
	http://mayanboats.com	Get hash	malicious	Unknown	Browse	159.89.102.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.3157.15146.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	PAYMENT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	188.166.193.143
	RFQ-000753.xla.xlsx	Get hash	malicious	Unknown	Browse	188.166.193.143
	GafRMV7H8l.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	f4ASbdi1FU.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	hOsJhFwrA8.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	vabSc00Ygm.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	EExwBdsFBP.rtf	Get hash	malicious	Unknown	Browse	188.166.193.143
	Excel.xlsx	Get hash	malicious	Unknown	Browse	188.166.193.143

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.916559601535338
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	lnstaller_2024.008.20535_win64_86.exe
File size:	20'215'710 bytes
MD5:	a0543af2a8b551d1bf5b89ddedae4180
SHA1:	3c89b4550bbd1f85c8080cbebabfd9f16c6fa836
SHA256:	9419b1e9fa5741f629f61094811a4936beb2acd76bbad083ec75c7e50de9b02b
SHA512:	ff8c002a324f14aac9fd8ce4021ce02fa774d26d076f836b3df7bb64429d88055e0430629da14e9895df39c88aae6b0f4d359805cf020e3df5b8209ee377ccfe
SSDEEP:	196608:IXMYdiaMf2tRdH0isC0gwQwAuvs649P9D26sTA:Uxlc2tRyiGgwQfuvs1pgRM
TLSH:	3E173A22F2509A36C0DE4B3A849F47115335411A4F97A78701E8DABDFD8E2912FBA74F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	f8d8c8e4a2fce871

Static PE Info

General

Entrypoint:	0x7a27b0
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65E2DA33 [Sat Mar 2 07:50:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	04b8ec0741a79333f092fa313b872402

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Certum Code Signing CA SHA2, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	8/10/2016 10:47:26 PM 8/10/2017 9:43:06 AM
Subject Chain	E=getgreenshot@gmail.com, CN="Open Source Developer, Robin Krom", O=Open Source Developer, C=DE
Version:	3
Thumbprint MD5:	3D0B23C0158F240A7C77494C92869594
Thumbprint SHA-1:	6DFA88FEDBA957855DB938B38082378F14C7CCCC
Thumbprint SHA-256:	BFE1095F804D8A46A8ED956556837C75AF33CA42A843C7F4F660BEAA10AF26EA
Serial:	66C5DCC14B517809C172B44B7E9784F7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00795A50h
call 00007F07609A9BE9h
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
call 00007F0760BA9981h
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007F0760BAB963h
mov ecx, dword ptr [007ADEACh]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0078EB78h]
call 00007F0760BA9973h
mov ecx, dword ptr [007ADB14h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00760930h]
call 00007F0760BA995Bh
mov ecx, dword ptr [007AE224h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00779714h]
call 00007F0760BA9943h
mov ecx, dword ptr [007ADF78h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00777D94h]
call 00007F0760BA992Bh
mov ecx, dword ptr [007AE414h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [007753ACh]
call 00007F0760BA9913h
mov ecx, dword ptr [007AE568h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00774568h]
call 00007F0760BA98FBh
mov ecx, dword ptr [007ADE24h]
mov eax, dword ptr [007AE190h]
mov eax, dword ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3bc000	0x72	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b7000	0x39c0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40d000	0x199000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x13449ee	0x2db0	.debug
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3bf000	0x4d33c
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a6000	0x1	.debug
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3be000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b7a2c	0x8d8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3bb000	0xf02	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x39ec38	0x39ee00	0828ebe9d9378194a2fe0bf6fcc6ae96	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x3a0000	0x28dc	0x2a00	944260412ce500865d2600dc6b88782d	False	0.5331101190476191	data	6.28014145817746	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3a3000	0xb63c	0xb800	1f535b9dc088770ce7183e129e6cbb3e	False	0.5688264266304348	data	6.124742883932662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x3af000	0x7430	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3b7000	0x39c0	0x3a00	b9f7f15ce05f410c4fd15eead66c8430	False	0.32947198275862066	data	5.264262401333611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x3bb000	0xf02	0x1000	45fb5d9464ff21bdae7500464d4c2372	False	0.33544921875	data	4.28512245038203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x3bc000	0x72	0x200	b74d6143ec210dab71ee1cba80c6574a	False	0.181640625	data	1.352757698444735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x3bd000	0x5c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3be000	0x5d	0x200	97492c6a8152f8f28421d3522ff5d319	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3bf000	0x4d2ec	0x4d400	46157e18d75436c8476f419e2ad1bdc0	False	0.5693770226537217	data	6.718850883622972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x40d000	0x199000	0x199000	8747050ae801c1b7822464fb92b904b9	False	0.5800852880501223	data	6.779160208313254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.debug	0x5a6000	0xdac3ee	0xdac3ee	ab7875a110092885dd8a4aaad682ae9e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x40eb7c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x40ecb0	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x40ede4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x40ef18	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x40f04c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x40f180	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x40f2b4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x40f3e8	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x40f4a8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x40f588	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x40f668	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x40f748	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x40f808	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x40f8c8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x40f9a8	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x40fa68	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x40fb48	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x40fc08	0x98	Device independent bitmap graphic, 9 x 6 x 4, image size 48, 16 important colors	English	United States	0.5197368421052632
RT_BITMAP	0x40fca0	0x98	Device independent bitmap graphic, 9 x 6 x 4, image size 48, 16 important colors	English	United States	0.506578947368421
RT_BITMAP	0x40fd38	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_ICON	0x40fe18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7854609929078015
RT_ICON	0x410280	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.7192622950819673
RT_ICON	0x410c08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6890243902439024
RT_ICON	0x411cb0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6573651452282158
RT_ICON	0x414258	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.6388167217760983
RT_ICON	0x418480	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.6061856211898256
RT_ICON	0x421928	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.5782710280373832
RT_ICON	0x432150	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.5177197680267479
RT_ICON	0x474178	0x5ed81	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	1.0000823721108625
RT_STRING	0x4d2efc	0x144	data			0.5370370370370371
RT_STRING	0x4d3040	0x32c	data			0.4211822660098522
RT_STRING	0x4d336c	0x394	data			0.35262008733624456
RT_STRING	0x4d3700	0x324	data			0.4166666666666667
RT_STRING	0x4d3a24	0x414	data			0.3390804597701149
RT_STRING	0x4d3e38	0x418	data			0.38072519083969464
RT_STRING	0x4d4250	0x304	data			0.43134715025906734
RT_STRING	0x4d4554	0x3b8	data			0.38130252100840334
RT_STRING	0x4d490c	0x41c	data			0.3897338403041825
RT_STRING	0x4d4d28	0x52c	data			0.39652567975830816
RT_STRING	0x4d5254	0xab8	data			0.25911078717201164
RT_STRING	0x4d5d0c	0x96c	data			0.2657545605306799
RT_STRING	0x4d6678	0x454	data			0.33574007220216606
RT_STRING	0x4d6acc	0x308	data			0.43170103092783507
RT_STRING	0x4d6dd4	0x470	data			0.3899647887323944
RT_STRING	0x4d7244	0xa0	data			0.7
RT_STRING	0x4d72e4	0xe0	data			0.6473214285714286
RT_STRING	0x4d73c4	0x2bc	data			0.4342857142857143
RT_STRING	0x4d7680	0x2b4	data			0.46965317919075145
RT_STRING	0x4d7934	0x3ac	data			0.3840425531914894
RT_STRING	0x4d7ce0	0x3e0	data			0.3810483870967742
RT_STRING	0x4d80c0	0x46c	data			0.3621908127208481
RT_STRING	0x4d852c	0x4e4	data			0.31869009584664537
RT_STRING	0x4d8a10	0x21c	data			0.26296296296296295
RT_STRING	0x4d8c2c	0x468	data			0.4175531914893617
RT_STRING	0x4d9094	0x474	data			0.35175438596491226
RT_STRING	0x4d9508	0x4b4	data			0.3803986710963455
RT_STRING	0x4d99bc	0x47c	data			0.34146341463414637
RT_STRING	0x4d9e38	0x3e4	data			0.38052208835341367
RT_STRING	0x4da21c	0x400	data			0.3623046875
RT_STRING	0x4da61c	0x34c	data			0.37796208530805686
RT_STRING	0x4da968	0xd4	data			0.5283018867924528
RT_STRING	0x4daa3c	0xa4	data			0.6524390243902439
RT_STRING	0x4daae0	0x2dc	data			0.4685792349726776
RT_STRING	0x4dadbc	0x43c	data			0.31273062730627305
RT_STRING	0x4db1f8	0x328	data			0.43316831683168316
RT_STRING	0x4db520	0x2f0	data			0.3776595744680851
RT_STRING	0x4db810	0x368	data			0.29243119266055045
RT_RCDATA	0x4dbb78	0xd5d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032154340836013
RT_RCDATA	0x4dc8d8	0xd57	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003221083455344
RT_RCDATA	0x4dd630	0xcfc	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003309265944645
RT_RCDATA	0x4de32c	0xcd9	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033444816053512
RT_RCDATA	0x4df008	0xd5d	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032154340836013
RT_RCDATA	0x4dfd68	0xd57	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003221083455344
RT_RCDATA	0x4e0ac0	0xc4e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0034920634920634
RT_RCDATA	0x4e1710	0xc4e	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0034920634920634
RT_RCDATA	0x4e2360	0xcb5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033814940055334
RT_RCDATA	0x4e3018	0xcb0	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033866995073892
RT_RCDATA	0x4e3cc8	0xd56	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032220269478618
RT_RCDATA	0x4e4a20	0xd47	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0032362459546926
RT_RCDATA	0x4e5768	0xdc2	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031232254400908
RT_RCDATA	0x4e652c	0xdc5	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031205673758865
RT_RCDATA	0x4e72f4	0xcf3	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003318250377074
RT_RCDATA	0x4e7fe8	0xced	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033242671501965
RT_RCDATA	0x4e8cd8	0xda9	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031455533314269
RT_RCDATA	0x4e9a84	0xda6	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0031482541499714
RT_RCDATA	0x4ea82c	0xcf3	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.003318250377074
RT_RCDATA	0x4eb520	0xced	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0033242671501965
RT_RCDATA	0x4ec210	0x10	data			1.5
RT_RCDATA	0x4ec220	0x148b	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0020916524054002
RT_RCDATA	0x4ed6ac	0x111e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0025102692834322
RT_RCDATA	0x4ee7cc	0xd8c	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0031718569780854
RT_RCDATA	0x4ef558	0xf28	data			0.4814432989690722
RT_RCDATA	0x4f0480	0x2	data	English	United States	5.0
RT_RCDATA	0x4f0484	0x274	Delphi compiled form 'TChildForm'			0.6321656050955414
RT_RCDATA	0x4f06f8	0x71b36	Delphi compiled form 'TFrameChild'			0.39567935961246936
RT_RCDATA	0x562230	0xcdcc	Delphi compiled form 'TfrmAbout'			0.953287525624478
RT_RCDATA	0x56effc	0x4e5b	Delphi compiled form 'TfrmAdBlocker'			0.5574056533226981
RT_RCDATA	0x573e58	0x17e3	Delphi compiled form 'TfrmAddMediaLink'			0.685363859362224
RT_RCDATA	0x57563c	0x17f1	Delphi compiled form 'TfrmAddURL'			0.684287812041116
RT_RCDATA	0x576e30	0x17e1	Delphi compiled form 'TfrmAddWLURL'			0.6832978897431703
RT_RCDATA	0x578614	0x1d4c	Delphi compiled form 'TfrmDeleteBrowserHistory'			0.5817333333333333
RT_RCDATA	0x57a360	0x195a	Delphi compiled form 'TfrmDeleteDomainData'			0.6496147919876734
RT_RCDATA	0x57bcbc	0x86b3	Delphi compiled form 'TfrmMediaPlayer'			0.525244323289737
RT_RCDATA	0x584370	0x1d6f7	Delphi compiled form 'TfrmParent'			0.43129546227408827
RT_RCDATA	0x5a1a68	0x33be	Delphi compiled form 'TfrmSettings'			0.37211233579948666
RT_RCDATA	0x5a4e28	0x565	Delphi compiled form 'TTBasicUserAuthForm'			0.49022447501810285
RT_GROUP_CURSOR	0x5a5390	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x5a53a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x5a53b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5a53cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5a53e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5a53f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x5a5408	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x5a541c	0x84	data	English	United States	0.7045454545454546
RT_VERSION	0x5a54a0	0x42c	data	English	United States	0.4297752808988764
RT_MANIFEST	0x5a58cc	0x70b	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.403771491957848

Imports

DLL	Import
winmm.dll	timeGetTime
wininet.dll	InternetGetConnectedState
winspool.drv	DocumentPropertiesW, ClosePrinter, OpenPrinterW, GetDefaultPrinterW, EnumPrintersW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	ImageList_GetImageInfo, FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, ImageList_Copy, FlatSB_GetScrollInfo, ImageList_Write, ImageList_DrawIndirect, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Replace, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_LoadImageW, ImageList_Draw, ImageList_Remove, ImageList_ReplaceIcon, ImageList_SetOverlayImage
shell32.dll	Shell_NotifyIconW, SHAppBarMessage, ShellExecuteW
user32.dll	MoveWindow, CopyImage, SetMenuItemInfoW, GetMenuItemInfoW, SetCaretPos, GetCaretPos, DefFrameProcW, ScrollWindowEx, GetDlgCtrlID, FrameRect, RegisterWindowMessageW, GetMenuStringW, FillRect, SendMessageA, IsClipboardFormatAvailable, EnumWindows, ShowOwnedPopups, GetClassInfoW, GetScrollRange, SetActiveWindow, GetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, EnumChildWindows, GetScrollBarInfo, UnhookWindowsHookEx, SetCapture, GetCapture, ShowCaret, CreatePopupMenu, GetMenuItemID, DestroyCaret, CharLowerBuffW, PostMessageW, SetWindowLongW, IsZoomed, SetParent, DrawMenuBar, GetClientRect, IsChild, IsIconic, CallNextHookEx, ShowWindow, GetWindowTextW, SetForegroundWindow, IsDialogMessageW, DestroyWindow, RegisterClassW, EndMenu, CharNextW, GetFocus, GetDC, SetFocus, ReleaseDC, GetClassLongW, SetScrollRange, DrawTextW, PeekMessageA, MessageBeep, SetClassLongW, RemovePropW, GetSubMenu, DestroyIcon, IsWindowVisible, PtInRect, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, GetMessageTime, LoadStringW, CreateMenu, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, GetSysColorBrush, GetWindowDC, DrawTextExW, EnumClipboardFormats, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, GetSysColor, EnableScrollBar, TrackPopupMenu, keybd_event, DrawIconEx, GetClassNameW, GetMessagePos, GetIconInfo, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, SetCursorPos, GetCursorPos, SetMenu, GetMenuState, GetMenu, SetRect, GetKeyState, ValidateRect, IsCharAlphaW, GetCursor, KillTimer, BeginDeferWindowPos, WaitMessage, TranslateMDISysAccel, GetWindowPlacement, CreateIconIndirect, CreateWindowExW, GetDCEx, PeekMessageW, MonitorFromWindow, GetUpdateRect, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, MapVirtualKeyW, OffsetRect, IsWindowUnicode, DispatchMessageW, CreateAcceleratorTableW, DefMDIChildProcW, GetSystemMenu, SetScrollPos, GetScrollPos, InflateRect, DrawFocusRect, ReleaseCapture, LoadCursorW, ScrollWindow, GetLastActivePopup, GetSystemMetrics, CharUpperBuffW, ClientToScreen, SetClipboardData, GetClipboardData, SetWindowPlacement, GetMonitorInfoW, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, EnableWindow, GetWindowThreadProcessId, RedrawWindow, EndPaint, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, ActivateKeyboardLayout, GetParent, CreateCaret, MonitorFromRect, InsertMenuItemW, GetPropW, MessageBoxW, SetPropW, UpdateWindow, MsgWaitForMultipleObjects, DestroyMenu, SetWindowsHookExW, GetDoubleClickTime, EmptyClipboard, GetDlgItem, AdjustWindowRectEx, IsWindow, DrawIcon, EnumThreadWindows, InvalidateRect, SetKeyboardState, GetKeyboardState, ScreenToClient, DrawFrameControl, IsCharAlphaNumericW, SetCursor, CreateIcon, RemoveMenu, GetKeyboardLayoutNameW, OpenClipboard, TranslateMessage, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, CountClipboardFormats, CloseClipboard, DestroyCursor, CopyIcon, PostQuitMessage, ShowScrollBar, EnableMenuItem, DeferWindowPos, HideCaret, EndDeferWindowPos, FindWindowExW, MonitorFromPoint, LoadIconW, SystemParametersInfoW, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, IsWindowEnabled, IsDialogMessageA, FindWindowW, GetKeyboardLayout, DeleteMenu
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SysFreeString, VariantClear, VariantInit, GetErrorInfo, SysReAllocStringLen, SafeArrayCreate, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, VariantChangeType
advapi32.dll	RegSetValueExW, RegConnectRegistryW, RegEnumKeyExW, RegLoadKeyW, RegDeleteKeyW, RegOpenKeyExW, RegQueryInfoKeyW, RegUnLoadKeyW, RegSaveKeyW, RegDeleteValueW, RegReplaceKeyW, RegFlushKey, RegQueryValueExW, RegEnumValueW, RegCloseKey, RegCreateKeyExW, RegRestoreKeyW
msvcrt.dll	memcpy, memset
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	GetACP, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, GetFullPathNameW, VirtualFree, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, GlobalSize, RtlUnwind, GetCPInfo, EnumSystemLocalesW, GetStdHandle, GetTimeZoneInformation, GetModuleHandleW, FreeLibrary, TryEnterCriticalSection, HeapDestroy, ReadFile, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetVersion, RaiseException, GlobalAddAtomW, FormatMessageW, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, LoadLibraryExW, SetPriorityClass, LockResource, FileTimeToSystemTime, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, GlobalFindAtomW, VirtualQueryEx, GlobalFree, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GetStartupInfoW, GlobalDeleteAtom, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, GlobalLock, VirtualAlloc, GetTempPathW, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, WinExec, GetVersionExW, VerifyVersionInfoW, HeapCreate, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, GlobalHandle, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, EnumResourceNamesW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, IsValidLocale, TlsSetValue, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
SHFolder.dll	SHGetFolderPathW
ole32.dll	IsEqualGUID, OleInitialize, CoInitializeEx, OleUninitialize, CoInitialize, CoCreateInstance, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc
gdi32.dll	Pie, SetBkMode, CreateCompatibleBitmap, GetEnhMetaFileHeader, RectVisible, AngleArc, ResizePalette, SetAbortProc, SetTextColor, StretchBlt, RoundRect, SelectClipRgn, RestoreDC, SetRectRgn, GetTextMetricsW, GetWindowOrgEx, CreatePalette, CreateDCW, PolyBezierTo, CreateICW, GetStockObject, CreateSolidBrush, Polygon, MoveToEx, PlayEnhMetaFile, Ellipse, StartPage, GetBitmapBits, StartDocW, AbortDoc, GetSystemPaletteEntries, GetEnhMetaFileBits, GetEnhMetaFilePaletteEntries, CreatePenIndirect, SetMapMode, CreateFontIndirectW, PolyBezier, ExtCreatePen, LPtoDP, EndDoc, GetObjectW, GetWinMetaFileBits, SetROP2, GetEnhMetaFileDescriptionW, ArcTo, Arc, SelectPalette, ExcludeClipRect, MaskBlt, SetWindowOrgEx, EndPage, DeleteEnhMetaFile, Chord, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, CreateBrushIndirect, PatBlt, SetEnhMetaFileBits, PlgBlt, Rectangle, SaveDC, DeleteDC, BitBlt, FrameRgn, GetDeviceCaps, GetTextExtentPoint32W, GetClipBox, IntersectClipRect, Polyline, CreateBitmap, SetWinMetaFileBits, GetStretchBltMode, CreateDIBitmap, SetStretchBltMode, GetDIBits, CreateDIBSection, LineTo, GetRgnBox, EnumFontsW, SetWindowExtEx, CreateHalftonePalette, SelectObject, DeleteObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, OffsetRgn, SetBkColor, CreateCompatibleDC, GetBrushOrgEx, GetCurrentPositionEx, GetNearestPaletteIndex, CreateRoundRectRgn, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, GdiFlush, SetViewportExtEx, SetPixel, PolyPolyline, EnumFontFamiliesExW, StretchDIBits, GetPaletteEntries

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x411f68
dbkFCallWrapperAddr	1	0x7b2648

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 9
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 18:17:42.236059904 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.236104012 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.236208916 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.247345924 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.247365952 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.765664101 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.765774012 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.770415068 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.770443916 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.770792007 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.770868063 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.829786062 CET	49168	443	192.168.2.22	188.166.193.143
Mar 21, 2024 18:17:42.829921961 CET	443	49168	188.166.193.143	192.168.2.22
Mar 21, 2024 18:17:42.830018044 CET	49168	443	192.168.2.22	188.166.193.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2024 18:17:42.128926039 CET	65510	53	192.168.2.22	8.8.8.8
Mar 21, 2024 18:17:42.224040031 CET	53	65510	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 21, 2024 18:17:42.128926039 CET	192.168.2.22	8.8.8.8	0xa9f6	Standard query (0)	www.legal-tools.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 21, 2024 18:17:42.224040031 CET	8.8.8.8	192.168.2.22	0xa9f6	No error (0)	www.legal-tools.org		188.166.193.143	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• lnstaller_2024.008.20535_win64_86.exe

Click to jump to process

Memory Usage

• lnstaller_2024.008.20535_win64_86.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Target ID:	0
Start time:	08:17:38
Start date:	20/03/2024
Path:	C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lnstaller_2024.008.20535_win64_86.exe"
Imagebase:	0x400000
File size:	20'215'710 bytes
MD5 hash:	A0543AF2A8B551D1BF5B89DDEDAE4180
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lnstaller_2024.008.20535_win64_86.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
lnstaller_2024.008.20535_win64_86.exe