Windows Analysis Report
TSD_ESign_Window_7_V2.5.8.exe

Overview

General Information

Sample name: TSD_ESign_Window_7_V2.5.8.exe
Analysis ID: 1447095
MD5: f28b80dd90a08f60c3b1e1853780e5c2
SHA1: fcc18510d38551a22b04b16467157a7da3c379a7
SHA256: 94c898b8c78342205b126e8e90d1c2a2f4ca683f92d22213b82c5f24dfa5c8ec
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Signatures

Drops PE files
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: TSD_ESign_Window_7_V2.5.8.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: TSD_ESign_Window_7_V2.5.8.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: >{app}\com.tsd.einvoice.host.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: >{app}\com.tsd.einvoice.core.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\ESignLibrary.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002513000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\com.tsd.einvoice.core.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002521000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\com.tsd.einvoice.host.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002521000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\EinvoiceSignLib.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.00000000024F6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 2{app}\EinvoiceSignLib.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ,{app}\ESignLibrary.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)
Source: unknown DNS traffic detected: query: 50.23.12.20.in-addr.arpa replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2287199763.0000000002316000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.00000000024F6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://einvoice.com.vn/
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2083906504.0000000002590000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://einvoice.com.vn/0https://einvoice.com.vn/0https://einvoice.com.vn/
Source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.00000000024F6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://einvoice.com.vn/9jO
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2287199763.0000000002316000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://einvoice.com.vn/Ah1
Source: TSD_ESign_Window_7_V2.5.8.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2085354992.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2084953815.0000000002590000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000000.2087006183.0000000000401000.00000020.00000001.01000000.00000004.sdmp, TSD_ESign_Window_7_V2.5.8.tmp.0.dr String found in binary or memory: https://www.innosetup.com/
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2085354992.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2084953815.0000000002590000.00000004.00001000.00020000.00000000.sdmp, TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000000.2087006183.0000000000401000.00000020.00000001.01000000.00000004.sdmp, TSD_ESign_Window_7_V2.5.8.tmp.0.dr String found in binary or memory: https://www.remobjects.com/ps
PE file contains executable resources (Code or Archives)
Source: TSD_ESign_Window_7_V2.5.8.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000000.2083390303.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs TSD_ESign_Window_7_V2.5.8.exe
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2084953815.0000000002679000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs TSD_ESign_Window_7_V2.5.8.exe
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2085354992.000000007FE35000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs TSD_ESign_Window_7_V2.5.8.exe
Source: TSD_ESign_Window_7_V2.5.8.exe, 00000000.00000003.2287199763.00000000022F8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs TSD_ESign_Window_7_V2.5.8.exe
Source: TSD_ESign_Window_7_V2.5.8.exe Binary or memory string: OriginalFileName vs TSD_ESign_Window_7_V2.5.8.exe
Uses 32bit PE files
Source: TSD_ESign_Window_7_V2.5.8.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: clean1.winEXE@3/2@2/0
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe File created: C:\Users\user\AppData\Local\Temp\is-536DE.tmp Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: TSD_ESign_Window_7_V2.5.8.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe File read: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe "C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe"
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Process created: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp "C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp" /SL5="$203EE,7563488,777728,C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe"
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Process created: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp "C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp" /SL5="$203EE,7563488,777728,C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe" Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: TSD_ESign_Window_7_V2.5.8.exe Static file information: File size 8394434 > 1048576
Source: TSD_ESign_Window_7_V2.5.8.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: >{app}\com.tsd.einvoice.host.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: >{app}\com.tsd.einvoice.core.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\ESignLibrary.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002513000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\com.tsd.einvoice.core.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002521000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\com.tsd.einvoice.host.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.0000000002521000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: {app}\EinvoiceSignLib.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2281772665.00000000024F6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 2{app}\EinvoiceSignLib.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ,{app}\ESignLibrary.pdb source: TSD_ESign_Window_7_V2.5.8.tmp, 00000002.00000003.2088903156.0000000003480000.00000004.00001000.00020000.00000000.sdmp
PE file contains sections with non-standard names
Source: TSD_ESign_Window_7_V2.5.8.exe Static PE information: section name: .didata
Source: TSD_ESign_Window_7_V2.5.8.tmp.0.dr Static PE information: section name: .didata
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp File created: C:\Users\user\AppData\Local\Temp\is-VQOJS.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe File created: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Jump to dropped file
Source: C:\Users\user\Desktop\TSD_ESign_Window_7_V2.5.8.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VQOJS.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-536DE.tmp\TSD_ESign_Window_7_V2.5.8.tmp Process information queried: ProcessInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1447095 Sample: TSD_ESign_Window_7_V2.5.8.exe Startdate: 24/05/2024 Architecture: WINDOWS Score: 1 16 50.23.12.20.in-addr.arpa 2->16 18 15.164.165.52.in-addr.arpa 2->18 6 TSD_ESign_Window_7_V2.5.8.exe 2 2->6         started        process3 file4 12 C:\Users\...\TSD_ESign_Window_7_V2.5.8.tmp, PE32 6->12 dropped 9 TSD_ESign_Window_7_V2.5.8.tmp 5 13 6->9         started        process5 file6 14 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 9->14 dropped
⊘No contacted IP infos

Contacted Domains

Name IP Active
15.164.165.52.in-addr.arpa unknown unknown
50.23.12.20.in-addr.arpa unknown unknown