Edit tour

Windows Analysis Report
HSBC Payment Advice_pdf.exe

Overview

General Information

Sample name:	HSBC Payment Advice_pdf.exe
Analysis ID:	1462386
MD5:	4a54a1cfb9a323654e9382645dd55f03
SHA1:	2a569a45460a3a7251fe74fc0ce082dbe05de9d4
SHA256:	88ee50dbfee90121de2f56cbb6fb8e23384f2423a0598a45147fe08f6503cb3b
Tags:	AgentTeslaexeHSBC
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HSBC Payment Advice_pdf.exe (PID: 3088 cmdline: "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe" MD5: 4A54A1CFB9A323654E9382645DD55F03)

HSBC Payment Advice_pdf.exe (PID: 4996 cmdline: "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe" MD5: 4A54A1CFB9A323654E9382645DD55F03)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@reivaix.cam", "Password": "Ukbase123."}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: HSBC Payment Advice_pdf.exe PID: 4996	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HSBC Payment Advice_pdf.exe PID: 4996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e00f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3387f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e09f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa872f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33561:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa882b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e107:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8927:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33759:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e179:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8999:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e20f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a2f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 66.29.159.53, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe, Initiated: true, ProcessId: 4996, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49726

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://smtp.privateemail.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.privateemail.com", "Username": "info@reivaix.cam", "Password": "Ukbase123."}

Multi AV Scanner detection for submitted file

Source: HSBC Payment Advice_pdf.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: HSBC Payment Advice_pdf.exe

Joe Sandbox ML: detected

Source: HSBC Payment Advice_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49724 version: TLS 1.2

Source: HSBC Payment Advice_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: FyLs.pdb source: HSBC Payment Advice_pdf.exe
Source:	Binary string: FyLs.pdbSHA256 source: HSBC Payment Advice_pdf.exe

Source: global traffic

TCP traffic: 192.168.2.6:49726 -> 66.29.159.53:587

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 66.29.159.53 66.29.159.53

Source: Joe Sandbox View

ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.6:49726 -> 66.29.159.53:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.privateemail.com

Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.privateemail.com
Source: HSBC Payment Advice_pdf.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49724 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, R1W.cs	.Net Code: _9lBUx
Source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, R1W.cs	.Net Code: _9lBUx

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: HSBC Payment Advice_pdf.exe
Source: initial sample	Static PE information: Filename: HSBC Payment Advice_pdf.exe

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 0_2_028D50E0	0_2_028D50E0
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 0_2_028D1820	0_2_028D1820
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 0_2_04ECD444	0_2_04ECD444
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_0181E2B1	3_2_0181E2B1
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_01814A98	3_2_01814A98
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_01813E80	3_2_01813E80
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_018141C8	3_2_018141C8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E1A068	3_2_06E1A068
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E26638	3_2_06E26638
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E255F8	3_2_06E255F8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E2B270	3_2_06E2B270
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E230B0	3_2_06E230B0
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E27DC8	3_2_06E27DC8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E276E8	3_2_06E276E8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E2E3E8	3_2_06E2E3E8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E22388	3_2_06E22388
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E20040	3_2_06E20040
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E25D33	3_2_06E25D33
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E20007	3_2_06E20007

Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2272931406.0000000006E70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000000.2251469667.0000000000768000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFyLs.exe4 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename69a68dfb-b596-44fb-81cc-4f8cdf6ef50f.exe4 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2269413753.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2269413753.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename69a68dfb-b596-44fb-81cc-4f8cdf6ef50f.exe4 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2267083009.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2272174277.0000000005240000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename69a68dfb-b596-44fb-81cc-4f8cdf6ef50f.exe4 vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3499408043.0000000000FE9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs HSBC Payment Advice_pdf.exe
Source: HSBC Payment Advice_pdf.exe	Binary or memory string: OriginalFilenameFyLs.exe4 vs HSBC Payment Advice_pdf.exe

Source: HSBC Payment Advice_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: HSBC Payment Advice_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, AxXwoOcwjGCrIEPcHi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: _0020.SetAccessControl
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	Security API names: _0020.AddAccessRule
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, AxXwoOcwjGCrIEPcHi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.HSBC Payment Advice_pdf.exe.2c5dabc.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.HSBC Payment Advice_pdf.exe.5520000.11.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.HSBC Payment Advice_pdf.exe.2c3c8ec.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HSBC Payment Advice_pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Mutant created: NULL

Source: HSBC Payment Advice_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HSBC Payment Advice_pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HSBC Payment Advice_pdf.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process created: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process created: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: HSBC Payment Advice_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HSBC Payment Advice_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: HSBC Payment Advice_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: FyLs.pdb source: HSBC Payment Advice_pdf.exe
Source:	Binary string: FyLs.pdbSHA256 source: HSBC Payment Advice_pdf.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: HSBC Payment Advice_pdf.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	.Net Code: snwNAWyx7a System.Reflection.Assembly.Load(byte[])
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	.Net Code: snwNAWyx7a System.Reflection.Assembly.Load(byte[])

Source: HSBC Payment Advice_pdf.exe

Static PE information: 0xDABCAD09 [Tue Apr 16 12:22:33 2086 UTC]

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_01810C45 push ebx; retf	3_2_01810C52
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E15150 push es; ret	3_2_06E15160
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E1FCC7 push es; retf	3_2_06E1FCC8
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Code function: 3_2_06E2AED5 push 8B0418B5h; iretd	3_2_06E2AEDA

Source: HSBC Payment Advice_pdf.exe

Static PE information: section name: .text entropy: 7.913356403013591

Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, LywPj5aBTkLsYaQkEe.cs	High entropy of concatenated method names: 'Dispose', 'VjJq4XmJ4r', 'Gw66LUchLb', 'HS6nnyraZ8', 'Xwsq2eqGJs', 'DPQqzexiE5', 'ProcessDialogKey', 'UJP6j9kqc4', 'xwF6qqJBCZ', 'ihV668wdCA'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, FeX0bTrFKdvkCk1YxR.cs	High entropy of concatenated method names: 'mGsAApFDM', 'sbcVNyaVO', 'CIF3JkOCL', 'V3bU32u52', 'YBl8E4tVT', 'oaVet3TeA', 'vKHLHBTUlC2iY2IvmU', 'WC0j6tALbpvBKDZrVk', 'LrC5Aih4V', 'vPksvdDXN'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, LtFOm3yJUyYxnuYCdo.cs	High entropy of concatenated method names: 'tu4ECIUjMr', 'OkHE8hoIsK', 'vktEvZ8CyK', 'HNkELMknt5', 'gXIEwJEFFh', 'H8BErtpZR6', 'CsmEZhVWTH', 'fD1ESeGLtN', 'oiaEOqDOyI', 'RIsEWlg0JL'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, d5k0o8DUfPNwqd6W7f.cs	High entropy of concatenated method names: 'wFKqMWtMkA', 'n63qmN0B3k', 'IbkqTVmctk', 'UbjqoYFD82', 'CB9qJHcmFR', 'f29qQki7RF', 'YZj15L6XUjDycQfV4C', 'aPChcavvoZS17yT7aE', 'yW4qqMCSTQ', 'SBgqBet6UV'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, vcZsWwjVaviwocgtGb.cs	High entropy of concatenated method names: 'ah8iVcNRgY', 'yVsi3Rpljp', 'Ol5iCi4PDw', 'pX4i8TebDy', 'ChbiJnNJvm', 'Vd1iQqhnZT', 'lx9iXkHPbb', 'TxPi5G61xT', 'BOBi9YqED1', 'FXxisIAhUg'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, rxalHNPCeN6G7cSWoi.cs	High entropy of concatenated method names: 'MamxpuVq80', 'ul5xU0MduQ', 'NsJiulHc9Z', 'gOTiw9bZ72', 'VZrirhwblM', 'QnLiFDIUdo', 'u5oiZs8STa', 'p5JiSXyLku', 'TU7i0rfLJ6', 'cIiiOgWVjj'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, roZQWm12lnekpJn6JL.cs	High entropy of concatenated method names: 'YT5Xc8TUJO', 'hAPX2awNIF', 'kIk5jeEXo6', 'V735q713Eg', 'x6EXWXVjCT', 'OwFXGAyScD', 'cKMXtCXr5E', 'KJjXbePd9p', 'AwrXDEOU1Q', 'y3VXRhfqp4'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, qO5U8v7TKwF86LJ1B9K.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DCRsbMAmlm', 'KqtsDo3oNw', 'nCQsR97FS8', 'OUjsIUJYRG', 'd5NskyICYp', 'LXysKgC3N1', 'eGxsdWwbqd'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, du55YQwiFlGgqtfXe8.cs	High entropy of concatenated method names: 'w045vU8I6M', 'JDQ5LBwLTZ', 'JIr5uuwd8q', 'D5m5wiHTaF', 'puv5bDtuVq', 'PeQ5rDdh2X', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, POytPAV3XRTWXWhQXl.cs	High entropy of concatenated method names: 'aMvXTTW2vr', 'k5oXobtpaU', 'ToString', 'uINXh6ZUEy', 'xMHXlc8ugY', 'T3AXiGy2KV', 'UwsXxh6KZ1', 'EmcXaD1QWy', 'NsCXM76FBW', 'e2EXmaCty8'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, mAcxIfpZrxBho2Ub10.cs	High entropy of concatenated method names: 'UeF5h7G8Jp', 'EaH5lUsQuS', 'ivd5iwEqFD', 'BBb5xU6B81', 'VkC5ajf8RA', 'kJa5MC1riE', 'TpN5mJ6lmp', 'VcD5fOdhff', 'YnV5TNvVUu', 'l8e5o2J4s7'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, SSxpw32RBkkqa09pAX.cs	High entropy of concatenated method names: 'bMpM739XSE', 'dECMgqMMhr', 'cQsMAjy3wL', 'mVWMVDQ6qh', 'eynMpEHPTD', 'a6AM3IAkqf', 'iwyMU0s4NH', 'WNsMC5sTZ5', 'XkFM8Rw7B6', 'ehMMeOYyiM'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	High entropy of concatenated method names: 'ruXBY5q1Mm', 'nd1Bhgxhpo', 'OZUBlObk6A', 'qKVBibjU38', 'YKUBxEHUME', 'zMvBaaRqCH', 'JVvBMcvc7R', 'WAgBm9ZgHh', 'sRaBfO0dh8', 'v3JBTQxs9Z'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, xVE05LhJEonTZpAyst.cs	High entropy of concatenated method names: 'ToString', 'WTGQWRbPfe', 'tOgQLdcCHB', 'gxnQuNZKkh', 'ExsQw2YxWG', 'NBbQrlNwdF', 'I4dQF043As', 'mu5QZlIqyb', 'oMpQSMRXCd', 'M8vQ0N7hDT'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, K5TUoG6qmlwZ7hrE6O.cs	High entropy of concatenated method names: 'jmNaYx71x2', 'YjoalMQBDG', 'EKnaxaXYTe', 'qGxaMogxtq', 'Gf6amDUrqH', 'gSexkDwyXe', 'vMnxKNqZha', 'zf3xd5Ch2t', 'BKgxcU3ro0', 'jTHx4pbi8o'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, bHf3hUkXOo7SVjpqLR.cs	High entropy of concatenated method names: 'e049qu4Oxt', 'F7T9BSvc4H', 'Gap9NJNZ27', 'cAT9hUYC8m', 'AKL9lqiftP', 'LtS9x02ggS', 'P3p9aKdbyV', 'nOL5dDlpq3', 'gq65craU2J', 'Vr754ft9JQ'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, AxXwoOcwjGCrIEPcHi.cs	High entropy of concatenated method names: 'vILlb9Yj9E', 'zeNlDttiFY', 'hTVlRWFfGJ', 'kRFlIClIC1', 'ahLlkYjlDJ', 'ztUlKH7N2t', 'oYDldWqMho', 'Gg1lcq9aRg', 'V6el4Q935R', 'URMl2BETDy'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, x0Mqm19QWQXmhvEQL0.cs	High entropy of concatenated method names: 'IE6MhNpauL', 'iViMiUAaBd', 'IfGMaCPGdF', 'du0a2uH7Oe', 'GMkazE8Ubk', 'MnEMjBE4iM', 'LrLMqlilF7', 's4CM6o0rAE', 'hDfMBF5y7v', 'DFsMNFIhjm'
Source: 0.2.HSBC Payment Advice_pdf.exe.3e653f0.6.raw.unpack, iksoQ078TDhpuDj5Nj7.cs	High entropy of concatenated method names: 'rZo97s3dnW', 'KYi9gBAh11', 'pcQ9ANMThX', 'khA9VOTfjx', 'sIm9pDa1Rb', 'Yl593tnZ2Y', 'Wgt9UQbqg3', 'GOI9CAcoNa', 'QvB989LWcm', 'khX9eaFQXg'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, LywPj5aBTkLsYaQkEe.cs	High entropy of concatenated method names: 'Dispose', 'VjJq4XmJ4r', 'Gw66LUchLb', 'HS6nnyraZ8', 'Xwsq2eqGJs', 'DPQqzexiE5', 'ProcessDialogKey', 'UJP6j9kqc4', 'xwF6qqJBCZ', 'ihV668wdCA'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, FeX0bTrFKdvkCk1YxR.cs	High entropy of concatenated method names: 'mGsAApFDM', 'sbcVNyaVO', 'CIF3JkOCL', 'V3bU32u52', 'YBl8E4tVT', 'oaVet3TeA', 'vKHLHBTUlC2iY2IvmU', 'WC0j6tALbpvBKDZrVk', 'LrC5Aih4V', 'vPksvdDXN'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, LtFOm3yJUyYxnuYCdo.cs	High entropy of concatenated method names: 'tu4ECIUjMr', 'OkHE8hoIsK', 'vktEvZ8CyK', 'HNkELMknt5', 'gXIEwJEFFh', 'H8BErtpZR6', 'CsmEZhVWTH', 'fD1ESeGLtN', 'oiaEOqDOyI', 'RIsEWlg0JL'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, d5k0o8DUfPNwqd6W7f.cs	High entropy of concatenated method names: 'wFKqMWtMkA', 'n63qmN0B3k', 'IbkqTVmctk', 'UbjqoYFD82', 'CB9qJHcmFR', 'f29qQki7RF', 'YZj15L6XUjDycQfV4C', 'aPChcavvoZS17yT7aE', 'yW4qqMCSTQ', 'SBgqBet6UV'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, vcZsWwjVaviwocgtGb.cs	High entropy of concatenated method names: 'ah8iVcNRgY', 'yVsi3Rpljp', 'Ol5iCi4PDw', 'pX4i8TebDy', 'ChbiJnNJvm', 'Vd1iQqhnZT', 'lx9iXkHPbb', 'TxPi5G61xT', 'BOBi9YqED1', 'FXxisIAhUg'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, rxalHNPCeN6G7cSWoi.cs	High entropy of concatenated method names: 'MamxpuVq80', 'ul5xU0MduQ', 'NsJiulHc9Z', 'gOTiw9bZ72', 'VZrirhwblM', 'QnLiFDIUdo', 'u5oiZs8STa', 'p5JiSXyLku', 'TU7i0rfLJ6', 'cIiiOgWVjj'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, roZQWm12lnekpJn6JL.cs	High entropy of concatenated method names: 'YT5Xc8TUJO', 'hAPX2awNIF', 'kIk5jeEXo6', 'V735q713Eg', 'x6EXWXVjCT', 'OwFXGAyScD', 'cKMXtCXr5E', 'KJjXbePd9p', 'AwrXDEOU1Q', 'y3VXRhfqp4'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, qO5U8v7TKwF86LJ1B9K.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DCRsbMAmlm', 'KqtsDo3oNw', 'nCQsR97FS8', 'OUjsIUJYRG', 'd5NskyICYp', 'LXysKgC3N1', 'eGxsdWwbqd'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, du55YQwiFlGgqtfXe8.cs	High entropy of concatenated method names: 'w045vU8I6M', 'JDQ5LBwLTZ', 'JIr5uuwd8q', 'D5m5wiHTaF', 'puv5bDtuVq', 'PeQ5rDdh2X', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, POytPAV3XRTWXWhQXl.cs	High entropy of concatenated method names: 'aMvXTTW2vr', 'k5oXobtpaU', 'ToString', 'uINXh6ZUEy', 'xMHXlc8ugY', 'T3AXiGy2KV', 'UwsXxh6KZ1', 'EmcXaD1QWy', 'NsCXM76FBW', 'e2EXmaCty8'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, mAcxIfpZrxBho2Ub10.cs	High entropy of concatenated method names: 'UeF5h7G8Jp', 'EaH5lUsQuS', 'ivd5iwEqFD', 'BBb5xU6B81', 'VkC5ajf8RA', 'kJa5MC1riE', 'TpN5mJ6lmp', 'VcD5fOdhff', 'YnV5TNvVUu', 'l8e5o2J4s7'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, SSxpw32RBkkqa09pAX.cs	High entropy of concatenated method names: 'bMpM739XSE', 'dECMgqMMhr', 'cQsMAjy3wL', 'mVWMVDQ6qh', 'eynMpEHPTD', 'a6AM3IAkqf', 'iwyMU0s4NH', 'WNsMC5sTZ5', 'XkFM8Rw7B6', 'ehMMeOYyiM'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, Nq3SuCIVXQe0AM9YEE.cs	High entropy of concatenated method names: 'ruXBY5q1Mm', 'nd1Bhgxhpo', 'OZUBlObk6A', 'qKVBibjU38', 'YKUBxEHUME', 'zMvBaaRqCH', 'JVvBMcvc7R', 'WAgBm9ZgHh', 'sRaBfO0dh8', 'v3JBTQxs9Z'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, xVE05LhJEonTZpAyst.cs	High entropy of concatenated method names: 'ToString', 'WTGQWRbPfe', 'tOgQLdcCHB', 'gxnQuNZKkh', 'ExsQw2YxWG', 'NBbQrlNwdF', 'I4dQF043As', 'mu5QZlIqyb', 'oMpQSMRXCd', 'M8vQ0N7hDT'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, K5TUoG6qmlwZ7hrE6O.cs	High entropy of concatenated method names: 'jmNaYx71x2', 'YjoalMQBDG', 'EKnaxaXYTe', 'qGxaMogxtq', 'Gf6amDUrqH', 'gSexkDwyXe', 'vMnxKNqZha', 'zf3xd5Ch2t', 'BKgxcU3ro0', 'jTHx4pbi8o'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, bHf3hUkXOo7SVjpqLR.cs	High entropy of concatenated method names: 'e049qu4Oxt', 'F7T9BSvc4H', 'Gap9NJNZ27', 'cAT9hUYC8m', 'AKL9lqiftP', 'LtS9x02ggS', 'P3p9aKdbyV', 'nOL5dDlpq3', 'gq65craU2J', 'Vr754ft9JQ'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, AxXwoOcwjGCrIEPcHi.cs	High entropy of concatenated method names: 'vILlb9Yj9E', 'zeNlDttiFY', 'hTVlRWFfGJ', 'kRFlIClIC1', 'ahLlkYjlDJ', 'ztUlKH7N2t', 'oYDldWqMho', 'Gg1lcq9aRg', 'V6el4Q935R', 'URMl2BETDy'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, x0Mqm19QWQXmhvEQL0.cs	High entropy of concatenated method names: 'IE6MhNpauL', 'iViMiUAaBd', 'IfGMaCPGdF', 'du0a2uH7Oe', 'GMkazE8Ubk', 'MnEMjBE4iM', 'LrLMqlilF7', 's4CM6o0rAE', 'hDfMBF5y7v', 'DFsMNFIhjm'
Source: 0.2.HSBC Payment Advice_pdf.exe.6e70000.12.raw.unpack, iksoQ078TDhpuDj5Nj7.cs	High entropy of concatenated method names: 'rZo97s3dnW', 'KYi9gBAh11', 'pcQ9ANMThX', 'khA9VOTfjx', 'sIm9pDa1Rb', 'Yl593tnZ2Y', 'Wgt9UQbqg3', 'GOI9CAcoNa', 'QvB989LWcm', 'khX9eaFQXg'

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: ACF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 6EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: BDF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: CDF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 17D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Memory allocated: 5120000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Window / User API: threadDelayed 1227			Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Window / User API: threadDelayed 3645			Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7300	Thread sleep count: 1227 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7300	Thread sleep count: 3645 > 30	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99605s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -99062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97856s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -97421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99714	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99605	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99499	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99390	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99171	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 99062	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98843	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98402	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97969	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97856	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97750	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 97421	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Memory written: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Process created: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe "C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 4996, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 4996, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.HSBC Payment Advice_pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3ac4390.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HSBC Payment Advice_pdf.exe.3a89970.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 3088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HSBC Payment Advice_pdf.exe PID: 4996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HSBC Payment Advice_pdf.exe	39%	ReversingLabs	Win32.Trojan.Generic
HSBC Payment Advice_pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
http://smtp.privateemail.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		unknown
smtp.privateemail.com	66.29.159.53	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	HSBC Payment Advice_pdf.exe, 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001418000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, HSBC Payment Advice_pdf.exe, 00000003.00000002.3499588618.0000000001477000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.privateemail.com	HSBC Payment Advice_pdf.exe, 00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tempuri.org/DataSet1.xsd	HSBC Payment Advice_pdf.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
66.29.159.53	smtp.privateemail.com	United States		19538	ADVANTAGECOMUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1462386
Start date and time:	2024-06-25 15:47:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HSBC Payment Advice_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: HSBC Payment Advice_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
09:48:10	API Interceptor	25x Sleep call for process: HSBC Payment Advice_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ld.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
66.29.159.53	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	17129052285907bbffa1e06db9a2c2be9b124dbfe370dcce33488c29504b5286529b8a6aa8471.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	Scan_IMG-Payment Sheet _Till Febuary 2024...bat.exe	Get hash	malicious	AgentTesla	Browse
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	https://www.wikiran.org/attachments/leaks/asbgroup//4d90f5a202dda02e5900334984637a7fd0d3b2e2/CIMB%20PAYMENT%200520.zip	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.privateemail.com	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	INQUIRY RE44535_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	66.29.159.53
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	e-dekont_swift-details.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	66.29.159.53
	17129052285907bbffa1e06db9a2c2be9b124dbfe370dcce33488c29504b5286529b8a6aa8471.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	Scan_IMG-Payment Sheet _Till Febuary 2024...bat.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	1709572324a197889913f96ec9bd444cdc1a03ae72cd8e81098994f82b76ebbbd558d62ba0270.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	66.29.159.53
	https://www.wikiran.org/attachments/leaks/asbgroup//4d90f5a202dda02e5900334984637a7fd0d3b2e2/CIMB%20PAYMENT%200520.zip	Get hash	malicious	AgentTesla	Browse	66.29.159.53
api.ipify.org	E-dekont.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	0097-CGM CIGIEMME S.p.A.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	gdC5AKTv6RiIgyr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payroll List or Salary List.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	crypted file.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Cosco_RFQ_June_.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	loading advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.Evo-gen.25703.16605.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.W64.Agent.NV.tr.9318.30020.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	PEC Statement 770925.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win64.Evo-gen.25703.16605.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SecuriteInfo.com.Win32.Evo-gen.1540.18028.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	Promotion letter-2.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	7rBFEWNRqy.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	188.114.96.3
	SecuriteInfo.com.W64.Agent.NV.tr.9318.30020.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	E-dekont.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	Promotion letter-3.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
ADVANTAGECOMUS	https://tgbot.cyb3r.army/700975049/Instagram.com.html	Get hash	malicious	Unknown	Browse	66.29.146.75
	https://tgbot.cyb3r.army/1598573024/Instagram.com.html	Get hash	malicious	Unknown	Browse	66.29.146.75
	http://tgbot.cyb3r.army/6453936172/Instagram.com.html	Get hash	malicious	Unknown	Browse	66.29.146.75
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	66.29.145.248
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	66.29.145.248
	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	66.29.145.248
	60a8.scr.exe	Get hash	malicious	FormBook	Browse	66.29.137.12
	https://tgbot.cyb3r.army/1440835494/Instagram.com.html	Get hash	malicious	Unknown	Browse	66.29.146.75
	https://tgbot.cyb3r.army/6695883664/Instagram.com.html	Get hash	malicious	Unknown	Browse	66.29.146.75
	PO 060624.exe	Get hash	malicious	FormBook	Browse	66.29.149.46

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	MKiN8877.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Evo-gen.25703.16605.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.W64.Agent.NV.tr.9318.30020.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	MKiN8877.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Evo-gen.25703.16605.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.Win32.Evo-gen.1540.18028.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Promotion letter-2.docx	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.W64.Agent.NV.tr.9318.30020.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	E-dekont.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9063089183462045
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	HSBC Payment Advice_pdf.exe
File size:	683'008 bytes
MD5:	4a54a1cfb9a323654e9382645dd55f03
SHA1:	2a569a45460a3a7251fe74fc0ce082dbe05de9d4
SHA256:	88ee50dbfee90121de2f56cbb6fb8e23384f2423a0598a45147fe08f6503cb3b
SHA512:	6830e11f411b50da12361bbd8749dc80386b49895823986609d990871c8a9c01884c38e9dc8698f913b00f1f273809e225430b22c2f0d9241735892b96d5cab5
SSDEEP:	12288:wo5wtN2gPFocYNclSS51hq2t7ud/I59A/IFlDBUun3BYMn/:7LESc5F5F8dQ40lDeGr/
TLSH:	5CE4122035684F53E9BD4BF4122CF68127FB460F5261E79C8DE271DB2876F8143A1A9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..N...........m... ........@.. ....................................@................................

File Icon


Icon Hash:	b6b3a3a398988cb3

Static PE Info

General

Entrypoint:	0x4a6d1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDABCAD09 [Tue Apr 16 12:22:33 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6ccc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa8000	0x1830	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa3dac	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa4d24	0xa4e00	87803562fdd55e743e493f4829c2b7a2	False	0.9306870143100834	data	7.913356403013591	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa8000	0x1830	0x1a00	5d1a70fc93af3de7628df5a9dcb23b6c	False	0.7546574519230769	data	7.208753987549188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0xc	0x200	926647611823790aa4d07c775db48281	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa8130	0x11f4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9253698868581375
RT_GROUP_ICON	0xa9324	0x14	data	0.95
RT_VERSION	0xa9338	0x30c	data	0.4358974358974359
RT_MANIFEST	0xa9644	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2024 15:48:12.571446896 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:12.571485043 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:12.571620941 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:12.575650930 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:12.575675964 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.143501043 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.143625975 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.155802011 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.155834913 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.156124115 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.215030909 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.241041899 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.284499884 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.348980904 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.349482059 CEST	443	49724	104.26.13.205	192.168.2.6
Jun 25, 2024 15:48:13.349711895 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.352097034 CEST	49724	443	192.168.2.6	104.26.13.205
Jun 25, 2024 15:48:13.966964960 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:13.971774101 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:13.973421097 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:14.580679893 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:14.580889940 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:14.585813999 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:14.732760906 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:14.732959986 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:14.737910986 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:14.884553909 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:14.885117054 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:14.890372992 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038047075 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038074970 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038104057 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038121939 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038137913 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038136959 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.038156033 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.038167000 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.038206100 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.055073023 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.059933901 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.207079887 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.211055040 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.217530012 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.363845110 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.365010977 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.369828939 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.517115116 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.518285990 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.523305893 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.672975063 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.673288107 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.678319931 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.837208033 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:15.837480068 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:15.842369080 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.051855087 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.052453041 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:16.059823990 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.208861113 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.209608078 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:16.209608078 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:16.209638119 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:16.209638119 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:48:16.214504957 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.214550018 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.214595079 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.214608908 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.597390890 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:48:16.652478933 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:49:53.965826035 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:49:53.971306086 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:49:54.117594957 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:49:54.118865967 CEST	587	49726	66.29.159.53	192.168.2.6
Jun 25, 2024 15:49:54.118921041 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:49:54.118921041 CEST	49726	587	192.168.2.6	66.29.159.53
Jun 25, 2024 15:49:54.123832941 CEST	587	49726	66.29.159.53	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 25, 2024 15:48:12.557495117 CEST	52042	53	192.168.2.6	1.1.1.1
Jun 25, 2024 15:48:12.564709902 CEST	53	52042	1.1.1.1	192.168.2.6
Jun 25, 2024 15:48:13.948128939 CEST	54969	53	192.168.2.6	1.1.1.1
Jun 25, 2024 15:48:13.966038942 CEST	53	54969	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 25, 2024 15:48:12.557495117 CEST	192.168.2.6	1.1.1.1	0x110e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jun 25, 2024 15:48:13.948128939 CEST	192.168.2.6	1.1.1.1	0xde6f	Standard query (0)	smtp.privateemail.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 25, 2024 15:48:12.564709902 CEST	1.1.1.1	192.168.2.6	0x110e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jun 25, 2024 15:48:12.564709902 CEST	1.1.1.1	192.168.2.6	0x110e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jun 25, 2024 15:48:12.564709902 CEST	1.1.1.1	192.168.2.6	0x110e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jun 25, 2024 15:48:13.966038942 CEST	1.1.1.1	192.168.2.6	0xde6f	No error (0)	smtp.privateemail.com	66.29.159.53	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	104.26.13.205	443	4996	C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-25 13:48:13 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-06-25 13:48:13 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 25 Jun 2024 13:48:13 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 899569f71b3941f2-EWR
2024-06-25 13:48:13 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 25, 2024 15:48:14.580679893 CEST	587	49726	66.29.159.53	192.168.2.6	220 PrivateEmail.com prod Mail Node
Jun 25, 2024 15:48:14.580889940 CEST	49726	587	192.168.2.6	66.29.159.53	EHLO 367706
Jun 25, 2024 15:48:14.732760906 CEST	587	49726	66.29.159.53	192.168.2.6	250-mta-05.privateemail.com 250-PIPELINING 250-SIZE 81788928 250-ETRN 250-AUTH PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-CHUNKING 250 STARTTLS
Jun 25, 2024 15:48:14.732959986 CEST	49726	587	192.168.2.6	66.29.159.53	STARTTLS
Jun 25, 2024 15:48:14.884553909 CEST	587	49726	66.29.159.53	192.168.2.6	220 Ready to start TLS

Target ID:	0
Start time:	09:48:09
Start date:	25/06/2024
Path:	C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"
Imagebase:	0x6c0000
File size:	683'008 bytes
MD5 hash:	4A54A1CFB9A323654E9382645DD55F03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2270067141.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:48:10
Start date:	25/06/2024
Path:	C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HSBC Payment Advice_pdf.exe"
Imagebase:	0xdb0000
File size:	683'008 bytes
MD5 hash:	4A54A1CFB9A323654E9382645DD55F03
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3501087252.000000000319C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3501087252.00000000031A4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3501087252.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3499187438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	235
Total number of Limit Nodes:	24

Executed Functions

Function 028D50E0 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03422d217a417636c3a35163731f82e60353416c6e288f37035675f5b1284ae1
Instruction ID: 4a9f215204af078526f39bcb9964b1630d4f9d7b579841c1d3e07a1a39f649e3
Opcode Fuzzy Hash: 03422d217a417636c3a35163731f82e60353416c6e288f37035675f5b1284ae1
Instruction Fuzzy Hash: 64328A38B012049FEB19DB69D550BAEBBF7AF89304F54406AE109DB391DB38ED06CB51

Function 028D2394 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 028D25D6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 535866912f9cd458f1fa7d63d48a0ceefe90daeeb0d6861155f5dd101f377269
Instruction ID: db894dc4748fc316c9cc7c3e520babdffe9d4e3dc8602e5ece80e39708013162
Opcode Fuzzy Hash: 535866912f9cd458f1fa7d63d48a0ceefe90daeeb0d6861155f5dd101f377269
Instruction Fuzzy Hash: EFA14A79D002198FEB14DF68D851BAEBBB2BF48314F1481A9EC08E7245DB749989CF91

Function 028D23A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 028D25D6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: edfe354718d02008da937d5125ccc1f46ec253a422b2a629504428705a3a66e2
Instruction ID: ecd9fd57030ff320c4ba18ea89c167706381bdd7ad2730a2b5a59ff3cf8bb658
Opcode Fuzzy Hash: edfe354718d02008da937d5125ccc1f46ec253a422b2a629504428705a3a66e2
Instruction Fuzzy Hash: C0914A79D00219CFEB14DF68D851BAEBBB2BF48314F1481A9EC08E7245DB749989CF91

Function 04ECAE79 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04ECB0DE

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a3b66b07e15011a98cbe4070954ba636f39ad595aa23ac13dfe53f7b4abd9837
Instruction ID: 3abff288faa0b711fcbee60b3529fb7dd2ceb36e19cafab92c06cc808ea4c844
Opcode Fuzzy Hash: a3b66b07e15011a98cbe4070954ba636f39ad595aa23ac13dfe53f7b4abd9837
Instruction Fuzzy Hash: B68134B0A00B498FD724DF29D64575ABBF1FF88304F008A2ED45AD7A40DB75E946CB94

Function 04EC590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04EC59C9

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5b54d838abf8c2e240259a0496a1de1ca6d73a0f7e2888b9ac9b2070ea2c25cb
Instruction ID: 5af16617f140db171b552d40b61604cb49c40cb1009cb2627e81a4d786b04422
Opcode Fuzzy Hash: 5b54d838abf8c2e240259a0496a1de1ca6d73a0f7e2888b9ac9b2070ea2c25cb
Instruction Fuzzy Hash: E141E0B1C0072DCBEB24DFAAC98579EBBF1BF48714F20805AD408AB251DB756946CF91

Function 04EC44E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04EC59C9

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 74328a9015d4e44d2644f24f6f6b2ba8e6ca26abd67fc7dc97b126b196c264ec
Instruction ID: 25102e21663b37421a75d26b5a198ec94c3734e61d489d55bb148ce2f58abb13
Opcode Fuzzy Hash: 74328a9015d4e44d2644f24f6f6b2ba8e6ca26abd67fc7dc97b126b196c264ec
Instruction Fuzzy Hash: B441F3B0C0072DDBEB24DFAAC94479EBBF5BF48304F20806AD508AB251DB756946CF90

Function 04EC5A84 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e92021e267ab4270a0b32f03dcf6cf841a828055224e78973cda1a66f05cdec
Instruction ID: e130dde4eab9d136457fa91fbb0e817bf2acab43b8114fc1e5e9a66c5c1ad9b5
Opcode Fuzzy Hash: 3e92021e267ab4270a0b32f03dcf6cf841a828055224e78973cda1a66f05cdec
Instruction Fuzzy Hash: 9931DAB1805358CFEB11CFA8C9447ADBBF0AF46308F20418AC055AB292DB74B946CB01

Function 028D1D10 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028D1DA8

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dd09f3a373dbe8f541b6a7434f665f6226bae3804b5e2e9463c483b9dc27ff7a
Instruction ID: 367c98f212171dbf0cd3c398c8034a49e03dc990ee2222ea5469d5a5c01d8cd3
Opcode Fuzzy Hash: dd09f3a373dbe8f541b6a7434f665f6226bae3804b5e2e9463c483b9dc27ff7a
Instruction Fuzzy Hash: 97216675900359DFDB00CFAAC985BDEBBF0FF88310F10842AE918A7240D778A954CBA4

Function 028D1D18 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028D1DA8

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fd9a1820ec6f10a079b65fcdd5deb1ca97c921aa69cf410f462d86be47ad1470
Instruction ID: 897811c2712160d82eed3c0ea5b1325164511f9a48b05b99467262174b2e3ac5
Opcode Fuzzy Hash: fd9a1820ec6f10a079b65fcdd5deb1ca97c921aa69cf410f462d86be47ad1470
Instruction Fuzzy Hash: D02157759003099FDF10CFAAC985BDEBBF5FF48310F10842AE919A7240D778A954CBA4

Function 028D1E01 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028D1E88

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b49c438cfdc2355a42327e02064b659f4fd73efa005e82fa63833a7aafb48986
Instruction ID: ed3a8edc20c292d33ed64d20e01257bf40cd3f901b39116f24c01dd3405fcfde
Opcode Fuzzy Hash: b49c438cfdc2355a42327e02064b659f4fd73efa005e82fa63833a7aafb48986
Instruction Fuzzy Hash: D8212775900349DFDB10CFAAC881BEEBBF1FF88310F10842AE518A7250C7749954CBA5

Function 028D1741 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 028D17C6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e3aee66f5a24fd1bb1023a0aee39f9835101719553d70b2b34785261d38c5ad1
Instruction ID: 59db555e7273de372bdc9c90ea58601ea1013ad635abd8913d983585c9cd6960
Opcode Fuzzy Hash: e3aee66f5a24fd1bb1023a0aee39f9835101719553d70b2b34785261d38c5ad1
Instruction Fuzzy Hash: D82168B9D003098FDB10CFAAC5857EEBBF4EF88714F14842AD519A7240CB78A544CFA5

Function 04ECB870 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04ECD726,?,?,?,?,?), ref: 04ECD7E7

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c130b53e37617007e70a4f2842b19448b535eef217f5a02e2601f06d988e225f
Instruction ID: 2df989b223c00ee3c751181ca45a778234ae809e2a9ad2df79423fdeebd24db6
Opcode Fuzzy Hash: c130b53e37617007e70a4f2842b19448b535eef217f5a02e2601f06d988e225f
Instruction Fuzzy Hash: 7121E3B5900209EFDB10CF9AD984ADEBBF8EF48320F14802AE914B3310D375A955CFA5

Function 028D1E08 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028D1E88

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d07921d26aacf81b5357d72e13b0f0bb826c0b6dda6958a3a7c897eac3cc8aae
Instruction ID: aeb4fb037fc13a32031e923608d1100b103845cf301dadbbc85600837e9c13be
Opcode Fuzzy Hash: d07921d26aacf81b5357d72e13b0f0bb826c0b6dda6958a3a7c897eac3cc8aae
Instruction Fuzzy Hash: 862128B59003599FDB10CFAAC885BEEBBF5FF88320F50842AE518A7240C7799514CBA5

Function 028D1748 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 028D17C6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 05a587170e2d2710b187fec292ee54acb6bc85a9f29eb21aedaaec46c04a910d
Instruction ID: 045ff09d1a75bc8a9db3a802f98d0086684ddf34dd1b85f66d6dfb8d5ea436b0
Opcode Fuzzy Hash: 05a587170e2d2710b187fec292ee54acb6bc85a9f29eb21aedaaec46c04a910d
Instruction Fuzzy Hash: 3A211875D003098FDB10DFAAC4857EEBBF4EF88324F14842AD519A7240DB78A944CFA5

Function 04ECD759 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,04ECD726,?,?,?,?,?), ref: 04ECD7E7

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6cdfbd5ada07b8c3cfb477b38c850a77e6aa1a16d457e2b764deffd86417928c
Instruction ID: 044c52a2371a26f858e946fe3aefaa2b2508ff67cd3918652130571477a32f89
Opcode Fuzzy Hash: 6cdfbd5ada07b8c3cfb477b38c850a77e6aa1a16d457e2b764deffd86417928c
Instruction Fuzzy Hash: D821E0B5900209DFDB10CF9AD581ADEBBF5FB48324F14802AE918A3250C779A950CF64

Function 028D1C50 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028D1CC6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0be98f14a8ee2541f81fa5bf34536a7b3b93ebb8d8f1c82f0b48c7492ef91aa6
Instruction ID: e6cbf5ff73f0b38b2d10c3be967f94ff641d79807aca95755858ba1dee2c5d4f
Opcode Fuzzy Hash: 0be98f14a8ee2541f81fa5bf34536a7b3b93ebb8d8f1c82f0b48c7492ef91aa6
Instruction Fuzzy Hash: 3E118976900249DFDB10DFA9C944BDFBBF5EF48310F108819E519A7210C7759554CFA4

Function 04ECA248 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04ECB159,00000800,00000000,00000000), ref: 04ECB36A

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9f86420d8c84ccc0791e9e3a9d6c75a59e38b36d2fe65575b473a9208000e38
Instruction ID: 8eb30cae3168b488e4fdc422b8784a104fe393287cc1e59c9bfc52ec27c3146c
Opcode Fuzzy Hash: d9f86420d8c84ccc0791e9e3a9d6c75a59e38b36d2fe65575b473a9208000e38
Instruction Fuzzy Hash: C811D6B69003099FDB10CF9AD545BAEFBF4EB48714F10841EE919A7210C3B5A545CFA5

Function 028D1C58 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028D1CC6

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0603f45eaaf45892065fa07681db00adf9bc53a2cb2ba30ee347e1cdb3ab47df
Instruction ID: 7844a37f67b84ebdaa747b977d3be7b87cfe43d43313fbbddc6f430b3d4e1fac
Opcode Fuzzy Hash: 0603f45eaaf45892065fa07681db00adf9bc53a2cb2ba30ee347e1cdb3ab47df
Instruction Fuzzy Hash: 4F1156769002499FDB20DFAAC844BDFBBF5EF88320F208819E519A7250C775A914CBA4

Function 028D1690 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 028D16FA

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a2b94d47d7c279310ed131489f6dae9bbf228ef4b897282c60207e4ad8226533
Instruction ID: b5e461ca9441e5fa3e587b145a01089aa8d50e479efa7077491ca0fea5b61a68
Opcode Fuzzy Hash: a2b94d47d7c279310ed131489f6dae9bbf228ef4b897282c60207e4ad8226533
Instruction Fuzzy Hash: 971188B5900349CFDB20DFAAD4457DEFFF4EF88224F24842AD519A7250CB79A944CB94

Function 028D1698 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 028D16FA

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 893b34e1c64407b161d273b0ab102a8d4110db321bfe7003e7bcff7531469844
Instruction ID: cca38ee64366e4660f33b9c17ea1bfb6e9ad322afdb84c6e765b5d99bc99c1ef
Opcode Fuzzy Hash: 893b34e1c64407b161d273b0ab102a8d4110db321bfe7003e7bcff7531469844
Instruction Fuzzy Hash: 2B1166B59003498FDB20DFAAC44579FFBF4EF88324F24841AD519A7240CB79A944CBA4

Function 04ECB2F9 Relevance: 1.5, APIs: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04ECB159,00000800,00000000,00000000), ref: 04ECB36A

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8e605043f9b30f4d7c9323e3f48b5bd1581da0cbd2152beb829dfc37ab669253
Instruction ID: 0efd4ec5ddc6a7005cbca50b96f4e735e31f588392b90038748b64906ec3330d
Opcode Fuzzy Hash: 8e605043f9b30f4d7c9323e3f48b5bd1581da0cbd2152beb829dfc37ab669253
Instruction Fuzzy Hash: 191112B69003098FDB14CF9AD540BAEFBF5BB88310F14841ED968A7210C7B9A506CFA5

Function 04ECB078 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04ECB0DE

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f9162d4aa3be35f43c013a51f414f936eed6252b49ea544afef300da11d12e62
Instruction ID: 68358006ad24a677f07dc69b18d92e0bfdf87025c3c1769dd044a56f1f4e48ca
Opcode Fuzzy Hash: f9162d4aa3be35f43c013a51f414f936eed6252b49ea544afef300da11d12e62
Instruction Fuzzy Hash: E2110FB6C00249CFDB10CF9AD545B9EFBF8EF88324F10841AD828A7210D379A545CFA5

Function 028D1FA8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 028D4645

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5d92a9336b8b822073eb14ed25eaff243b178e5da64a447125664050ac354bba
Instruction ID: 91975ce58aac22926e2ec6579ad8be7b13021bf0f52ce9da9dbcce5084f22199
Opcode Fuzzy Hash: 5d92a9336b8b822073eb14ed25eaff243b178e5da64a447125664050ac354bba
Instruction Fuzzy Hash: 7A11F5B98003499FDB10CF9AD545BDEBBF8EB48324F10845AE919A7210C3B5A954CFA5

Function 028D45E0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 028D4645

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f83c3f316295148c31129de4c78ecf14e6c737575fe86b2e19b4e3a3fba09da3
Instruction ID: e2a61d4bd61696dab0c30b0fcfe698682be6b23c35ae185f0db7c55ee569e7a5
Opcode Fuzzy Hash: f83c3f316295148c31129de4c78ecf14e6c737575fe86b2e19b4e3a3fba09da3
Instruction Fuzzy Hash: 8E1110B98003498FDB10CF99D685BDEBBF8EF48324F20844AE558A3611C375A544CFA4

Function 00D3D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267056203.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aac6da0459b5951123b957956712c4266ab0f0f8d09ed25464fdc528c5ada5e
Instruction ID: 86b438f458f360f6eb202db03cd7d26cfe3cf72cd560dee2a32b87b3a20978fd
Opcode Fuzzy Hash: 5aac6da0459b5951123b957956712c4266ab0f0f8d09ed25464fdc528c5ada5e
Instruction Fuzzy Hash: DF21F572504244EFDB15DF14E9C0B26BF66FB88318F24C569E9490B256C336D856CEB1

Function 011DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268039058.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a341757feb4faa9df30e54f6ec445190d980a353a875333484842fe99a8d165
Instruction ID: 3ca010eef383f0548a336674a326f70fed956fa9308acf04c3a7b18810488630
Opcode Fuzzy Hash: 0a341757feb4faa9df30e54f6ec445190d980a353a875333484842fe99a8d165
Instruction Fuzzy Hash: 45210075604200EFDF19DF68E980B26BB65EBC8314F20C56DD90A0B296C77AD406CA62

Function 011DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268039058.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b966f6b86fe0b3bd099367388f31bdde33ed65cd759331aa42d2c6296af731
Instruction ID: a258ac4758a6463cb5134487e6f7aef5e76b593ff903a42e21c4d4a6bda26afd
Opcode Fuzzy Hash: 80b966f6b86fe0b3bd099367388f31bdde33ed65cd759331aa42d2c6296af731
Instruction Fuzzy Hash: 50212675504304EFDF09DF94E9C0F26BBA5FB84324F20C56DE90A4B292C77AD446CA62

Function 011DD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268039058.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de4ea31916f7024ddad8496a5476b991176820d290d0d52bf473a9dde53bdf7
Instruction ID: b3c78557f878e6eed1b012bedb1b075535dfe912497d54cbf6a6c9066b061cca
Opcode Fuzzy Hash: 9de4ea31916f7024ddad8496a5476b991176820d290d0d52bf473a9dde53bdf7
Instruction Fuzzy Hash: 2721C3755093808FCB17CF24D990B15BF71EB85314F28C5EAD8498B6A7C33AD40ACB62

Function 00D3D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267056203.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 65dbf69d0789dcbcb8d77217ec5e23e748ec84d6a9d552dcc3d92ceaf5911f5d
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 3511E676504280CFCB16CF10D9C4B16BF72FB94318F28C6A9D8490B656C33AD856CFA1

Function 011DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268039058.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11dd000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 023c235932f58d30f3b219bf5fe983f62620d92fcb4eaa2efbbc5caca3f7d7f6
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 6011BB75504280DFCF06CF54D5C0B15BBB1FB84224F24C6A9D8494B6A6C33AD40ACB62

Function 00D3D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267056203.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df762e10dbabc8a388ca12afc20442c7fd2a6df60481d8866b91b6b445a22f24
Instruction ID: d1688ca5c14d86753f4177d7295d3697d84d1ee8b7f62c6e94a8490cd19b1ad2
Opcode Fuzzy Hash: df762e10dbabc8a388ca12afc20442c7fd2a6df60481d8866b91b6b445a22f24
Instruction Fuzzy Hash: 1901F2B20043409AE7104A25ED84B66BF98EF41320F28841AED4A0A286C7B9D840CAB1

Function 00D3D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2267056203.0000000000D3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d3d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dab1dcceca1abdd27e2a1b8863a2195ab5b3b88f1594489bf50dd6bc4f6d1d
Instruction ID: 9f239a7fa3c9061a299875857f3145e7796e393a7c9f6a22e3c735d078f26487
Opcode Fuzzy Hash: b8dab1dcceca1abdd27e2a1b8863a2195ab5b3b88f1594489bf50dd6bc4f6d1d
Instruction Fuzzy Hash: C6F0C2B2404344AEE7108A06ECC4B62FFA8EF50724F18C45AED090B286C3B9AC40CAB1

Non-executed Functions

Function 028D1820 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2268886102.00000000028D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd56d41d95a75e90f9f9015166699f216d474fcb7189ac773e2116d8cad9b95
Instruction ID: 7b63e65bca6b9d4ca8659a25f39c026b85dbd26d32ff65378db78500957ef876
Opcode Fuzzy Hash: 4bd56d41d95a75e90f9f9015166699f216d474fcb7189ac773e2116d8cad9b95
Instruction Fuzzy Hash: BBE11A78E002598FDB14DF99C584AAEFBB2FF88304F248269D418A7355D731AD86CF60

Function 04ECD444 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271188001.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82026c03c4a3a6521ecaa85a1e95c3ce6e250dbfd3589c4b07f7ff03d34962e
Instruction ID: f6d035cd34f5ed55edb447d3bd42936691dfe9c549bd64f18c3e036a354d4461
Opcode Fuzzy Hash: f82026c03c4a3a6521ecaa85a1e95c3ce6e250dbfd3589c4b07f7ff03d34962e
Instruction Fuzzy Hash: 50A17D32E002098FCF05DFB5CA4499EBBB3FF85304B15956EE805AB2A1DB75E916CB40

Analysis Process: HSBC Payment Advice_pdf.exePID: 4996, Parent PID: 3088COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	184
Total number of Limit Nodes:	20

Executed Functions

Function 06E255F8 Relevance: 1.8, Strings: 1, Instructions: 598
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06E25C90

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 0e008e1c40157f8667b2b21fc6c7b9bd6fcf9e6aad02861315abf7d7270eb83b
Instruction ID: 38ad29c9f1d56733e205cfb9e51bdccf1ef834dbd0a01a558b12f45e95c76a8a
Opcode Fuzzy Hash: 0e008e1c40157f8667b2b21fc6c7b9bd6fcf9e6aad02861315abf7d7270eb83b
Instruction Fuzzy Hash: 5122C035E0036A8FDB64DBA4C5846AEB7B2FF49324F248469D856EB384DB35DC41CB90

Function 06E22388 Relevance: 1.0, Instructions: 1017COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aece96608031818d406b4f296cdaafbd50a757276aa160aa811eba759df52fd
Instruction ID: 51344bd3216f803cc0ea3dd94941aca5c130cb356d40d8ef643dfb2fb3939ad0
Opcode Fuzzy Hash: 4aece96608031818d406b4f296cdaafbd50a757276aa160aa811eba759df52fd
Instruction Fuzzy Hash: 22925534A003168FDB64DF68C584B9DB7F2FB88318F5494A9D509AB365DB35ED81CB80

Function 06E26638 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2feda312c715c93e76f6fa8ced42fd7effad35370514769f264e28ca627fb7ac
Instruction ID: 84e91f21c4648f64e6680e08c68cca8a09d5697090c307522f9055e547aed90e
Opcode Fuzzy Hash: 2feda312c715c93e76f6fa8ced42fd7effad35370514769f264e28ca627fb7ac
Instruction Fuzzy Hash: 7A627B34A002268FDB54DB68D584BADB7F3EF88314F249569E9069B394DB35EC46CB80

Function 06E2B270 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc62c38954414485adbcef3403d6bea3bcd25a020a05ffe049420af11f9dbb1
Instruction ID: 5a9909102fe2034bee0288ff235f04749abb1177d9e1b1d6a4bbec9ef7f3e2c3
Opcode Fuzzy Hash: bcc62c38954414485adbcef3403d6bea3bcd25a020a05ffe049420af11f9dbb1
Instruction Fuzzy Hash: 51225230E1021A8FEF64CBA8D4847ADB7B7FB89318F649529E405DB391DA74DC81CB51

Function 06E230B0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bd5428215ab252d2801c580d35b50a0b3de3142352b040f1ace4df0a63826a
Instruction ID: 2e3dca289b67b54e1e50e567cb969c89afbe3cb38d8334c07f8da82c74ce7fb8
Opcode Fuzzy Hash: a4bd5428215ab252d2801c580d35b50a0b3de3142352b040f1ace4df0a63826a
Instruction Fuzzy Hash: E9322C30E1075ACBDB14DB65C89059DB7B6FFC9300F2096AAD40AAB254EF74AD85CF90

Function 06E27DC8 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc5b7aba1fb0a40759d09eb845d3a3473a8096e021964b77608976c6018bc66
Instruction ID: 705ac03072d031ffadb9b941a7f063a154f7bd38c547a852ab400a100c31d1d2
Opcode Fuzzy Hash: edc5b7aba1fb0a40759d09eb845d3a3473a8096e021964b77608976c6018bc66
Instruction Fuzzy Hash: 6902CE30B012268FDB54DB65D494BAEB7E3FF88304F249528E5069B394DB75EC86CB90

Function 06E1B228 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: da81851461fb7e02d933e965b0c3f59549d819e6733a7297a8ba7bd2a28aa1b1
Instruction ID: fb0332bb467fc641206b3f939a2a1dc87ea31ac0ba13be701fb3b1903edb6d05
Opcode Fuzzy Hash: da81851461fb7e02d933e965b0c3f59549d819e6733a7297a8ba7bd2a28aa1b1
Instruction Fuzzy Hash: E5815670A00B058FD764DF6AD44479ABBF5FF88304F008A2DD49ADBA50DB74E84ACB90

Function 0181EB48 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3500742920.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1810000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1ab130a88f995d2bee19766018b516d007c0fa89887d9d04c0b145d2e31b4c
Instruction ID: bb5f0d398e6e59d8a87e7520f49931663b4b2a12356a6d5bced995de3be45a23
Opcode Fuzzy Hash: fd1ab130a88f995d2bee19766018b516d007c0fa89887d9d04c0b145d2e31b4c
Instruction Fuzzy Hash: EF413272D0439ACFDB14DFAAD8006EEBBF5AF89310F14856BD904E7240EB749945CBA0

Function 06E1D804 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E1D922

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9568476b798da4145a87848cb8fe4dc75582b4f07d5a8d612c0eaee778c3b169
Instruction ID: ca7f869dd7e0ab7eca1ed46d4ce1f6b5c6dba139f9f838065e1ce72dc65228ef
Opcode Fuzzy Hash: 9568476b798da4145a87848cb8fe4dc75582b4f07d5a8d612c0eaee778c3b169
Instruction Fuzzy Hash: 9A51D2B1D00349DFDB14CFAAC894ADEBFB5BF48310F24912AE819AB210D7719985CF90

Function 06E1D810 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E1D922

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 47968d34a9220a9335a734ab64ad5315312312c5cae26c8309809eb4aff74461
Instruction ID: 57f4bcb06fccff42a70a8860164fefd5b7fd7665915b58ca32912885edaadee9
Opcode Fuzzy Hash: 47968d34a9220a9335a734ab64ad5315312312c5cae26c8309809eb4aff74461
Instruction Fuzzy Hash: CA41C1B1D00349DFDB14CF9AC894ADEBFB5BF48314F24912AE819AB210D7B49985CF90

Function 06E1CD6C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06E1FE91

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 70c06d8ee5e50d989be5317c1c2465fdb23225790de3628c2ec2f56becb69827
Instruction ID: ed613a50448d5c1d15c498e6796a2c6c770b626e7cb2544bd400aa1e5348322b
Opcode Fuzzy Hash: 70c06d8ee5e50d989be5317c1c2465fdb23225790de3628c2ec2f56becb69827
Instruction Fuzzy Hash: 0F413BB5900309CFDB54CF99C848AAAFBF5FF88324F248459E519AB321D774A941CFA0

Function 06E13048 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06E130D7

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5853d09388ec7eda1def6eb04cee392c1abe7d6b8b8658900761aaf16ace9078
Instruction ID: db8093dc51f0637cfab839b04c76a5e968ba4d75a25bb410b71009724a8c7d43
Opcode Fuzzy Hash: 5853d09388ec7eda1def6eb04cee392c1abe7d6b8b8658900761aaf16ace9078
Instruction Fuzzy Hash: B121E3B5D00209DFDB10CFAAD984AEEBBF5EB48310F14841AE915A7350D379A950CF61

Function 06E13050 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06E130D7

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 11979e5fb6c96b50503520348b56c2e1865dbe0e18b0859723168c8a041ef891
Instruction ID: 9a17ac0668bb9d053aa948db5dff16f8361f9891d0539d52e13f83c58f58744e
Opcode Fuzzy Hash: 11979e5fb6c96b50503520348b56c2e1865dbe0e18b0859723168c8a041ef891
Instruction Fuzzy Hash: 2A21E3B5900309DFDB10CFAAD984ADEBBF4EB48320F14841AE914A7210D379A950CF61

Function 06E1B67B Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06E1B6EA

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5aad872981cd6eaf9bd91f172d2f37046b10d59c8f2b93419b0832a8f7c5fdf0
Instruction ID: ce258f940ac446d12eee72317456238045acbf864863e1699027acac9c2e835e
Opcode Fuzzy Hash: 5aad872981cd6eaf9bd91f172d2f37046b10d59c8f2b93419b0832a8f7c5fdf0
Instruction Fuzzy Hash: 0A1126B6C003498FDB10CFAAD844ADEFBF4EF88320F10841AE519A7200C375A545CFA5

Function 0181EC30 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0181EC97

Memory Dump Source

Source File: 00000003.00000002.3500742920.0000000001810000.00000040.00000800.00020000.00000000.sdmp, Offset: 01810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1810000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 56172107b43cee3ff016ac4baf3941c7429d0aeb9f5d19deca6bce437bf70be5
Instruction ID: fde2c3675774b3e9d4b3d8bde605cb65a9913b01db91cd86678ed143c76fc8b3
Opcode Fuzzy Hash: 56172107b43cee3ff016ac4baf3941c7429d0aeb9f5d19deca6bce437bf70be5
Instruction Fuzzy Hash: 511114B2C0065ADFDB10CF9AC544BDEFBF4AF48320F14852AD918A7240D378A954CFA1

Function 06E1B680 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 06E1B6EA

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5c5704dac84673c177a7cc5e701727a6e31b505736b96f5cd5d3e94052762d9c
Instruction ID: 7564831739117d043405a25c25343c09965a171419a0e392e90e090fa9c361d8
Opcode Fuzzy Hash: 5c5704dac84673c177a7cc5e701727a6e31b505736b96f5cd5d3e94052762d9c
Instruction Fuzzy Hash: C911F6B6C003098FDB10CF9AD844ADEFBF4AF48324F10841AD519A7210C375A545CFA5

Function 06E1A17C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06E1B244), ref: 06E1B47E

Memory Dump Source

Source File: 00000003.00000002.3505985999.0000000006E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e10000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2fe90ae1dbb6567a2fcc6e15ac7db4c668f7e0d261fe1de161341a55a85a3f1d
Instruction ID: f6b0816af5f00fefc33d2da14ac41a9c1bbe51c591840b9e049623cbf2f6396c
Opcode Fuzzy Hash: 2fe90ae1dbb6567a2fcc6e15ac7db4c668f7e0d261fe1de161341a55a85a3f1d
Instruction Fuzzy Hash: FA11F0B5C007498FDB20CF9AC444ADEFBF4EB88724F10846AD919A7210D3B9A545CFA1

Function 06E2CF88 Relevance: .8, Instructions: 803COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07791f98172574330ef987e2b39ed56c9163abeb358a93e62137a342b39e4b4
Instruction ID: ccd42949a99473f92b06f172038cce9f0b5816cde29b65ecc737d51238ba94ef
Opcode Fuzzy Hash: b07791f98172574330ef987e2b39ed56c9163abeb358a93e62137a342b39e4b4
Instruction Fuzzy Hash: 5F625B30B1021B8FDB65DB69D990A5DBBB3FF84304F209A29D105DB255DB79EC86CB80

Function 06E2C1C0 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370c1b329c98cc76e263a6c94518fb79e0308767f19379d66bafb4985076e270
Instruction ID: c7304798218c758293740eeebcfa897507ca3a97ba58704c74dbbf93de921260
Opcode Fuzzy Hash: 370c1b329c98cc76e263a6c94518fb79e0308767f19379d66bafb4985076e270
Instruction Fuzzy Hash: A1328134B0021A9FDB94DB69D890BAEB7B3FB88714F209529E505E7345DB35EC81CB90

Function 06E2B690 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c856b6bdbe02fe1160e248b97ab059985163679efad30d580f665e6545786f7
Instruction ID: 4cd5bff86378410e97fb03876018a854fc7766439d9933f50984cf51137acd0a
Opcode Fuzzy Hash: 3c856b6bdbe02fe1160e248b97ab059985163679efad30d580f665e6545786f7
Instruction Fuzzy Hash: 91028C30E1032A8FEBA4CB68D4847ADB7B2FF85318F14996AE405DB255DB74DC81CB91

Function 06E291A0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95d17ffedd527bb631ea5f407ff1513bb444783b940acdbd9d3700b77b4e4bd
Instruction ID: c157abac0bc17602ca10b607b863f61c38df6cca024bc7dd7458739470221267
Opcode Fuzzy Hash: b95d17ffedd527bb631ea5f407ff1513bb444783b940acdbd9d3700b77b4e4bd
Instruction Fuzzy Hash: 3B915130B0125B8FDB54DB6AD890BAEB7F6FF85200F109469D50AEB345EF74AC458B90

Function 06E26238 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb46f996760a0019902fa3160192a3e800f2bd292a6d7d0208bdd7b186eb60c3
Instruction ID: 5b44356d3fbc9cc8f7069276c595a31bcaea1c1235f071ce7f8a23508719424c
Opcode Fuzzy Hash: fb46f996760a0019902fa3160192a3e800f2bd292a6d7d0208bdd7b186eb60c3
Instruction Fuzzy Hash: 5661E3B2F002624BDF549A6DC88066FBBD7EFC4220B154079E90ADB364DEB5EC0287C1

Function 06E242F0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087597777e49567ca9b512d6b527b19cd0bf0b8b0f9e39e43cf3b0749c0a31f1
Instruction ID: e257d45e2ad6d63d56355369f424c1a341f4e66377444bcf5820805632b6c080
Opcode Fuzzy Hash: 087597777e49567ca9b512d6b527b19cd0bf0b8b0f9e39e43cf3b0749c0a31f1
Instruction Fuzzy Hash: 34814D34B0125A8BDB54DBA9D59475EB7F3FF89304F248528E40ADB384EB34DC468B91

Function 06E24614 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df00a874c48f11b7184ff75b8b6b1a291c813b9a4d01ff2f8e9b5782e340c66
Instruction ID: 5a7c5aac63084c709d65da829fd841a09deeda2c96de2115ddb0b9e17294c0f3
Opcode Fuzzy Hash: 7df00a874c48f11b7184ff75b8b6b1a291c813b9a4d01ff2f8e9b5782e340c66
Instruction Fuzzy Hash: E1914130E1071ACBDF60DF68C840B9DB7B2FF89314F208599D549AB285DB70AA85CF90

Function 06E2AF68 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b2e41c6d6c2d953410f89041e447a6462f36a8d63f662cd0b3062136f4caeb
Instruction ID: 38eb1fa55e8530308352bdb9206220d25100bd77707cf3ff27a969891916a1f2
Opcode Fuzzy Hash: c4b2e41c6d6c2d953410f89041e447a6462f36a8d63f662cd0b3062136f4caeb
Instruction Fuzzy Hash: 5C717031E0031A8BDB19DFA5D4406AEBBB3FFC9304F209529E509AB354DB749946CB90

Function 06E24628 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc38f5e3be17fd55ca1396cd4fb301f24cce2cd01031034207a5c32c30a85d9
Instruction ID: a4a98f32d05eb2cb68e6251a4819151dd32a5457c86992d376fe0fc06b4de878
Opcode Fuzzy Hash: 0cc38f5e3be17fd55ca1396cd4fb301f24cce2cd01031034207a5c32c30a85d9
Instruction Fuzzy Hash: FD913030E1061ACBDF64DF64C840B9DB7B2FF89314F208599D549BB285DB71AA85CF90

Function 06E2EB48 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a164e154e1b659a9242b2b55ea178fbc7fb5a669cf69c20d5ba686b6477da0
Instruction ID: 8143075c6583ba0378fb8381ef7f77a5f11a12e17f9a8d3f52d1a0b876faca99
Opcode Fuzzy Hash: f8a164e154e1b659a9242b2b55ea178fbc7fb5a669cf69c20d5ba686b6477da0
Instruction Fuzzy Hash: 39713B30A0022A9FDB54DFA9C980A9DBBF6FF88304F149429D406EB359DB74ED46CB50

Function 06E2AEE5 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e772336e4e3441c056891c7a0cdaf16ed2042f6b7eb977e23276c2fadbdec6b
Instruction ID: f37005912f39dc3b7440b12f274a3f944653aa73a876985c9c53f58d77ab3203
Opcode Fuzzy Hash: 4e772336e4e3441c056891c7a0cdaf16ed2042f6b7eb977e23276c2fadbdec6b
Instruction Fuzzy Hash: 6B61A030F1031A8FEB65DB6CD8806AEB7B7EB85314F20553AE446D7245DA38DC82CB91

Function 06E2EB58 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1b5b78edd9679e2a635a98bd0bb67f54db0c6ffc9702ea4e519e1439b3fb81
Instruction ID: 3bad1928d9716513bf2f5beda9796394828b1947c66b310ec9ad08f1d9a824a5
Opcode Fuzzy Hash: 7a1b5b78edd9679e2a635a98bd0bb67f54db0c6ffc9702ea4e519e1439b3fb81
Instruction Fuzzy Hash: 5E713C30A0026A9FDB54DBA9D980A9DBBF7FF88304F149429D406EB358DB74ED42CB50

Function 06E24BC0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea0ae06e4047bb80ebf8305555b2cae63d35d1d0c5074479e5786e26ea13aa1
Instruction ID: 27fabd17ac949deb12d8c9408846ed7be7198ffe9f7a6e82b0eaf7de75f724c0
Opcode Fuzzy Hash: 8ea0ae06e4047bb80ebf8305555b2cae63d35d1d0c5074479e5786e26ea13aa1
Instruction Fuzzy Hash: B7616F70F00219DFEB54DBA5D8547AEBBF7FB88300F24842AE50AAB395DB754C458B90

Function 06E2FCB8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5953ad8bc340f30b28eac88d1bdf0dfb715838a0c29f8271efc3e547f99796c8
Instruction ID: f60b37b3b38167e145d7146014a7eb942d538d42fb623ea6e46b49319bfba88e
Opcode Fuzzy Hash: 5953ad8bc340f30b28eac88d1bdf0dfb715838a0c29f8271efc3e547f99796c8
Instruction Fuzzy Hash: AB51F131E0121ADFDF24AB79E4546ADB7B3FF84325F208869D106D7255DB358C55CB80

Function 06E29190 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08726f04fefd70f2f216a90a5105707df3f26296b29e0c97da7f2c0d86fe74b
Instruction ID: 9cacdc839826290eb358e22ba29494fc120712610e152b33d95dbaf74fc5f9d4
Opcode Fuzzy Hash: a08726f04fefd70f2f216a90a5105707df3f26296b29e0c97da7f2c0d86fe74b
Instruction Fuzzy Hash: 66516F30B012579FDB54DB6AE890B6EB3F6FF88210F149469D90ADB345EA34AC418B90

Function 06E2FA69 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1c989add8ef27c66db5ac23642c5c10abe70cd730c9e843ad4346001e54a9a
Instruction ID: 256128e2a6ffa506e824e3e09754d99c8c1b39a8fb9f54ae4163b9e272384b32
Opcode Fuzzy Hash: 0b1c989add8ef27c66db5ac23642c5c10abe70cd730c9e843ad4346001e54a9a
Instruction Fuzzy Hash: 2751F770F602269BEF7456BCD95476F3AABE7C9300F20142AE50AC7386CD6DCD818392

Function 06E2FA78 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4baa09254cbb2357cc9194175c977d149576421599db0e5691983bb6a97fdb
Instruction ID: da1f103b6a076f55b69e930651ad2718648c8b97ca42fafc8446bf33bca6948f
Opcode Fuzzy Hash: 5a4baa09254cbb2357cc9194175c977d149576421599db0e5691983bb6a97fdb
Instruction Fuzzy Hash: 9951C570F602269BEF6456FCD95476F3AABE7C9710F205426E50AC7386CD6DCC8143A2

Function 06E24B8C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947098b6bf2701306a367906d4c1e6cd13cc64c4db1bf2427747749724938847
Instruction ID: c6dfab1b502c8c87233ac399b68f57d3f0d7060210b5a7d27aa880b4fc0b494f
Opcode Fuzzy Hash: 947098b6bf2701306a367906d4c1e6cd13cc64c4db1bf2427747749724938847
Instruction Fuzzy Hash: AF519330B002699FEB559FA5C8547AEBBF7FF88310F20852AE505EB395DA758C05CB90

Function 06E25468 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e254b724ccf297a3d4b4bdc1ecc42b95027dfdc72d5e33bce43b48cd87edf3ca
Instruction ID: 34a037b40a31565652136061aeda3fa658bfcad2c4378f5ce145f551c6367cff
Opcode Fuzzy Hash: e254b724ccf297a3d4b4bdc1ecc42b95027dfdc72d5e33bce43b48cd87edf3ca
Instruction Fuzzy Hash: 70418E71E0071A9FDB70CF99D980AAFFBB3FB85314F10492AE216D7650D230E9558B91

Function 06E2DAFD Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae0355097ec59bde87af3ed2b96ac819e2ae7a3cf02327bbc1c629ea0d2e1baa
Instruction ID: 428f647821459f532a73238141218019b4878a0f8229562f0a555ccddf88554d
Opcode Fuzzy Hash: ae0355097ec59bde87af3ed2b96ac819e2ae7a3cf02327bbc1c629ea0d2e1baa
Instruction Fuzzy Hash: 49419030E0032ADFDB64DF65C85469EBBB3EF85604F14952AE505DB244DB749846CB90

Function 06E22210 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d65bea3e2ce4c35e244feed6a582ab16da4b32b2802d7245c9ad49811b70c79
Instruction ID: 2df5df79fe08d55a11e00c6409d45df83d82ecedbf1dc3bf9e307bc38838c41b
Opcode Fuzzy Hash: 9d65bea3e2ce4c35e244feed6a582ab16da4b32b2802d7245c9ad49811b70c79
Instruction Fuzzy Hash: 84311E31B102168FDB589B35C41466E7BA7BF89214F20942CD506DB394EF3ADD42C7D4

Function 06E22208 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467b5731c6507cb3af74d8ee4cbd2d5c17e3b37fb8e8592d1ffa0e0c36c36fe1
Instruction ID: c09df5bbb7cd3d4bc855795df6e3138b9c7243c52809b41396d6226e6c4c3ee1
Opcode Fuzzy Hash: 467b5731c6507cb3af74d8ee4cbd2d5c17e3b37fb8e8592d1ffa0e0c36c36fe1
Instruction Fuzzy Hash: 6D312231B102128FDB599B34C4146AE7BA3BF89214F10942CD506DB394EF3ADD42C7D0

Function 06E220C0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d6f560d9bff17afc8020c01021b0cc761f474c4796f61b3f4d72fa45c2adb1
Instruction ID: 0950c3e96152dfdd0e3a263d8ceb2a60e7e4d79dac261831d53c58cfa6567e56
Opcode Fuzzy Hash: d2d6f560d9bff17afc8020c01021b0cc761f474c4796f61b3f4d72fa45c2adb1
Instruction Fuzzy Hash: 51317034E003569FCB15CF65C894A9EBBB2FF89300F148519EA16EB350DB759D86CB90

Function 06E220D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d969014af980367d9bb47b063fe3171a4055b114ab1f520a3cbfc297e994a52b
Instruction ID: 89513802d6656fa212af4d0a91fdbb82b6ef61071bf078fc8479d88344779e61
Opcode Fuzzy Hash: d969014af980367d9bb47b063fe3171a4055b114ab1f520a3cbfc297e994a52b
Instruction Fuzzy Hash: B0316234E1021A9FCB55DF65C854A9EB7B3FF89300F108519EA16E7350DB71AD85CB50

Function 06E23AF0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a1b95928580cd2a8ba8dafd0d7832f5bffcea7e366248a05b307fb70c441d5
Instruction ID: 0905cb713ca0c428d63aee38bf3ccd7cbd4b04cb881bc43b9bfd336572884ba1
Opcode Fuzzy Hash: f2a1b95928580cd2a8ba8dafd0d7832f5bffcea7e366248a05b307fb70c441d5
Instruction Fuzzy Hash: D0215C75E116169FDB50CF69E980AEEB7F6EB48310F108029E945E7340EB38EC45CB90

Function 06E23B00 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9cd209d9a76ff84cc1bc09f5c7698c32433efaf7b19cf197c056e776417ec5
Instruction ID: 38315943d85eeb8ac442aed18dd248f7eb4e293475701ffa425b6eb7498f62c0
Opcode Fuzzy Hash: 0f9cd209d9a76ff84cc1bc09f5c7698c32433efaf7b19cf197c056e776417ec5
Instruction Fuzzy Hash: 30213B75E016269FDB50CF69D980AAEB7F6EB48610F149069E905E7344E738ED40CF90

Function 0173D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3500371851.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_173d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faab34e2310019869362b7b34e0c9358941e4978724189156b8794fb2f92de1a
Instruction ID: 47b24e824157336a0bdcc199c79777252307a32d77326081c8d19c8f93c50c1a
Opcode Fuzzy Hash: faab34e2310019869362b7b34e0c9358941e4978724189156b8794fb2f92de1a
Instruction Fuzzy Hash: 732134B1504204EFDB25CF64C9C0B26FB65FBC4714F60C5ADE9490B253C77AD446CA61

Function 06E23C10 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae72d577f1fb2016c6c2427ebefaf3d19143bf1c7deb6ab489ca7b9f1398475
Instruction ID: 34f1a9ab8df9cebb1e819999d90eacab2601fe3434a9e1b26d055c03687364fb
Opcode Fuzzy Hash: 1ae72d577f1fb2016c6c2427ebefaf3d19143bf1c7deb6ab489ca7b9f1398475
Instruction Fuzzy Hash: 1C11A131B0523A4BDB54A668E8106EF73EBEBC8610F044539D506EB340EE28DC028BA0

Function 06E2EDC9 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afb6a95a528bf773110547382fd00f630cce25cb1d695c18e8bb87a33054e1ff
Instruction ID: 6f86d507adcb67fa919e5cb25f54a9cd344747ac8a18663f3a476d6b47428dc8
Opcode Fuzzy Hash: afb6a95a528bf773110547382fd00f630cce25cb1d695c18e8bb87a33054e1ff
Instruction Fuzzy Hash: 90012430B002321FEB229A7C9894B3BB7D7DBCA624F14883AF20ACB340DD59CC464390

Function 06E24250 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac7d29e30d0771eee48640b0110449c343902ab21a54a6f3c5ba46800048c74
Instruction ID: 235149eccd3e5b78cd8464645ac260e6d60803dfa37a94d3c99af713414a79ee
Opcode Fuzzy Hash: dac7d29e30d0771eee48640b0110449c343902ab21a54a6f3c5ba46800048c74
Instruction Fuzzy Hash: F001F535B042614FEB619AAEC45072AB7DBEBC9724F24883AE24EC7381DD65CC424395

Function 06E2A350 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636ff8e0d45386a39f45731e8ce893f10de65a246decd5778be782524de9cbcb
Instruction ID: 9d881ad1e9fd68a0b427324ec522059ee1001149e673cc2b553b6a4ed6ff1ca9
Opcode Fuzzy Hash: 636ff8e0d45386a39f45731e8ce893f10de65a246decd5778be782524de9cbcb
Instruction Fuzzy Hash: A701B1307043294FDB619A3DD85475E77E6FB89714F104839E24AC7341EA25DC428794

Function 06E238C8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fa91997c1b94dd866527e3bb94d4ec137850046ed6fa060278d40dc6ecb8a4
Instruction ID: ad1c6e32f8ab4f1751df209aaf523fa3ff8be694302cc7a967caa35a87e9cb81
Opcode Fuzzy Hash: 39fa91997c1b94dd866527e3bb94d4ec137850046ed6fa060278d40dc6ecb8a4
Instruction Fuzzy Hash: CF21F4B5D00259AFCB00CF9AD884ACEFBF4FF49714F10821AE918A7200C374A954CFA5

Function 0173D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3500371851.000000000173D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0173D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_173d000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: fccb1bbed19d42e1dbb9438f2a7bee8c00c0ff6b571f229a2654be448a9e0c2a
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: AF11BB75504284CFCB22CF54C9C4B15FBA2FB84314F24C6A9D8494B253C33AD44ACF62

Function 06E238D0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1a457509c912bbb650fb8dba88c703d7c7b3346ea7c52f30d69d2ea8202bf4
Instruction ID: b450272d0f6261bf5d7c2208a71c3e43cef7c26bb62363a3d7fdadb277ff7d0d
Opcode Fuzzy Hash: 3b1a457509c912bbb650fb8dba88c703d7c7b3346ea7c52f30d69d2ea8202bf4
Instruction Fuzzy Hash: E711D3B5D0125AAFCB00CF9AD884ACEFFB4FF49720F10812AE518A7200C778A554CFA5

Function 06E23C00 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaab9eb5966d4cb36ef80a6844d66965bc1826b399b9db98334c39a5790351d9
Instruction ID: 8e0c53ab775fa1a2782067569fd511d1c6cce5a6279ffd8db92ed10f7e6a312a
Opcode Fuzzy Hash: aaab9eb5966d4cb36ef80a6844d66965bc1826b399b9db98334c39a5790351d9
Instruction Fuzzy Hash: D101D435B152654BDB549A69E8116EF73A7EFC8710F044539D406E7380EE24CC028BA1

Function 06E24260 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0511909a69afd73b977b3c4dc91351690b7f0904cc9d090980059d481b6d71
Instruction ID: 5ec716171183b43f0f8117509bd63d98e1e38d02cb2d5231b37fbb6a2efe00e1
Opcode Fuzzy Hash: 5e0511909a69afd73b977b3c4dc91351690b7f0904cc9d090980059d481b6d71
Instruction Fuzzy Hash: 5301D136B001224BEB64D6AFD45072BB3DBEBC8724F248839E20EC7380DD69DC424395

Function 06E2EDD8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386116c00014edb2aef3578051290a32cba9a19ce437fa22f46e44bc5965ba21
Instruction ID: f3a473cd188bd511eeb644406929832cbf29fb3d365c431f0340d677403038a1
Opcode Fuzzy Hash: 386116c00014edb2aef3578051290a32cba9a19ce437fa22f46e44bc5965ba21
Instruction Fuzzy Hash: C501DC31B102320BDB65966D9454B3EA3D7DBC9624F149829E20AC7340EE69DC024384

Function 06E2A360 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc776a75d42c4d4e7928892696df5ed491cface0231c75a1caca4c8ac0191d0
Instruction ID: 1b3d798b2350e904fdf4d48710b6c36270b46f4ec4716e97b8978eaf98c8318e
Opcode Fuzzy Hash: bfc776a75d42c4d4e7928892696df5ed491cface0231c75a1caca4c8ac0191d0
Instruction Fuzzy Hash: AF014F34B102264FDB65DA6DD854B2EB7E7FB89714F10983CE60BC7340EA25EC428794

Function 06E2830F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b12f516932ff69b22aed6ade4a18ea95bcc254418f00c655057940cc443594
Instruction ID: 66fc14bed70bd139eea68345fcebf580d60ef65308500593c9eef68da718c5af
Opcode Fuzzy Hash: 83b12f516932ff69b22aed6ade4a18ea95bcc254418f00c655057940cc443594
Instruction Fuzzy Hash: 5AF08C36E04336CFEB648A55E9492FE77B6FB04365F286062D802D3151C335999ECB90

Function 06E264B8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3506038125.0000000006E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e20000_HSBC Payment Advice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38484972928952ff973894427b12e3f641e53e905e461275303643a187838d7
Instruction ID: 5d5cc8a8a012b55d4ea1ac95f1b499e25b81353013bcd8277964e3ea38b01b58
Opcode Fuzzy Hash: a38484972928952ff973894427b12e3f641e53e905e461275303643a187838d7
Instruction Fuzzy Hash: 24E09B71E1D3696BDB60CAB49D1569B7B5EA702108F1045D5D444C7141E175CA05CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HSBC Payment Advice_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HSBC Payment Advice_pdf.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
HSBC Payment Advice_pdf.exe

Function 028D2394 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Function 028D23A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 04ECAE79 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 04EC590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 04EC44E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04EC5A84 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 028D1D10 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Function 028D1D18 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 028D1E01 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 028D1741 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 04ECB870 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 028D1E08 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 028D1748 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 04ECD759 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 028D1C50 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre