Windows Analysis Report
PO454355 Pdf.exe

Overview

General Information

Sample name: PO454355 Pdf.exe
Analysis ID: 1466132
MD5: 2d8c7cd70698ef3b6d1a3e042de0a93a
SHA1: c73700a78a391e61b9ca3535c8d26dde12035808
SHA256: 657f1fddc9566fb412981480dcc6f6600219c6e5ca756070fe5b15baaa3843ce
Tags: exe
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
AI detected suspicious sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
One or more processes crash
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: PO454355 Pdf.exe ReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Source: PO454355 Pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8D21C50
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8D21C50
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rdi 0_2_00007FF6E8DE3D20
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then sub rsp, 28h 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rbx 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then sub rsp, 28h 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rsi 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push rdi 0_2_00007FF6E8DADD30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 4x nop then push r14 0_2_00007FF6E8E5D7E0

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.2.4:62736 -> 3.33.244.179:80
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: Amcache.hve.6.dr String found in binary or memory: http://upx.sf.net
Source: PO454355 Pdf.exe String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: PO454355 Pdf.exe String found in binary or memory: https://aka.ms/nativeaot-c
Source: PO454355 Pdf.exe, 00000000.00000002.2171313837.00007FF6E8E6B000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: PO454355 Pdf.exe String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: PO454355 Pdf.exe String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Detected potential crypto function
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D521B0 0_2_00007FF6E8D521B0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D538B0 0_2_00007FF6E8D538B0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D531E0 0_2_00007FF6E8D531E0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D381F0 0_2_00007FF6E8D381F0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D239D0 0_2_00007FF6E8D239D0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D571B0 0_2_00007FF6E8D571B0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D529B0 0_2_00007FF6E8D529B0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D54B10 0_2_00007FF6E8D54B10
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D282D0 0_2_00007FF6E8D282D0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D402A0 0_2_00007FF6E8D402A0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D39A90 0_2_00007FF6E8D39A90
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D4BC80 0_2_00007FF6E8D4BC80
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D46C90 0_2_00007FF6E8D46C90
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D55490 0_2_00007FF6E8D55490
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D3D620 0_2_00007FF6E8D3D620
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D41D60 0_2_00007FF6E8D41D60
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D33EF0 0_2_00007FF6E8D33EF0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D2B6F0 0_2_00007FF6E8D2B6F0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D26ED0 0_2_00007FF6E8D26ED0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D567E0 0_2_00007FF6E8D567E0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D4C7D0 0_2_00007FF6E8D4C7D0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D417B4 0_2_00007FF6E8D417B4
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D2BF90 0_2_00007FF6E8D2BF90
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8DD7F40 0_2_00007FF6E8DD7F40
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D33130 0_2_00007FF6E8D33130
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D5E8E0 0_2_00007FF6E8D5E8E0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D558C0 0_2_00007FF6E8D558C0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D4C0A0 0_2_00007FF6E8D4C0A0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D32080 0_2_00007FF6E8D32080
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: String function: 00007FF6E8D2DBD0 appears 64 times
One or more processes crash
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 20
Sample file is different than original file name gathered from version info
Source: PO454355 Pdf.exe Binary or memory string: OriginalFilename vs PO454355 Pdf.exe
Source: PO454355 Pdf.exe, 00000000.00000002.2171469647.00007FF6E8F70000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameIFormattableGetEnumNames.dllR vs PO454355 Pdf.exe
Source: PO454355 Pdf.exe Binary or memory string: OriginalFilenameIFormattableGetEnumNames.dllR vs PO454355 Pdf.exe
Source: PO454355 Pdf.exe Static PE information: Section: .rsrc ZLIB complexity 0.996648656542056
Source: classification engine Classification label: mal72.evad.winEXE@5/5@1/0
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D32F60 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma, 0_2_00007FF6E8D32F60
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4980:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4932
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2c83fdca-92d8-417c-9c3e-a3d64b15695c Jump to behavior
Source: PO454355 Pdf.exe Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PO454355 Pdf.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\Desktop\PO454355 Pdf.exe File read: C:\Users\user\Desktop\PO454355 Pdf.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO454355 Pdf.exe "C:\Users\user\Desktop\PO454355 Pdf.exe"
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 20
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Section loaded: profapi.dll Jump to behavior
Source: PO454355 Pdf.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: PO454355 Pdf.exe Static file information: File size 2404352 > 1048576
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PO454355 Pdf.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: PO454355 Pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PO454355 Pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PO454355 Pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PO454355 Pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PO454355 Pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PO454355 Pdf.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Compiles C# or VB.Net code
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" Jump to behavior
PE file contains sections with non-standard names
Source: PO454355 Pdf.exe Static PE information: section name: .managed
Source: PO454355 Pdf.exe Static PE information: section name: hydrated
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory allocated: 22E8B970000 memory reserve | memory write watch Jump to behavior
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D32B90 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask, 0_2_00007FF6E8D32B90
Source: Amcache.hve.6.dr Binary or memory string: VMware
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1hbin@
Source: PO454355 Pdf.exe Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: Amcache.hve.6.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.6.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D28130 RtlAddVectoredExceptionHandler,RaiseFailFastException, 0_2_00007FF6E8D28130
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D8B70C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF6E8D8B70C

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4EE0008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D8BDA4 cpuid 0_2_00007FF6E8D8BDA4
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: GetLocaleInfoEx, 0_2_00007FF6E8DF0D30
Source: C:\Users\user\Desktop\PO454355 Pdf.exe Code function: 0_2_00007FF6E8D8BA10 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF6E8D8BA10
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1466132 Sample: PO454355 Pdf.exe Startdate: 02/07/2024 Architecture: WINDOWS Score: 72 17 15.164.165.52.in-addr.arpa 2->17 19 Snort IDS alert for network traffic 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 AI detected suspicious sample 2->23 8 PO454355 Pdf.exe 1 2->8         started        signatures3 process4 signatures5 25 Writes to foreign memory regions 8->25 27 Allocates memory in foreign processes 8->27 29 Injects a PE file into a foreign processes 8->29 11 csc.exe 8->11         started        13 conhost.exe 8->13         started        process6 process7 15 WerFault.exe 23 18 11->15         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
15.164.165.52.in-addr.arpa unknown unknown