Edit tour

Windows Analysis Report
AWB DHL#40882993049403.pdf.exe

Overview

General Information

Sample name:	AWB DHL#40882993049403.pdf.exe
Analysis ID:	1466213
MD5:	e31da8df37174250f302c4640f97ba15
SHA1:	8fad39b3196f439d96fb662161c868de0dc36b9c
SHA256:	92dc348193523762bc873e593467abfb04b3509f650976608e6c89436eea993f
Tags:	DHLexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

AWB DHL#40882993049403.pdf.exe (PID: 1984 cmdline: "C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe" MD5: E31DA8DF37174250F302C4640F97BA15)

RegSvcs.exe (PID: 5660 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elektronikkutu.com", "Username": "info@elektronikkutu.com", "Password": "9U:e3@wpS3:U7h_V"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4515977938.000000000317E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 5660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5660	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32395:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32407:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32491:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32523:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3258d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32695:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32725:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34195:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34207:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34291:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34323:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34495:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34525:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32395:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32407:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32491:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32523:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3258d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32695:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32725:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34195:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f7b5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34207:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f827:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34291:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f8b1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34323:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f943:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f9ad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fa1f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34495:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fab5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34525:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fb45:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34195:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f9b5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaafd5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34207:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fa27:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xab047:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34291:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6fab1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xab0d1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34323:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fb43:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xab163:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3438d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fbad:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xab1cd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fc1f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xab23f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34495:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6fcb5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xab2d5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe", CommandLine: "C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe, NewProcessName: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe, OriginalFileName: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe", ProcessId: 1984, ProcessName: AWB DHL#40882993049403.pdf.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 94.73.188.44, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 5660, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49710

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.987984
SID:	2030171
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.987984
SID:	2839723
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.988045
SID:	2851779
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.988045
SID:	2840032
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.988045
SID:	2855542
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 94.73.188.44

Timestamp:	07/02/24-17:32:05.988045
SID:	2855245
Source Port:	49710
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.elektronikkutu.com", "Username": "info@elektronikkutu.com", "Password": "9U:e3@wpS3:U7h_V"}

Multi AV Scanner detection for submitted file

Source: AWB DHL#40882993049403.pdf.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: AWB DHL#40882993049403.pdf.exe

Joe Sandbox ML: detected

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: JJHI.pdbSHA256 source: AWB DHL#40882993049403.pdf.exe
Source:	Binary string: JJHI.pdb source: AWB DHL#40882993049403.pdf.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49710 -> 94.73.188.44:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.5:49710 -> 94.73.188.44:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49710 -> 94.73.188.44:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49710 -> 94.73.188.44:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49710 -> 94.73.188.44:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.5:49710 -> 94.73.188.44:587

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 94.73.188.44:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 94.73.188.44 94.73.188.44

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: CIZGITR CIZGITR

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.5:49710 -> 94.73.188.44:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.elektronikkutu.com

Source: AWB DHL#40882993049403.pdf.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: AWB DHL#40882993049403.pdf.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: RegSvcs.exe, 00000003.00000002.4515977938.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4514810650.0000000001547000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4515977938.0000000003121000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.elektronikkutu.com
Source: RegSvcs.exe, 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mx-out05.natrohost.com
Source: AWB DHL#40882993049403.pdf.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087276155.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4515977938.0000000003121000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: AWB DHL#40882993049403.pdf.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, xljC6U.cs	.Net Code: Qaz
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, xljC6U.cs	.Net Code: Qaz

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.AWB DHL#40882993049403.pdf.exe.64c0000.5.raw.unpack, -Module-.cs

Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088

.NET source code contains very large strings

Source: AWB DHL#40882993049403.pdf.exe, frm_login.cs

Long String: Length: 97210

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: AWB DHL#40882993049403.pdf.exe

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_02D3D5BC	0_2_02D3D5BC
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_053E6C00	0_2_053E6C00
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_053E0006	0_2_053E0006
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_053E0040	0_2_053E0040
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_053E6BF0	0_2_053E6BF0
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A22538	0_2_05A22538
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A22548	0_2_05A22548
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26728	0_2_05A26728
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A2D710	0_2_05A2D710
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26718	0_2_05A26718
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A226DB	0_2_05A226DB
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A2F628	0_2_05A2F628
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26168	0_2_05A26168
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26178	0_2_05A26178
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A2DF80	0_2_05A2DF80
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26F88	0_2_05A26F88
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A26F78	0_2_05A26F78
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A209E8	0_2_05A209E8
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A209F8	0_2_05A209F8
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A2DB48	0_2_05A2DB48
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A2FA60	0_2_05A2FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02F34AC8	3_2_02F34AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02F33EB0	3_2_02F33EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02F3ECE1	3_2_02F3ECE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02F3AD11	3_2_02F3AD11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02F341F8	3_2_02F341F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A40CF8	3_2_06A40CF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A42CDE	3_2_06A42CDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A41FE3	3_2_06A41FE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A41FE8	3_2_06A41FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A56630	3_2_06A56630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A5B278	3_2_06A5B278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A530A0	3_2_06A530A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A5C1C8	3_2_06A5C1C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A551D8	3_2_06A551D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A57DC0	3_2_06A57DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A576E0	3_2_06A576E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A5E3E8	3_2_06A5E3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A50040	3_2_06A50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A5591F	3_2_06A5591F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A50038	3_2_06A50038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A50007	3_2_06A50007

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: invalid certificate

Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087276155.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedafe0966-c26d-4e7d-b1a5-d41abe896bab.exe4 vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2085769454.000000000104E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2090251488.00000000064C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2090623875.0000000008560000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000000.2054967991.0000000000A62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJJHI.exe* vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedafe0966-c26d-4e7d-b1a5-d41abe896bab.exe4 vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs AWB DHL#40882993049403.pdf.exe
Source: AWB DHL#40882993049403.pdf.exe	Binary or memory string: OriginalFilenameJJHI.exe* vs AWB DHL#40882993049403.pdf.exe

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, 9O2OLI.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, hdYUG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, LGBZ4N2f.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, F8OmG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, Bgo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, k7FmsUgnvL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, qO4Z9xt0en1avIDhdN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: _0020.SetAccessControl
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: _0020.AddAccessRule
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, qO4Z9xt0en1avIDhdN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: _0020.SetAccessControl
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AWB DHL#40882993049403.pdf.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AWB DHL#40882993049403.pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000000.2054967991.0000000000A62000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: INSERT INTO tab_grade (gId, gName) VALUES(NULL, @gName);SELECT @@IDENTITY# Add successfullyInfo%Add unsuccessfully-Grade name not changed

Source: AWB DHL#40882993049403.pdf.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe "C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe"
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: JJHI.pdbSHA256 source: AWB DHL#40882993049403.pdf.exe
Source:	Binary string: JJHI.pdb source: AWB DHL#40882993049403.pdf.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: AWB DHL#40882993049403.pdf.exe, frm_login.cs	.Net Code: InitializeComponent
Source: 0.2.AWB DHL#40882993049403.pdf.exe.64c0000.5.raw.unpack, -Module-.cs	.Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.AWB DHL#40882993049403.pdf.exe.64c0000.5.raw.unpack, PingPong.cs	.Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	.Net Code: kjIFxWek42 System.Reflection.Assembly.Load(byte[])
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	.Net Code: kjIFxWek42 System.Reflection.Assembly.Load(byte[])

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: 0xFFBAF889 [Wed Dec 16 21:50:01 2105 UTC]

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_02D3F110 pushad ; iretd	0_2_02D3F111
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A24C38 push esp; retf	0_2_05A24C39
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Code function: 0_2_05A20C01 push 8BBCEB50h; ret	0_2_05A20C07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A46CC4 push esp; iretd	3_2_06A46CFD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A40F01 pushfd ; iretd	3_2_06A40F0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A4B691 push es; ret	3_2_06A4B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06A47312 push es; ret	3_2_06A47320

Source: AWB DHL#40882993049403.pdf.exe

Static PE information: section name: .text entropy: 7.160837106255626

Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, Ll3PIg3HHj4jqsAJXv.cs	High entropy of concatenated method names: 'B4JNEGhmCi', 'A8DNvXMhFY', 'ToString', 'rn3Nclr2VB', 'cWwNahyDMT', 'VJ3NQN2Paw', 'yJsNlOH3Ki', 'druN70l6ci', 'cQ2NZcIuc1', 'z9xN4yUqMk'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	High entropy of concatenated method names: 'XbsSL8IFtq', 'QRIScBW6y3', 'XrpSaDCfwB', 'qDOSQBy7M7', 'PUuSlIeGim', 'doSS74lsRJ', 'S6USZl0LGk', 'zFbS45tG1H', 'vAcSt5v0pN', 'xCxSEtjKK1'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, dOmZvwYcJ3bJQ1K7e3.cs	High entropy of concatenated method names: 'niW7LxImRF', 'G1D7abyQcv', 'sJB7l1rRVJ', 'p8n7Za3gCg', 'PNu74R2MgT', 'ii2lyZUnUt', 'mYnl5p0bnE', 'vAylbkaVWp', 'tIHl1b5lR3', 'TDrlh2KN3e'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, XavOPJ7y9FcfyvCWjV.cs	High entropy of concatenated method names: 'f4GQwK4XU1', 'T1DQVEd9pl', 'rG4Qsvr9ew', 'jsGQgbxsXK', 'DqnQ3FAy7U', 'cZ3Q20S5Ka', 'aJrQNpqhWB', 'wZaQHitoAu', 'nY5QdJehtV', 'YapQTwyD09'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, KRSvHCcV7gUZ39QS3e.cs	High entropy of concatenated method names: 'wLUZcSBibi', 'MpfZQiyD2t', 'ABAZ7dMTJ5', 'yas7iDVNME', 'MqX7zF0uks', 'zT4Z9DCgJk', 'A0kZ6hxdJt', 'wGwZql9TiH', 'QZvZSn0rEv', 'i8aZFM1mMH'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, Qm7wtfItMS1KZhC0BH.cs	High entropy of concatenated method names: 'yhDd6WSrP8', 'fBsdSOem2a', 'cnndFL6yho', 'tmmdcyKYUj', 'j5cdausMCZ', 'Ie9dlPsFaT', 'AhEd78dBLO', 'nBxHbMjfGA', 'uurH1qjXEl', 'YtgHhUsDLh'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, gUYTx7zTaHPcA8E230.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bNNdOQPXxp', 'jgKd3lclWy', 'gCid2OiWCi', 'Uv2dNg9MI3', 'DoGdHCd1Aw', 'XoMddT1GG7', 'PDadT1AxF0'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, ohc82Wdo6MQn9twU9X.cs	High entropy of concatenated method names: 'iMiHKU9iq1', 'ID4HnrA3Bh', 'QhsH8tGdeU', 'EnnHJCwk3K', 'XntHmd6DHh', 'zwNHPyZDlg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, GRS3NlF8YJ6uTX5DNu.cs	High entropy of concatenated method names: 'ghU6ZmyHYM', 'K2T64nE31G', 's5G6ENebqQ', 'eBY6vANwVI', 'cUg632EHaF', 'QNJ626stL1', 'hnaexYfaNgasKRoQpF', 'OvS78OnIXiUDSkxhOF', 'UJH66xbygl', 'TGu6S04qvI'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, Q2hIxEW7puPvXh91u4.cs	High entropy of concatenated method names: 'ToString', 'eF92k818HQ', 'IY32nF52ln', 'JIb28ZGEjc', 'unC2Jfx03x', 'bVX2PIY6wv', 'oLh2W5Q1p6', 'mpM2DdUV1j', 'xiU2BAa0Ha', 'gpg2jONs8h'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, bo55ekTyRCk67yIfAQ.cs	High entropy of concatenated method names: 'bvwZoGyJc5', 'TaPZfT6ySY', 'tRqZxbtJ5X', 'tHcZwSOXjR', 'p97ZI6p49D', 'HchZVgqRnT', 'CXWZYYXjHg', 'nMlZs3IuX5', 'JuIZgaJNqx', 'GF9ZpbZFVA'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, bnoHRT9hdPt9cQOBU9.cs	High entropy of concatenated method names: 'ppPx84nJf', 'LAjwErKeO', 'pAjVwBl0p', 'y82YZZfFD', 'H46ge5JZJ', 'ueYpTh0tl', 'E0Tq0DBTuxpU8OP1pJ', 'RjZQ67ifY4gYqaTTWD', 'H24HdtPoT', 'GiTTNwHTH'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, BEW4rqhvQAwW9nbdY9.cs	High entropy of concatenated method names: 'MgKN1xVanX', 'gOnNiJadQN', 'XCfH9FoS6L', 'AUUH6aXcwK', 'Pi8Nk5Mp4P', 'c5rNUlvnaj', 'horNr8scrp', 'gwJNmyqNTK', 'yVKNRl7TaZ', 'LLANXUS2sb'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, EPPBiYLMwfOahZetcr.cs	High entropy of concatenated method names: 'AuFOsrcZWK', 'SROOgrcYFR', 'zvtOKlpbVR', 'oWxOnGjwnf', 'RQQOJRNfhA', 'im8OPQaGI5', 'pOEODc9Hws', 'nvaOBidSpV', 'R76OMOs2lO', 'GvSOkYNr6A'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, fwVJJWlEtVmSefL0fCG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZmTmFjAHV', 'S29TRbpERu', 'cLJTXgSQQT', 'vcCT0HgC27', 'w1YTy1CJjY', 'bs4T5CMDEq', 'u8rTbW4OQB'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, qO4Z9xt0en1avIDhdN.cs	High entropy of concatenated method names: 'rnyam0NnwA', 'xHyaRwOhfR', 'UbEaXMHpcY', 'kKga0PSoVi', 'tTdaywFE6x', 'BLfa5y4NDD', 'X7Sab1DhKc', 'ca1a1IKK41', 'V1hahwlVZh', 'U6YaiGpi4O'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, MaVoDSlp9MC9bZAmJYs.cs	High entropy of concatenated method names: 'gFtdooMBgc', 'JBEdf7ZGCg', 'jIxdxBEPmS', 'PrMdwwypi1', 'lAPdIGCwsK', 'hW3dVQ4DwL', 'WYwdYxjeJ5', 'bMedsduLC6', 'e7hdgQwweJ', 'Xqrdp13K7G'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, JL7gbFo71R8eaKTWhv.cs	High entropy of concatenated method names: 'Dispose', 'wKk6hjhgTA', 'imVqntJCtD', 'hqCuuIGGrl', 'zIH6iloXwl', 'L316zFoult', 'ProcessDialogKey', 'VZHq95cjvk', 'DY4q6rQsu9', 'Scnqq2MQkr'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, WWrdoQvMO4I0paKyTU.cs	High entropy of concatenated method names: 'cal3M4pgJe', 'V2j3UTjaCu', 'uUU3mTU3Hp', 'd8Q3RiQHSU', 'pEM3n7mcDO', 'wp838hoFaY', 'K1B3JIfqkk', 'b1M3PiLdJ5', 'ii33Wo9JdI', 'cFj3D45Ps8'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.4143c48.2.raw.unpack, Mia6hjeLSVY2LFjtdt.cs	High entropy of concatenated method names: 'IAKHc0XmK5', 'zC8HaSlvhN', 'TL9HQ6AQIO', 'jGAHlcecme', 'vIMH79qvmb', 'SwcHZ9p4Vk', 'VDUH4eQYQH', 'EOYHtYr4sB', 'vIjHEBhYWV', 'fDZHvds176'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, Ll3PIg3HHj4jqsAJXv.cs	High entropy of concatenated method names: 'B4JNEGhmCi', 'A8DNvXMhFY', 'ToString', 'rn3Nclr2VB', 'cWwNahyDMT', 'VJ3NQN2Paw', 'yJsNlOH3Ki', 'druN70l6ci', 'cQ2NZcIuc1', 'z9xN4yUqMk'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, PaFAxtkSXK2Z0KMn6S.cs	High entropy of concatenated method names: 'XbsSL8IFtq', 'QRIScBW6y3', 'XrpSaDCfwB', 'qDOSQBy7M7', 'PUuSlIeGim', 'doSS74lsRJ', 'S6USZl0LGk', 'zFbS45tG1H', 'vAcSt5v0pN', 'xCxSEtjKK1'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, dOmZvwYcJ3bJQ1K7e3.cs	High entropy of concatenated method names: 'niW7LxImRF', 'G1D7abyQcv', 'sJB7l1rRVJ', 'p8n7Za3gCg', 'PNu74R2MgT', 'ii2lyZUnUt', 'mYnl5p0bnE', 'vAylbkaVWp', 'tIHl1b5lR3', 'TDrlh2KN3e'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, XavOPJ7y9FcfyvCWjV.cs	High entropy of concatenated method names: 'f4GQwK4XU1', 'T1DQVEd9pl', 'rG4Qsvr9ew', 'jsGQgbxsXK', 'DqnQ3FAy7U', 'cZ3Q20S5Ka', 'aJrQNpqhWB', 'wZaQHitoAu', 'nY5QdJehtV', 'YapQTwyD09'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, KRSvHCcV7gUZ39QS3e.cs	High entropy of concatenated method names: 'wLUZcSBibi', 'MpfZQiyD2t', 'ABAZ7dMTJ5', 'yas7iDVNME', 'MqX7zF0uks', 'zT4Z9DCgJk', 'A0kZ6hxdJt', 'wGwZql9TiH', 'QZvZSn0rEv', 'i8aZFM1mMH'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, Qm7wtfItMS1KZhC0BH.cs	High entropy of concatenated method names: 'yhDd6WSrP8', 'fBsdSOem2a', 'cnndFL6yho', 'tmmdcyKYUj', 'j5cdausMCZ', 'Ie9dlPsFaT', 'AhEd78dBLO', 'nBxHbMjfGA', 'uurH1qjXEl', 'YtgHhUsDLh'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, gUYTx7zTaHPcA8E230.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bNNdOQPXxp', 'jgKd3lclWy', 'gCid2OiWCi', 'Uv2dNg9MI3', 'DoGdHCd1Aw', 'XoMddT1GG7', 'PDadT1AxF0'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, ohc82Wdo6MQn9twU9X.cs	High entropy of concatenated method names: 'iMiHKU9iq1', 'ID4HnrA3Bh', 'QhsH8tGdeU', 'EnnHJCwk3K', 'XntHmd6DHh', 'zwNHPyZDlg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, GRS3NlF8YJ6uTX5DNu.cs	High entropy of concatenated method names: 'ghU6ZmyHYM', 'K2T64nE31G', 's5G6ENebqQ', 'eBY6vANwVI', 'cUg632EHaF', 'QNJ626stL1', 'hnaexYfaNgasKRoQpF', 'OvS78OnIXiUDSkxhOF', 'UJH66xbygl', 'TGu6S04qvI'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, Q2hIxEW7puPvXh91u4.cs	High entropy of concatenated method names: 'ToString', 'eF92k818HQ', 'IY32nF52ln', 'JIb28ZGEjc', 'unC2Jfx03x', 'bVX2PIY6wv', 'oLh2W5Q1p6', 'mpM2DdUV1j', 'xiU2BAa0Ha', 'gpg2jONs8h'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, bo55ekTyRCk67yIfAQ.cs	High entropy of concatenated method names: 'bvwZoGyJc5', 'TaPZfT6ySY', 'tRqZxbtJ5X', 'tHcZwSOXjR', 'p97ZI6p49D', 'HchZVgqRnT', 'CXWZYYXjHg', 'nMlZs3IuX5', 'JuIZgaJNqx', 'GF9ZpbZFVA'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, bnoHRT9hdPt9cQOBU9.cs	High entropy of concatenated method names: 'ppPx84nJf', 'LAjwErKeO', 'pAjVwBl0p', 'y82YZZfFD', 'H46ge5JZJ', 'ueYpTh0tl', 'E0Tq0DBTuxpU8OP1pJ', 'RjZQ67ifY4gYqaTTWD', 'H24HdtPoT', 'GiTTNwHTH'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, BEW4rqhvQAwW9nbdY9.cs	High entropy of concatenated method names: 'MgKN1xVanX', 'gOnNiJadQN', 'XCfH9FoS6L', 'AUUH6aXcwK', 'Pi8Nk5Mp4P', 'c5rNUlvnaj', 'horNr8scrp', 'gwJNmyqNTK', 'yVKNRl7TaZ', 'LLANXUS2sb'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, EPPBiYLMwfOahZetcr.cs	High entropy of concatenated method names: 'AuFOsrcZWK', 'SROOgrcYFR', 'zvtOKlpbVR', 'oWxOnGjwnf', 'RQQOJRNfhA', 'im8OPQaGI5', 'pOEODc9Hws', 'nvaOBidSpV', 'R76OMOs2lO', 'GvSOkYNr6A'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, fwVJJWlEtVmSefL0fCG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZmTmFjAHV', 'S29TRbpERu', 'cLJTXgSQQT', 'vcCT0HgC27', 'w1YTy1CJjY', 'bs4T5CMDEq', 'u8rTbW4OQB'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, qO4Z9xt0en1avIDhdN.cs	High entropy of concatenated method names: 'rnyam0NnwA', 'xHyaRwOhfR', 'UbEaXMHpcY', 'kKga0PSoVi', 'tTdaywFE6x', 'BLfa5y4NDD', 'X7Sab1DhKc', 'ca1a1IKK41', 'V1hahwlVZh', 'U6YaiGpi4O'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, MaVoDSlp9MC9bZAmJYs.cs	High entropy of concatenated method names: 'gFtdooMBgc', 'JBEdf7ZGCg', 'jIxdxBEPmS', 'PrMdwwypi1', 'lAPdIGCwsK', 'hW3dVQ4DwL', 'WYwdYxjeJ5', 'bMedsduLC6', 'e7hdgQwweJ', 'Xqrdp13K7G'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, JL7gbFo71R8eaKTWhv.cs	High entropy of concatenated method names: 'Dispose', 'wKk6hjhgTA', 'imVqntJCtD', 'hqCuuIGGrl', 'zIH6iloXwl', 'L316zFoult', 'ProcessDialogKey', 'VZHq95cjvk', 'DY4q6rQsu9', 'Scnqq2MQkr'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, WWrdoQvMO4I0paKyTU.cs	High entropy of concatenated method names: 'cal3M4pgJe', 'V2j3UTjaCu', 'uUU3mTU3Hp', 'd8Q3RiQHSU', 'pEM3n7mcDO', 'wp838hoFaY', 'K1B3JIfqkk', 'b1M3PiLdJ5', 'ii33Wo9JdI', 'cFj3D45Ps8'
Source: 0.2.AWB DHL#40882993049403.pdf.exe.8560000.7.raw.unpack, Mia6hjeLSVY2LFjtdt.cs	High entropy of concatenated method names: 'IAKHc0XmK5', 'zC8HaSlvhN', 'TL9HQ6AQIO', 'jGAHlcecme', 'vIMH79qvmb', 'SwcHZ9p4Vk', 'VDUH4eQYQH', 'EOYHtYr4sB', 'vIjHEBhYWV', 'fDZHvds176'

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: AWB DHL#40882993049403.pdf.exe

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 2F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 8340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 7C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 9340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: A340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: A6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: B6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: 85E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: A6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Memory allocated: B6D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797110	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Window / User API: threadDelayed 1444	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2227	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe TID: 3660	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe TID: 5808	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe TID: 4708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98034	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97690	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1799094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1798110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1797110	Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000003.00000002.4520028530.0000000006552000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_02F370B8 CheckRemoteDebuggerPresent,

3_2_02F370B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4515977938.000000000317E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f74928.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AWB DHL#40882993049403.pdf.exe.3f39108.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4515977938.000000000317E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWB DHL#40882993049403.pdf.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Obfuscated Files or Information	1 Credentials in Registry	521 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Application Window Discovery	SSH	1 Clipboard Data	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWB DHL#40882993049403.pdf.exe	21%	ReversingLabs
AWB DHL#40882993049403.pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://mx-out05.natrohost.com	0%	Avira URL Cloud	safe
http://mail.elektronikkutu.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mx-out05.natrohost.com	94.73.188.44	true	true	unknown
ip-api.com	208.95.112.1	true	true	unknown
mail.elektronikkutu.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.elektronikkutu.com	RegSvcs.exe, 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AWB DHL#40882993049403.pdf.exe, 00000000.00000002.2087276155.0000000002F01000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4515977938.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	AWB DHL#40882993049403.pdf.exe	false	URL Reputation: safe	unknown
http://mx-out05.natrohost.com	RegSvcs.exe, 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000003.00000002.4515977938.0000000003121000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
94.73.188.44	mx-out05.natrohost.com	Turkey		34619	CIZGITR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466213
Start date and time:	2024-07-02 17:31:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AWB DHL#40882993049403.pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 131 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: AWB DHL#40882993049403.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
11:32:00	API Interceptor	12x Sleep call for process: AWB DHL#40882993049403.pdf.exe modified
11:32:02	API Interceptor	11889984x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ServerManager.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
94.73.188.44	PAYMENT SLIP.com.exe	Get hash	malicious	AgentTesla	Browse
	COTA#U00c7#U00c3O para fornecedores em branco - termometro digital.exe	Get hash	malicious	AgentTesla	Browse
	CTe 002-8-0167948-2.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.10093.13071.exe	Get hash	malicious	AgentTesla	Browse
	SHIPMENT NO-369555440.scr.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.PackedNET.2511.647.11120.exe	Get hash	malicious	AgentTesla	Browse
	Payment_Advice-MT103.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mx-out05.natrohost.com	PAYMENT SLIP.com.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	COTA#U00c7#U00c3O para fornecedores em branco - termometro digital.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	CTe 002-8-0167948-2.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	SecuriteInfo.com.Win32.PWSX-gen.10093.13071.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	SHIPMENT NO-369555440.scr.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	SecuriteInfo.com.Trojan.PackedNET.2511.647.11120.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	Payment_Advice-MT103.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
ip-api.com	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CIZGITR	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Potvrda narudzbe u prilogu.exe	Get hash	malicious	DBatLoader, FormBook	Browse	85.159.66.93
	Document TOP19928.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	U prilogu lista novih narudzbi.exe	Get hash	malicious	DBatLoader, FormBook	Browse	85.159.66.93
	PAYMENT SLIP.com.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	hdBLUdo056.exe	Get hash	malicious	FormBook	Browse	94.73.151.78
	fiY5fTkFKk.rtf	Get hash	malicious	FormBook	Browse	94.73.151.78
	tEBdYCAxQC.rtf	Get hash	malicious	FormBook	Browse	94.73.151.78
	COTA#U00c7#U00c3O para fornecedores em branco - termometro digital.exe	Get hash	malicious	AgentTesla	Browse	94.73.188.44
	wOoESPII08.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
TUT-ASUS	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.334025345208678
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4VE4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HT
MD5:	C8D49A85A61847AAE0536AE8856F6DEC
SHA1:	D4121C87789F6AE40FCB9B4F896BC2A0C79182AD
SHA-256:	3F7809C712D948FF3404AE242044B5463E60BCDCE93121886F8CB36799D4E3CE
SHA-512:	FFD3460D5B6F00C49D7A91B299765BB7620B440718DACA711566C41A0C153F51E936EE479F4B9E002794EF2E0EBFFCED32ACE15CF9C7A892248EFA6A42468D51
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.1695055566876755
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AWB DHL#40882993049403.pdf.exe
File size:	1'013'256 bytes
MD5:	e31da8df37174250f302c4640f97ba15
SHA1:	8fad39b3196f439d96fb662161c868de0dc36b9c
SHA256:	92dc348193523762bc873e593467abfb04b3509f650976608e6c89436eea993f
SHA512:	d9d75d8a6e97823556954a2a64a2a177fd1b7fe14694b60256fd541d0bde37c216e3b7786f64efaffac359734e88a268f18fc820e39ab72835f7b72b2d9cccf8
SSDEEP:	24576:bQ8SlsKocVQbsI6uadmVnmI7VH0GkGKCjR8Y:XXKfIkm0I7VHPXjuY
TLSH:	9A251AF4FEE55B3AF1E1AEF33788E5DE512EF2B205165A796B0467012220D504CB7B22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..6...........U... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4f551e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFFBAF889 [Wed Dec 16 21:50:01 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf54c9	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf6000	0x5a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf4000	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf2b3c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf3524	0xf3600	760e43ff73f1abcdf3b5a1902cfd7bf4	False	0.6791357697740112	data	7.160837106255626	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf6000	0x5a4	0x600	dff63c9db911fafed1a46526db5108d0	False	0.4303385416666667	data	4.0956163971257045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf8000	0xc	0x200	6f0c24164065ef7e2f7538f4a590d484	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xf6090	0x314	data			0.44543147208121825
RT_MANIFEST	0xf63b4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-17:32:05.987984	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49710	587	192.168.2.5	94.73.188.44
07/02/24-17:32:05.987984	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49710	587	192.168.2.5	94.73.188.44
07/02/24-17:32:05.988045	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49710	587	192.168.2.5	94.73.188.44
07/02/24-17:32:05.988045	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49710	587	192.168.2.5	94.73.188.44
07/02/24-17:32:05.988045	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49710	587	192.168.2.5	94.73.188.44
07/02/24-17:32:05.988045	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49710	587	192.168.2.5	94.73.188.44

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 17:32:02.368626118 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:32:02.373454094 CEST	80	49708	208.95.112.1	192.168.2.5
Jul 2, 2024 17:32:02.373519897 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:32:02.377576113 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:32:02.382436037 CEST	80	49708	208.95.112.1	192.168.2.5
Jul 2, 2024 17:32:02.853199005 CEST	80	49708	208.95.112.1	192.168.2.5
Jul 2, 2024 17:32:02.908859015 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:32:03.875037909 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:03.880093098 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:03.880183935 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:04.511312962 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:04.511496067 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:04.518132925 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:04.732882977 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:04.733956099 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:04.738878965 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:04.953203917 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:04.953497887 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:04.958317041 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.183937073 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.184191942 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.189007044 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.544742107 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.546382904 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.551331997 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.766474009 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.766946077 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.771820068 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.987466097 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.987983942 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.988044977 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.988075972 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.988084078 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:05.992799997 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.993066072 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.993165016 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:05.993175030 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:06.754036903 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:32:06.797653913 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:32:53.719795942 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:32:53.725198030 CEST	80	49708	208.95.112.1	192.168.2.5
Jul 2, 2024 17:32:53.725270987 CEST	49708	80	192.168.2.5	208.95.112.1
Jul 2, 2024 17:33:06.754215002 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:33:06.754407883 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:33:43.735503912 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:33:43.735586882 CEST	49710	587	192.168.2.5	94.73.188.44
Jul 2, 2024 17:33:43.740531921 CEST	587	49710	94.73.188.44	192.168.2.5
Jul 2, 2024 17:33:43.740545034 CEST	587	49710	94.73.188.44	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 17:32:02.350795984 CEST	60308	53	192.168.2.5	1.1.1.1
Jul 2, 2024 17:32:02.358156919 CEST	53	60308	1.1.1.1	192.168.2.5
Jul 2, 2024 17:32:03.716209888 CEST	64803	53	192.168.2.5	1.1.1.1
Jul 2, 2024 17:32:03.873982906 CEST	53	64803	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 17:32:02.350795984 CEST	192.168.2.5	1.1.1.1	0x5bb0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 17:32:03.716209888 CEST	192.168.2.5	1.1.1.1	0x3f91	Standard query (0)	mail.elektronikkutu.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 17:32:02.358156919 CEST	1.1.1.1	192.168.2.5	0x5bb0	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 2, 2024 17:32:03.873982906 CEST	1.1.1.1	192.168.2.5	0x3f91	No error (0)	mail.elektronikkutu.com	mx-out05.natrohost.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 2, 2024 17:32:03.873982906 CEST	1.1.1.1	192.168.2.5	0x3f91	No error (0)	mx-out05.natrohost.com		94.73.188.44	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	208.95.112.1	80	5660	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 17:32:02.377576113 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 17:32:02.853199005 CEST	175	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 15:32:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 2, 2024 17:32:04.511312962 CEST	587	49710	94.73.188.44	192.168.2.5	220 vsp-in13.natrohost.com ESMTP
Jul 2, 2024 17:32:04.511496067 CEST	49710	587	192.168.2.5	94.73.188.44	EHLO 849224
Jul 2, 2024 17:32:04.732882977 CEST	587	49710	94.73.188.44	192.168.2.5	250-vsp-in13.natrohost.com 250-PIPELINING 250-SIZE 52428800 250-STARTTLS 250-AUTH LOGIN PLAIN 250-ENHANCEDSTATUSCODES 250 8BITMIME
Jul 2, 2024 17:32:04.733956099 CEST	49710	587	192.168.2.5	94.73.188.44	AUTH login aW5mb0BlbGVrdHJvbmlra3V0dS5jb20=
Jul 2, 2024 17:32:04.953203917 CEST	587	49710	94.73.188.44	192.168.2.5	334 UGFzc3dvcmQ6
Jul 2, 2024 17:32:05.183937073 CEST	587	49710	94.73.188.44	192.168.2.5	235 2.7.0 Ok
Jul 2, 2024 17:32:05.184191942 CEST	49710	587	192.168.2.5	94.73.188.44	MAIL FROM:<info@elektronikkutu.com>
Jul 2, 2024 17:32:05.544742107 CEST	587	49710	94.73.188.44	192.168.2.5	250 2.1.0 Ok
Jul 2, 2024 17:32:05.546382904 CEST	49710	587	192.168.2.5	94.73.188.44	RCPT TO:<smt.treat@yandex.com>
Jul 2, 2024 17:32:05.766474009 CEST	587	49710	94.73.188.44	192.168.2.5	250 2.1.5 Ok
Jul 2, 2024 17:32:05.766946077 CEST	49710	587	192.168.2.5	94.73.188.44	DATA
Jul 2, 2024 17:32:05.987466097 CEST	587	49710	94.73.188.44	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
Jul 2, 2024 17:32:05.988084078 CEST	49710	587	192.168.2.5	94.73.188.44	.
Jul 2, 2024 17:32:06.754036903 CEST	587	49710	94.73.188.44	192.168.2.5	250 2.0.0 Ok: queued as 3bee0651-3888-11ef-bf4f-6f88f3e6c78f
Jul 2, 2024 17:33:43.735503912 CEST	49710	587	192.168.2.5	94.73.188.44	QUIT

Target ID:	0
Start time:	11:31:58
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AWB DHL#40882993049403.pdf.exe"
Imagebase:	0xa60000
File size:	1'013'256 bytes
MD5 hash:	E31DA8DF37174250F302C4640F97BA15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2087795023.0000000003F01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:32:01
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xe30000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4515977938.0000000003184000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4515977938.000000000317E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4513620434.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4515977938.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	2

Executed Functions

Function 053E6BF0 Relevance: .8, Instructions: 777COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089054014.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f59202a341b93f8f9c3ed5ebbb73d3fda3560632ac755fa3330d06febc9ecfe
Instruction ID: a5bba52ba0d0b2ff8796017e218440acfb13191961b76dda6c46faa4ac5793e5
Opcode Fuzzy Hash: 6f59202a341b93f8f9c3ed5ebbb73d3fda3560632ac755fa3330d06febc9ecfe
Instruction Fuzzy Hash: 7782E534A10229CFDB14EF68D895B99B7B2FF8A300F5185E9D4496B360DB30AE85CF51

Function 053E6C00 Relevance: .8, Instructions: 772COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089054014.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ef1f07c5ec957ecf8f8b4d5af59a7b062888c9f5111623ab5194df42a97bc9
Instruction ID: 97c0c7d5c5199623cbadae809f6e240e441784371a96f60caca38f6d8bdd6a66
Opcode Fuzzy Hash: 58ef1f07c5ec957ecf8f8b4d5af59a7b062888c9f5111623ab5194df42a97bc9
Instruction Fuzzy Hash: B382E434A10229CFDB14EF68D895B99B7B2FF8A300F5185E9D4496B360DB30AE85CF51

Function 02D3ADA8 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02D3AFFE

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d0f89b8d4a83c0846bccd29910a956790bcf230c5f7c88a10e9d2644bbc38f94
Instruction ID: fde69d2a6e361c1e4709cae58533bb5265fd57d149ec4f4ed67c1c3a4eac2198
Opcode Fuzzy Hash: d0f89b8d4a83c0846bccd29910a956790bcf230c5f7c88a10e9d2644bbc38f94
Instruction Fuzzy Hash: D97112B0A00B058FD725DF29D44475ABBF1FF88604F108A2ED48AE7B50E775E845CB90

Function 05A2E8D8 Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 05A2EDE8

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: b6d15bff1fa66af1c999470ac7f0a45d29562bb5e0f3c1e948502db8bd34034d
Instruction ID: a48c83cba9bca4c6bc5858516b2cfa40e02701141c9e6fab29e8257a5fee6e88
Opcode Fuzzy Hash: b6d15bff1fa66af1c999470ac7f0a45d29562bb5e0f3c1e948502db8bd34034d
Instruction Fuzzy Hash: 85E19174B0021ADFDB05EFACD494AAEBBB7FB88300F118059E505A7365DB34AD85CB51

Function 02D344B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D359C9

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8977474da1819743fca7a65c621c3e7f3f901e48e8704512cd900bbfa703b3b3
Instruction ID: d13e4c6faf21e24687c692e6a46b3ee992123b37e8747c970677114e1e373395
Opcode Fuzzy Hash: 8977474da1819743fca7a65c621c3e7f3f901e48e8704512cd900bbfa703b3b3
Instruction Fuzzy Hash: AC41DFB0C0061DCBDB25CFA9C884BDEBBB5BF49304F60806AD408AB255DB756949CFA1

Function 02D3590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D359C9

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9ba491447d37ce8198297771a76e603ba594026d36782232df612ad891d2728c
Instruction ID: 4bd6a31e1b24e998dd516634196775b0dc25d8ca3417861fbbc200234376ccb5
Opcode Fuzzy Hash: 9ba491447d37ce8198297771a76e603ba594026d36782232df612ad891d2728c
Instruction Fuzzy Hash: C441DFB1C00619CBDB25CFA9C884BCEBBB5BF49304F60806AD408AB255DB71694ACF91

Function 053E4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 053E4101

Memory Dump Source

Source File: 00000000.00000002.2089054014.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_AWB DHL#40882993049403.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 0c49132df491521199b001de71dea23697a300926216dacc2956d6c3b41460b7
Instruction ID: 22954527deb00e2d9c9b2016fc0a985b2ae87e80a680c473c7ce516707b9890e
Opcode Fuzzy Hash: 0c49132df491521199b001de71dea23697a300926216dacc2956d6c3b41460b7
Instruction Fuzzy Hash: 2341F5B8900359CFCB14CF99C888AAAFBF5FB88314F25C459D519AB361D775A841CFA0

Function 02D3D751 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02D3D656,?,?,?,?,?), ref: 02D3D717

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 74f400410f8af67a4ae87ebeae4df59ca223464b574aa4c987df11e7baeef36f
Instruction ID: 4ef1f4f10c4a9cfb5f62c122d3ed5b7be119442acfdc274798884b0e8e1ba380
Opcode Fuzzy Hash: 74f400410f8af67a4ae87ebeae4df59ca223464b574aa4c987df11e7baeef36f
Instruction Fuzzy Hash: A231C174A80381DFEB449F64E4597793BAAFB84315F528435F9218F7C8CAB00895CF20

Function 02D3D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02D3D656,?,?,?,?,?), ref: 02D3D717

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25ca100e2e4ffe1dbc10bbfe203341c31828750b4e971ca229d3279d13ea2ce0
Instruction ID: 090836c0167286f9edd015fcf51887f609e69bb71ec93007bd08b9a01faa35d5
Opcode Fuzzy Hash: 25ca100e2e4ffe1dbc10bbfe203341c31828750b4e971ca229d3279d13ea2ce0
Instruction Fuzzy Hash: A82103B5D002489FDB10CF9AD884ADEFBF9EB48310F10805AE919A3310D374A950CFA5

Function 02D3D689 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02D3D656,?,?,?,?,?), ref: 02D3D717

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 237d4800a00b3d89dcd28d3a0ffec1cb950dfaf95a2e15eee724788b84763660
Instruction ID: f502cfe00622c84293b789eb2bac3082d5a60dfe5c3d4f82be9521c3c0d01aab
Opcode Fuzzy Hash: 237d4800a00b3d89dcd28d3a0ffec1cb950dfaf95a2e15eee724788b84763660
Instruction Fuzzy Hash: FF2112B5D002499FDB10CFA9D584ADEFBF5EB48314F14805AE818A3310C338A954CF61

Function 02D3A130 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02D3B079,00000800,00000000,00000000), ref: 02D3B28A

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 330d5c7615ca4a0f251dfff94e19a4865ccbb2ed42670b69e134b7ccabc75682
Instruction ID: 1c06a4772370e1ee25aca4b87f9b5314c05e201061bc5a2bf16d84f8490595b9
Opcode Fuzzy Hash: 330d5c7615ca4a0f251dfff94e19a4865ccbb2ed42670b69e134b7ccabc75682
Instruction Fuzzy Hash: A21100BAD002499FCB10CF9AD448A9EFBF4EB88314F10856AE919A7710C375A945CFA5

Function 02D3B218 Relevance: 1.6, APIs: 1, Instructions: 51
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02D3B079,00000800,00000000,00000000), ref: 02D3B28A

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e668eabbcd11f9dff95cbe9f6def6228919c43ea612e4dfdb40a5cf01b83654a
Instruction ID: 5e18d853749a1b991bf9ad785687758f0847bfedde437c96390693e788f8d088
Opcode Fuzzy Hash: e668eabbcd11f9dff95cbe9f6def6228919c43ea612e4dfdb40a5cf01b83654a
Instruction Fuzzy Hash: 9C1112BAC003498FDB10CFAAD584BDEFBF4BB48314F10856AD419A7600C374A945CFA5

Function 02D3AF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02D3AFFE

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3c7b3ee8e8cce20a6422e8e015e35e37685704f00e5091009ac5bbc841095802
Instruction ID: 004ffb3b82b2b43fd5a74320c759ce232580aeb64e59324788ba3abce9c08180
Opcode Fuzzy Hash: 3c7b3ee8e8cce20a6422e8e015e35e37685704f00e5091009ac5bbc841095802
Instruction Fuzzy Hash: 4E1110B6C002498FCB10CF9AC444BDEFBF4EB88318F10845AD429A7710D375A945CFA1

Function 05A29C57 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05A29CB0

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 97e40b662bf0c7d7c30851292ac55979293501c09c40c7c9807219c7bb5471d1
Instruction ID: a6ed44560b4893c7ea233eaa6d9eb45e426aacdf53681b1f8c8e5550266b996c
Opcode Fuzzy Hash: 97e40b662bf0c7d7c30851292ac55979293501c09c40c7c9807219c7bb5471d1
Instruction Fuzzy Hash: 6F41A274E05219CFDB08CFE9D4859FEBBB6FF49710F205029E509AB251C7319985DB60

Function 05A29C6E Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05A29CB0

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ecdfa8ef68471173a50de539ab47a0bbfa71fb7ded149753e7e12caa33f545f5
Instruction ID: 90950edbf66a5fc9f72baa195e1bbda9746fcf18a2b2f19ddf6ddb8bf3b94181
Opcode Fuzzy Hash: ecdfa8ef68471173a50de539ab47a0bbfa71fb7ded149753e7e12caa33f545f5
Instruction Fuzzy Hash: A731C174E05218CFDB04CFA9D885AEEBBB6BF89700F109029E919AB261C7319945CF50

Function 05A29BDB Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05A29D7E

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ce93fc27b96e62264fc2b3f585ad2f1abd93a56b48aa9539af1967f83c50d61a
Instruction ID: 1126dd25021d0243534454b5ce248c76b8ca9daa4f640a6ce88e11ae9e861af3
Opcode Fuzzy Hash: ce93fc27b96e62264fc2b3f585ad2f1abd93a56b48aa9539af1967f83c50d61a
Instruction Fuzzy Hash: 12211970E052588FDB08DFEAC4456EEBFF7AF89700F14842AC419AB358DB705946CB91

Function 05A29BE8 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05A29D7E

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 57fdea032c88953dcd08afdedac74f41fb7eb43b7252b7c60353d9e804c3412e
Instruction ID: 64e45171bea647be5143795c8cf7e3c01dba25f12a08ba3410e01bf21cc1abd6
Opcode Fuzzy Hash: 57fdea032c88953dcd08afdedac74f41fb7eb43b7252b7c60353d9e804c3412e
Instruction Fuzzy Hash: 6921E7B0E046188BDB08DFEAC5456EEBBF6AF88700F10C02AC419AB358DB701946CB50

Function 05A2EE20 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1e4a4bf9074201377fc3d324046b91ca54f57d84159b4027912d4bb17f4829
Instruction ID: 2731a4a74fa40b449dfafd399674c6bd1571bb14e83a25dde22bd3fa3b52e214
Opcode Fuzzy Hash: ce1e4a4bf9074201377fc3d324046b91ca54f57d84159b4027912d4bb17f4829
Instruction Fuzzy Hash: 3651A071B082258FCF15AFBCC455ABEBAB7AB88710F10096DD416AB391DF319E4187A1

Function 05A2F1A8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebba2016802cdf900d99fe9d2cceff05e8d1fbcf33837549c3b035a38c7b8f2f
Instruction ID: 254b69b9d762a782d162c3cf4a3f404d0bb0ba34385d7cf4c35b34ee01473639
Opcode Fuzzy Hash: ebba2016802cdf900d99fe9d2cceff05e8d1fbcf33837549c3b035a38c7b8f2f
Instruction Fuzzy Hash: 1151F875B042269FCB18DF7DC8569BEBBF7BF8A200B10846AD455DB351DA348C41CB91

Function 05A2A418 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198942d831f558044b7d467594764272824c108a939d8c9760bc1f3b7d754d4f
Instruction ID: 33e91198b75b0da5297dab6fb08cd5e822836a49e898f9b32c5c134591c5692c
Opcode Fuzzy Hash: 198942d831f558044b7d467594764272824c108a939d8c9760bc1f3b7d754d4f
Instruction Fuzzy Hash: 93413A74E092188FCB04CFAEC445AFEBBF6AB8C311F14E06AD519A7211D7749941CB64

Function 05A2A40B Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087ceaa03458c2bbf814dcc8bafc4e290eb12fd529c7842e3dcd71dc68b69950
Instruction ID: 1bb21498392e82447ef770dd6434a69b04d0870a449d6efcde06a27c127d3203
Opcode Fuzzy Hash: 087ceaa03458c2bbf814dcc8bafc4e290eb12fd529c7842e3dcd71dc68b69950
Instruction Fuzzy Hash: F6414D74E09258CFCB04CFADC449ABEBBF6AF89301F14E4A9D909A7251D7749941CB60

Function 05A2A417 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87b7b550510abcfe3aadcda5cf663290d5831c762fd46881471cd0d1399cc1f
Instruction ID: b8cb72da2a378fec9aa787b7fb3925075d34586c945f5b65c17ec2ded7dba010
Opcode Fuzzy Hash: e87b7b550510abcfe3aadcda5cf663290d5831c762fd46881471cd0d1399cc1f
Instruction Fuzzy Hash: F7414C74E09218CFCB04CFAEC445AEEBBF6AF8D311F14E06AD919A7251D7748941CB64

Function 05A2A658 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7832abfe71ab3c4cae152fdcb4c9bf4955f8d8c4b525942057b7cd859656a016
Instruction ID: d5ce6c5d165907ca37e343d141ef8cd4099246416882ecb7da0d9d412433ce70
Opcode Fuzzy Hash: 7832abfe71ab3c4cae152fdcb4c9bf4955f8d8c4b525942057b7cd859656a016
Instruction Fuzzy Hash: E93107B4E09219DFCB04CF99C5819AEBBF6FF49310F209599D819AB312C770AA41CB91

Function 05A2F090 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7583812f8fb0d3718e6a38b42bf93786d5df6b4b96b1a451167e8c8384975d
Instruction ID: 25d07567240037e08d92457968aa5d5c60c9fbe329c249371ae901417bc64325
Opcode Fuzzy Hash: 5a7583812f8fb0d3718e6a38b42bf93786d5df6b4b96b1a451167e8c8384975d
Instruction Fuzzy Hash: B2217E30A141289FDB04EBB9D856AEEBBB3FF8C310F505129D502A7284EF305D45CB66

Function 0144D68C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34ff761abed5a4d01cee0adef1a03981e8939645b0df2814dae0f81379dc0e7
Instruction ID: 4f0308576c19e909ba78542f7b0cf39c78921d49a71abf5a63469254eb7cb841
Opcode Fuzzy Hash: d34ff761abed5a4d01cee0adef1a03981e8939645b0df2814dae0f81379dc0e7
Instruction Fuzzy Hash: BE2106B1904280DFEB06DF94D9C4B17BFA5FB98314F24866AE9090B366C33AD416CB61

Function 0144D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b6bb8ddfa926b4c776b1555fa959f5a299bbde47fb488e93d2eb00f78d3be1
Instruction ID: bffd718c41b61fa79485a84ed514f4f7ee3f821230064eebd534590bbd281aef
Opcode Fuzzy Hash: 10b6bb8ddfa926b4c776b1555fa959f5a299bbde47fb488e93d2eb00f78d3be1
Instruction Fuzzy Hash: B721C4B1904240DFEB05DF98D9C4B2BBFA5FB98324F24C56AED050A266C336D416CBA1

Function 0144D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a78bd278807143c4dde892c6c156a98d6b473b2cf413e41568230d2fdb94386
Instruction ID: 3990e41f14d7937084c3c2ef9e0439b32decc27c29b466956db2790e25854508
Opcode Fuzzy Hash: 2a78bd278807143c4dde892c6c156a98d6b473b2cf413e41568230d2fdb94386
Instruction Fuzzy Hash: 2F21D3B1A04240EFEB05DF58D9C0B27BF65FB98318F24C56AE9090B366C736D456CAA1

Function 05A2A5A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81c3ed88cdff968f2c399a55e0c663c615f4199e1b0a337f945615cc66ec4c8
Instruction ID: 560bb3ebbf9734f3e4c0467ad1e7569ed41a925c066507da6725a702f1b713c4
Opcode Fuzzy Hash: d81c3ed88cdff968f2c399a55e0c663c615f4199e1b0a337f945615cc66ec4c8
Instruction Fuzzy Hash: B8312CB4D09259DFCB40DFA8C1829AEBBF5FF49310F20919AD419A7752D7709E40CBA1

Function 0145D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086513930.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116131a3edaa7a463d9f472c1a926a92067e4af3a8e91324c024a0371690c9c4
Instruction ID: 08204549dc27e7e60282461429b07622abfb97a931606ba7b87610ac1196bd0c
Opcode Fuzzy Hash: 116131a3edaa7a463d9f472c1a926a92067e4af3a8e91324c024a0371690c9c4
Instruction Fuzzy Hash: 3721CFB1904200AFDB45DF98D9C0B26BBA5FF84324F24C96EED094B363C776D446CA61

Function 0145D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086513930.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ca21858661e6aa5e6c894d152539cf6be31196de3952fd20ddd66507545575
Instruction ID: c35c7c5bc6b2d686dcf0b98092c0cba1df5f2f321639248c0a1062f1a32011db
Opcode Fuzzy Hash: 64ca21858661e6aa5e6c894d152539cf6be31196de3952fd20ddd66507545575
Instruction Fuzzy Hash: 7A21FFB1A04200EFDB55DF58D980B26BBA5EF84718F24C56ADD0A4B367C33AD407CA61

Function 05A2FE98 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82c38a825d06aee8b69fd78565cafce328f55df396635a8ea850683f40d8b1c
Instruction ID: 1b5c30cb2e6ff44e4d92149169e933ed3fd575d660d01d1ff5a57735d5f2397a
Opcode Fuzzy Hash: b82c38a825d06aee8b69fd78565cafce328f55df396635a8ea850683f40d8b1c
Instruction Fuzzy Hash: F431E674E042599FCB04DFA8D4959EDBBF1FF89310F10802AE915A7350DB30A940CFA0

Function 05A25A74 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410d40b1af05a3119188c042476c539b5a1a6310db4f71cacec7fa63a3d0e32a
Instruction ID: e66ace16a118cd5a0e485634c7aa828eb70aa5d5971fc9c7646b1a2cfccad3f5
Opcode Fuzzy Hash: 410d40b1af05a3119188c042476c539b5a1a6310db4f71cacec7fa63a3d0e32a
Instruction Fuzzy Hash: B611E670B0A3489FCB05DB78CD569AE7BF5EF46200B2548EBD845CB242EA24CD058722

Function 0145D005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086513930.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebcdd58dfdde5eee3be7a0b742821b8af84a8413cc9b9b180636bb351a7ab6e2
Instruction ID: c8f289e26888ed633ed1b787028744af97914e3a788dbc0fd63d4e2fbefa4558
Opcode Fuzzy Hash: ebcdd58dfdde5eee3be7a0b742821b8af84a8413cc9b9b180636bb351a7ab6e2
Instruction Fuzzy Hash: F62183755083809FDB03CF64D994716BF71EF46214F28C5DAD8498F2A7C33A9816CB62

Function 05A2E418 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998df8fde9f11cb1374c15f180490391c07b96f2d97c900eda49eea6557500ff
Instruction ID: 9742d18ea43354d754127bb7a92b9d9d282daa62a61c37a91b31d004b033dfd0
Opcode Fuzzy Hash: 998df8fde9f11cb1374c15f180490391c07b96f2d97c900eda49eea6557500ff
Instruction Fuzzy Hash: AE119130B001258BCB28DF7D9811A7B7BBBBB84B60F048569EA1697390EB31898087D0

Function 05A27461 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e17cb9258e76d4214b59bc983ad9e5ea2645c5a2e2a37507d163a70136da20f
Instruction ID: 8241a9a73602a1d1ab78ad31ddddabf1fc990647cc7d7629bc38644abca3ddd6
Opcode Fuzzy Hash: 7e17cb9258e76d4214b59bc983ad9e5ea2645c5a2e2a37507d163a70136da20f
Instruction Fuzzy Hash: 7D11CE31A44614CFE715CB2CC956F647FA2FF46714F9A84E9E2558F272D622E802CB01

Function 05A2AAE0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ea7c8538230d3f220fd02a357fb3a91a9b865fd0224beb6f601a07497fecfa
Instruction ID: 2bbda7cd1d4dc500fac98b8205db66b03ddf3ee99850b92d643fb2fe9fad80a0
Opcode Fuzzy Hash: 06ea7c8538230d3f220fd02a357fb3a91a9b865fd0224beb6f601a07497fecfa
Instruction Fuzzy Hash: 4E213B70D056588BDB09DFABC8456EEFFB7AFCA300F04C46AD409A6265DB740945CF60

Function 05A2A5B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b86094f2f130b999f2e633d69526a20deb8cf4f79b1b4065930cea859f0574f
Instruction ID: a6eee3c7625bed7a7da6ea06182ff51868d99602d449144001eae6d2f872988a
Opcode Fuzzy Hash: 0b86094f2f130b999f2e633d69526a20deb8cf4f79b1b4065930cea859f0574f
Instruction Fuzzy Hash: F921D8B4E09219DFCB44CFA9C1819AEBBF9FB48310F609169D419A7711D770AE40CFA1

Function 0144D687 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235392520c3f1e7e09b6d89c66da8016760e9a9590b2b0d78f6be887e7f5212d
Instruction ID: e55f3685d01c462e031f9d18f3600a2f88d515497826d042667980ef3cf4b160
Opcode Fuzzy Hash: 235392520c3f1e7e09b6d89c66da8016760e9a9590b2b0d78f6be887e7f5212d
Instruction Fuzzy Hash: A021DF76904280DFDB06CF44D9C4B16BF72FB98314F24C6AAD9480B266C33AD426CB91

Function 0144D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction ID: c54c72bb3e7727e9bbae6d0220fe564d2fddd579941e554c1777df7016774229
Opcode Fuzzy Hash: 137f5766051e4324e45f0217ede9c43a14289fab1ea42f994ba2cff73d56ee7c
Instruction Fuzzy Hash: F221AF76904240DFEB06CF54D9C4B16BF72FB94324F24C5AADD490B666C33AD42ACBA1

Function 0144D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086445536.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 718fc95468650a92653401797be257870dc620f3a31b997fe755fb87dc444501
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: DF11E172904280CFDB02CF54D9C4B16BF71FB94314F24C6AAD8490B766C336D45ACBA1

Function 05A25AEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b7323b3bcaac9cf0046457d0a1de14e516d77dbf14a6261b7d6ebba5680909
Instruction ID: 55f3849572ce7862887fad7d27c2e9a916ae076bf92490091ab768d623519a12
Opcode Fuzzy Hash: 98b7323b3bcaac9cf0046457d0a1de14e516d77dbf14a6261b7d6ebba5680909
Instruction Fuzzy Hash: 3E2100B5C003499FCB10CF9AD884ADEBBF4FB48310F10842AE919A7210C375A954CFA1

Function 05A2AAF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac581797654217e5dc58c94dd3a688ebc2da0ff4e55156f444c710f83d967f2
Instruction ID: e2b196d5a2ab67875cf4dfee1b83b7f896fa7a5394616355e46aa9ec7b000968
Opcode Fuzzy Hash: 8ac581797654217e5dc58c94dd3a688ebc2da0ff4e55156f444c710f83d967f2
Instruction Fuzzy Hash: 7A11E9B1D056288BDB18CF5BC9456EEFAFBAFC8300F14C47A980DA6264DB7419458FA0

Function 0145D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086513930.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: eaa448be8b79a604f52ce021f70363935fed87665d4f867fe375517be49497b5
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: 4E11A975904280DFDB02CF54D5C4B16BBA1FB84224F24C6AAEC494B7A7C33AD44ACB61

Function 05A26A02 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418bb5d00589c0868bff2e7ca4c1a2b4f98c18eb742d3b6f7cf61f9439dab150
Instruction ID: 2c43d2e2c9870e556045b9b7ce673595c8f18994cd1100ad8557043cc7e13b3a
Opcode Fuzzy Hash: 418bb5d00589c0868bff2e7ca4c1a2b4f98c18eb742d3b6f7cf61f9439dab150
Instruction Fuzzy Hash: 4D21D0B5D002499FCB10CF9AD985ADEFFF4FB49320F10841AE919A7210C375A955CFA1

Function 05A29270 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9999c20d5c5cd2a2244436266bbc83aaaa35aa6e5fd1e9812b64c5783ba005dc
Instruction ID: b63edd9c6b3d95c57ff40a5e69c9cbabc47bcc16eda0b50b18737c05d46c8b51
Opcode Fuzzy Hash: 9999c20d5c5cd2a2244436266bbc83aaaa35aa6e5fd1e9812b64c5783ba005dc
Instruction Fuzzy Hash: 8B117971A48319DFDB50DFA9C846EABBFF4BF08600F0088A6E859D7612D7349584CF91

Function 05A2A668 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b57aebe01eeb2e9b5d930e2d491ccad9b6b85c2ba7afccf19f90f9b6c17cd02
Instruction ID: 8900ea212ae3397f8fbb6a0a12ce6847cdabeb427d7ddfabb2de3bf96d6734e2
Opcode Fuzzy Hash: 9b57aebe01eeb2e9b5d930e2d491ccad9b6b85c2ba7afccf19f90f9b6c17cd02
Instruction Fuzzy Hash: 16110574E08219EFCB08DF99C5819ADBBFAFB88310F11D5A5D418A7312D7B0AA41DF80

Function 05A27478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631414a90880b20a6de9b888144cebe71c686236b5b7342085cb8440d5235454
Instruction ID: ca92254b4b938d1660884d919a229f8920623da011849348b720cf201ce13422
Opcode Fuzzy Hash: 631414a90880b20a6de9b888144cebe71c686236b5b7342085cb8440d5235454
Instruction Fuzzy Hash: A3018C30748254CFD705CB2CC846F217BA2FF86700F5984E6E2158F2B2CB21D801CB01

Function 05A25ADC Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d253293af5171e482c262959e8fa0c2b92be9180c252f340959062379d03834
Instruction ID: a6cf3b6fdb66aea48aacf522a6593f036a678dbda6c787033eca9539e9d73527
Opcode Fuzzy Hash: 0d253293af5171e482c262959e8fa0c2b92be9180c252f340959062379d03834
Instruction Fuzzy Hash: E5F06231B141196FCF08DB6CD85ADAE7FFAEB49314B10847AE405DB210DE31D8108755

Function 05A2A347 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62217bdd4dbdd41a640113b09c5f5072a2afca8dfbd4ba7bea03cb9405b37316
Instruction ID: 3c0318c6493fff5954f3aa7553feb0091febf5ccf0805c49fbf6ce4d48b90ab5
Opcode Fuzzy Hash: 62217bdd4dbdd41a640113b09c5f5072a2afca8dfbd4ba7bea03cb9405b37316
Instruction Fuzzy Hash: EA01F238A0A21CEBCB05EFB8D60BAAC7F35AB02610F1085EAD84817641CA704E85C792

Function 05A2917B Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a381190709bf5b4ec5170eb6f7dc8dbbb73fa3fcb29c9853e8361143eb24ac
Instruction ID: ca92224736e31efdc426384bd3f38c6fe29bb3b0f6e032ea56ab620301f1cc3c
Opcode Fuzzy Hash: 67a381190709bf5b4ec5170eb6f7dc8dbbb73fa3fcb29c9853e8361143eb24ac
Instruction Fuzzy Hash: F6012670D04255AFC790EFBF880ABAABFF1AF05610F0484E6D008CB152D3308485CB41

Function 05A2B9A0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1398a3b33c59a9bbf6f579e74f9a2bc9ff56fa3b6466962942e8b3d82494f613
Instruction ID: a4276ae1b0f8437cf9ad68476d2e0f7e14fda205df08fa81958e78bfc96290b7
Opcode Fuzzy Hash: 1398a3b33c59a9bbf6f579e74f9a2bc9ff56fa3b6466962942e8b3d82494f613
Instruction Fuzzy Hash: 9001E874A0911CEFCB04EFA9C685EADBBFAAB49300F15D495E5099B361DB30DE00DB50

Function 05A2A3C7 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3e2585d794ea2cce71e20b37ff3ca2635d537f7c046e4be72a636ddbfd833c
Instruction ID: fa1a1572f938a75bfecdc255d126a82d4ec0449c979a60ef4e014c6b87a2b7bd
Opcode Fuzzy Hash: 6d3e2585d794ea2cce71e20b37ff3ca2635d537f7c046e4be72a636ddbfd833c
Instruction Fuzzy Hash: 34F0F634A0A22CDFCB04EFA8D54BABC7F75EB06320F1045D5D4490B651CE701E52D7A2

Function 05A2B928 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80be70c1d3df9ec3c6869348cd8d8c5d671780adfac0252de6a29a42a61f0a6b
Instruction ID: 772a4202b0b181214b0365023143c694a42810d7d7a5dceea3d564ac6c9b0a04
Opcode Fuzzy Hash: 80be70c1d3df9ec3c6869348cd8d8c5d671780adfac0252de6a29a42a61f0a6b
Instruction Fuzzy Hash: 77F08C7094D12DDBC704CB5DC542EBCBBFEAB4A300B10A5A5E4495B212D7309A40DBA0

Function 05A291D3 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 857623e8a3e4101395f78a9f57ac2a17ba6f4c450cda509d221abdb0cfc48514
Instruction ID: e6ca5d0feb81f4453a595ef5f3fe555e7709d24696f3523fb00a3865f5dd3ca3
Opcode Fuzzy Hash: 857623e8a3e4101395f78a9f57ac2a17ba6f4c450cda509d221abdb0cfc48514
Instruction Fuzzy Hash: 6601A270948386AFDB15CFAAC45AEAFBFF1AF09610F0444CAD461DB282C7748482CB50

Function 05A26990 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f82f05ee76f378bde7e6cdd5d463c46cb1c3fc3ef8470a9eb4d115184a7fec9
Instruction ID: 901f2fad0cbf667232ea41cf443c02a2668e724c7657f74a028db993270f6b79
Opcode Fuzzy Hash: 9f82f05ee76f378bde7e6cdd5d463c46cb1c3fc3ef8470a9eb4d115184a7fec9
Instruction Fuzzy Hash: B9F09031604105AFDF09CF6CD886C9ABFFAEF49224B1580BBE408CF226DA319910C750

Function 05A291E0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9aa74d223e2df50c42255c50ece8ced5c26d01a1aa59442b1833446cbd49cb
Instruction ID: a88bb3a4b1e4629601381dd805554f84667ba33a5861bcc25493b010faac766c
Opcode Fuzzy Hash: 8f9aa74d223e2df50c42255c50ece8ced5c26d01a1aa59442b1833446cbd49cb
Instruction Fuzzy Hash: 93F0DAB0D0431A9FDB54DFADD846AAFBFF8BB48600F1045AAD918E7240D77095408F91

Function 05A29421 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed57a10f411a76232877bebed5b8c16c6d3ede1fa06718835e35a9e5af10ee38
Instruction ID: e980008d227c3f0e29c0e934deaa5bc8df226d271b4702f262f657322e8403a8
Opcode Fuzzy Hash: ed57a10f411a76232877bebed5b8c16c6d3ede1fa06718835e35a9e5af10ee38
Instruction Fuzzy Hash: 96F0A77490E6288FCB40DF1CD9C6AEA7777B745704F10A5A9D40D62056DB700AC9CB06

Function 05A2CF10 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42ead55a5a9bf95d58bb4b2686b18b2f0e49a986138b990c55d1e34be555112
Instruction ID: b322c34919ef66e0700ecff7f7935b496c563dd7dc0e5f1e62cdcd076ad973ac
Opcode Fuzzy Hash: f42ead55a5a9bf95d58bb4b2686b18b2f0e49a986138b990c55d1e34be555112
Instruction Fuzzy Hash: B8F0E530909258DFCB40EBAEC509FA97BBAAB48300F109436950657251DF301986CB62

Function 05A2E3B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158c87f3a3c38ae6f2148c2f911512dfe035427aa04dba63595ed67f248c8fca
Instruction ID: 2e134912cd972116e7281cb9e77d6a6e867aca6a524696a66d0d2d985932c8c5
Opcode Fuzzy Hash: 158c87f3a3c38ae6f2148c2f911512dfe035427aa04dba63595ed67f248c8fca
Instruction Fuzzy Hash: AFF03938D0420CEFCB40EFA9D54469DBBB5EB98311F10C0AAE81497350D6345A50DF91

Function 05A29188 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07173e97a124bb85bbcb95a5eaef20336a247cfddae9ceefac52ac357dce3864
Instruction ID: 882dfe3177deb598e5dd3cebd19537117e6a9af20728327cee8db4d296420f72
Opcode Fuzzy Hash: 07173e97a124bb85bbcb95a5eaef20336a247cfddae9ceefac52ac357dce3864
Instruction Fuzzy Hash: B9E092B0D40219AFD780EFAAC909A5EBBF2BB08A00F1189A9D419E7251E77496458F91

Function 05A2AC15 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07c0be3a5d114f1f6622009f502ded3ae81a864dd850dfd6a65e3ce0d97fdd6
Instruction ID: b4251309f94a638523bc3bb461e7430f768739d2a529601e45bb78c5b365721f
Opcode Fuzzy Hash: c07c0be3a5d114f1f6622009f502ded3ae81a864dd850dfd6a65e3ce0d97fdd6
Instruction Fuzzy Hash: 73E01A30509228CFC7509F24D18AA687B7AFF0A312F0068E4E40E6E262CB328C44CF60

Function 05A290FB Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34948e747244f3c1312616f073171318382e34710bd72d8fb815e007d1fa730
Instruction ID: c2350ea46472fb6afc0c7f26175de58b0ac22d90d9c0c2a9557d75e6a552401c
Opcode Fuzzy Hash: b34948e747244f3c1312616f073171318382e34710bd72d8fb815e007d1fa730
Instruction Fuzzy Hash: C9D0A76105D5CC1FCB1117B4BDAE4387F349D4B1117081FD7E495CB093C1104891C3D1

Function 05A2A3D8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba98f43541688c1b899b014570bf93e9775dcdb3a8e11293ea6ea6d81edf27d1
Instruction ID: 11c24079dc1ba771aa52aa3b0016d6eae70635ce3cbcf16af1dec6267172e638
Opcode Fuzzy Hash: ba98f43541688c1b899b014570bf93e9775dcdb3a8e11293ea6ea6d81edf27d1
Instruction Fuzzy Hash: E5D01770C1621CEBCB04EFA8E54A6ADBF74FB45312F2081A9E80427240CB715E94DBE6

Function 05A29108 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74a50c5d3c32d17d481577480c882d7aa0ff3d56e7a4ad68da526f6e3e1ba0d
Instruction ID: 54469dcc199b147ae5679d6488b5bb1cf2f830e0ef3da982fe98b7315615a150
Opcode Fuzzy Hash: e74a50c5d3c32d17d481577480c882d7aa0ff3d56e7a4ad68da526f6e3e1ba0d
Instruction Fuzzy Hash: 53C08C300026089BC70437A9F50FB243AB8A700326F046420F109010108FB010A0C6B6

Function 05A26968 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a07c8f43f5b0cb8c72355c9a9d66e0a898877930ac6b6fa966b4ea55f20606
Instruction ID: cdc47bd797ffb08c6bdcea3b287792bcdb377d12c70383ae518492d70fd551d6
Opcode Fuzzy Hash: 34a07c8f43f5b0cb8c72355c9a9d66e0a898877930ac6b6fa966b4ea55f20606
Instruction Fuzzy Hash: E0C02B3128140A89F204E734C883F18B2EEF7F0700FB0C001C90888058CB10D402C126

Function 05A25A94 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5892d0c70c92c3f8e513b72e8da0101c9d2b4141b2123257acabf580a97df699
Instruction ID: 9baef7664b61b30914da98d9a72933ad2f5c36a1a3dbf586a781cfd6d0811a7a
Opcode Fuzzy Hash: 5892d0c70c92c3f8e513b72e8da0101c9d2b4141b2123257acabf580a97df699
Instruction Fuzzy Hash: 9DB012B5696311AA4001B77C4ADBD7E94B1FBB6700BA08C11324585210CC208424DA27

Non-executed Functions

Function 05A22548 Relevance: 9.0, Strings: 7, Instructions: 280COMMON

Download Yara Rule

Strings

!Y3E, xrefs: 05A22642
$]q, xrefs: 05A227C7
$]q, xrefs: 05A22831
Te]q, xrefs: 05A225BF
$]q, xrefs: 05A2283D
$]q, xrefs: 05A227D3
Te]q, xrefs: 05A22579

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: !Y3E$Te]q$Te]q$$]q$$]q$$]q$$]q
API String ID: 0-1582036792
Opcode ID: a6012f0de3153efc8e9dbad76e52525ed2639042eae92dfe271e940b7734e4d9
Instruction ID: 80c15a5d26fb4597981a1fbf4edcc5cc762e9118b42f5c01a2f5f6ff1411c951
Opcode Fuzzy Hash: a6012f0de3153efc8e9dbad76e52525ed2639042eae92dfe271e940b7734e4d9
Instruction Fuzzy Hash: 2CA16F38B102198FD718DF69C899B6E7AF3BF88710F258429E906DB3A4DE70DC418B51

Function 05A22538 Relevance: 5.3, Strings: 4, Instructions: 276COMMON

Download Yara Rule

Strings

$]q, xrefs: 05A227C7
$]q, xrefs: 05A22831
Te]q, xrefs: 05A225BF
Te]q, xrefs: 05A22579

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: Te]q$Te]q$$]q$$]q
API String ID: 0-3083981010
Opcode ID: 98991bad8483e47f8e8c4b30ba31b7211e4be9f16255d9e6ad55a73b8e24b9f6
Instruction ID: 84d4466861e7e56148edd5b6292c3ce8f53f7d9f719081deb05af7e1fa12364b
Opcode Fuzzy Hash: 98991bad8483e47f8e8c4b30ba31b7211e4be9f16255d9e6ad55a73b8e24b9f6
Instruction Fuzzy Hash: 53A15E38B102198FD718DF69C999B6E7AB3BF88710F258469E906DB3A4DE70DC41CB50

Function 05A226DB Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$]q, xrefs: 05A227C7
$]q, xrefs: 05A22831

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 0fbbc3ec2afe80b0637122705ed5b8914f74bd723b3b4fd889ebfde306c3915e
Instruction ID: 1e255beed4a00de175f754dcc4f171ccbbb7b46694b1de3aa9d5beac4cefdfbe
Opcode Fuzzy Hash: 0fbbc3ec2afe80b0637122705ed5b8914f74bd723b3b4fd889ebfde306c3915e
Instruction Fuzzy Hash: AF519138B012199FDB149F79C896B6E7AB3BF88710F154429E902EB7A4CE75CC41CB50

Function 05A26F78 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

T(z , xrefs: 05A27077

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: 60cafe556a1a93faf5429a793edccd244f9c21c0be8f86e9d197bf2ca1e56308
Instruction ID: 77c4c5fbc1098873138a7b02499136538ccbfe5a5865b33eb8957948ab80fc85
Opcode Fuzzy Hash: 60cafe556a1a93faf5429a793edccd244f9c21c0be8f86e9d197bf2ca1e56308
Instruction Fuzzy Hash: EA41D931F092258BDB58CFB989929BFF7B7FBC8750F14842AD501AB294CE308D058752

Function 05A26F88 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

T(z , xrefs: 05A27077

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: T(z
API String ID: 0-3184255237
Opcode ID: d582e6bf112e9e4cbe90a43a1268b2f352ba64793de8f49769485b9066c2bad3
Instruction ID: 9ce5ae2b3c340a885a620d98028263d30298a5469f114d695a58e892eca8dc1d
Opcode Fuzzy Hash: d582e6bf112e9e4cbe90a43a1268b2f352ba64793de8f49769485b9066c2bad3
Instruction Fuzzy Hash: 2441D831F091258BDB58CEAD8592ABFF7B7EBCC750F10842AD501AB294DE318D058792

Function 05A209E8 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

ax^, xrefs: 05A20AA6

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: ax^
API String ID: 0-994873808
Opcode ID: f2336426686cbda3944589d82125cf49a741d6bbe7a529d153da8b9ab44729ca
Instruction ID: e768564a5218167905b13c4900dc129e71c958fd5d3be7639baee6824287787f
Opcode Fuzzy Hash: f2336426686cbda3944589d82125cf49a741d6bbe7a529d153da8b9ab44729ca
Instruction Fuzzy Hash: 77419171F1526A8FCB40CFADD98A9AEFBF6FB98200B558126D90AF7350C234CD018B51

Function 05A209F8 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

ax^, xrefs: 05A20AA6

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID: ax^
API String ID: 0-994873808
Opcode ID: a3f4b4187a5865039b4e29ba55f237acf6ade832095372bf495cfff6f4a6094d
Instruction ID: 5dcf1a008079e902183a9384d33b1b78bc5b5a067abf4164b2eef29cb0f7f162
Opcode Fuzzy Hash: a3f4b4187a5865039b4e29ba55f237acf6ade832095372bf495cfff6f4a6094d
Instruction Fuzzy Hash: 5B419231F1526A8FCB44CF9DD88A8AEFBF6FB98200B558126D50AFB350C234DD018B91

Function 053E0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089054014.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf7bea6e6d407876ac8bb8c7d9dd3e03a07d0c91e0e4fe7f6e08c6fb099b97f
Instruction ID: f68e6b20ba782ed2bc68432c10d7ba347948ced5b0d70e853f0eb5d2296068c9
Opcode Fuzzy Hash: 6cf7bea6e6d407876ac8bb8c7d9dd3e03a07d0c91e0e4fe7f6e08c6fb099b97f
Instruction Fuzzy Hash: F01282B0CC1745CADB11CF66E95C18E3BA1BB8631CFD04A09E2612E2E5DBB415EACF45

Function 05A2D710 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216cc7d212b3bf7bc4b0cd288a2c5e17e1b7944ce4e6c2e274ed05401beb2668
Instruction ID: 7a242e21af0a667fc4f088a239c4753cdafb0926dfaa21094bdc254b8a569077
Opcode Fuzzy Hash: 216cc7d212b3bf7bc4b0cd288a2c5e17e1b7944ce4e6c2e274ed05401beb2668
Instruction Fuzzy Hash: 8EE11B74E041198FCB14DFA9C5919AEFBF2FF89304F248169E819AB356D730A942CF61

Function 05A2F628 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf97975d73ef5170572d6af59d755cdde794c91910eb8e5d85c4a4628e961d8
Instruction ID: d77af3a1d4fcbdb6d6bc8a8d7bb10d9b4e4d6f9ff5a8277cd797bd6954421f20
Opcode Fuzzy Hash: 3bf97975d73ef5170572d6af59d755cdde794c91910eb8e5d85c4a4628e961d8
Instruction Fuzzy Hash: 01E11B74E041198FCB14DFA9C5819AEFBF2FF89304F248169D819AB356D730A942CFA1

Function 05A2DF80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9571c791c3b78b133beb2b9c7961ed15a2d821e8cd03d702d8a05deaf63b4f32
Instruction ID: 6a79bd15fa66773601d403c300885e111461d8b35f8b95cdf4347d2dc97ff92b
Opcode Fuzzy Hash: 9571c791c3b78b133beb2b9c7961ed15a2d821e8cd03d702d8a05deaf63b4f32
Instruction Fuzzy Hash: 81E10B74E041298FDB14DF99C5819AEFBF2FF89304F248169D819AB356D730A982CF61

Function 05A2DB48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa3dae4269698a65f25ba6480d1f91ef9dc7764fbb3bc37c23a4086edeeeae1
Instruction ID: ff125f503d6430374a78a24611ed0892e216b5f2db4376a36e93e45a146d3bc2
Opcode Fuzzy Hash: 9aa3dae4269698a65f25ba6480d1f91ef9dc7764fbb3bc37c23a4086edeeeae1
Instruction Fuzzy Hash: D9E11C74E041198FCB14DFA9C5819AEFBF2FF89304F248169D459AB356D730A942CFA1

Function 05A2FA60 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5993ae20b6ffed9710bb6e7a44976f9baff5f5f4e57daf0a51be080a0d20c61
Instruction ID: 96588a96e2b5ba2297ae031895f0819a4e240dada99e058af39988e0a9c0f201
Opcode Fuzzy Hash: d5993ae20b6ffed9710bb6e7a44976f9baff5f5f4e57daf0a51be080a0d20c61
Instruction Fuzzy Hash: 92E12B74E041298FCB14DFA9C5919AEFBF2FF89304F248169D819AB356D730A942CF61

Function 05A26168 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e38f47fcda0eb474b83a8867e3cce2f3bd3c9fd5c06382b731d07a6576a87f0
Instruction ID: be4261c95e51f7dc1a210a4d4c4e9bb2b238371316468d512b3dd30597c7ac4d
Opcode Fuzzy Hash: 4e38f47fcda0eb474b83a8867e3cce2f3bd3c9fd5c06382b731d07a6576a87f0
Instruction Fuzzy Hash: 9ED11931C2061E8ADB11EF78D990699B7B1FFD5300F209B9AE50977224EF706AC5CB51

Function 02D3D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086938674.0000000002D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d30000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55655a4681288adaaf7ee9ec6630ec9fc8e0cd4cf3f361142aaa88cb68c5056c
Instruction ID: 98d5a11685bdcba579afb5d91b82bef2d3bb8d1866c372c438bf4d767a39864f
Opcode Fuzzy Hash: 55655a4681288adaaf7ee9ec6630ec9fc8e0cd4cf3f361142aaa88cb68c5056c
Instruction Fuzzy Hash: 00A15B36E002098FCF0ADFA5D84099EB7B2FF85304B15856AE805AB365DB71ED55CF90

Function 05A26178 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8eab3ccee004a20ca3a440a7690d9be06c2d2c0d611d008d50eaa0c84b4a150
Instruction ID: c254d03b489ae6a87e101e445587deb4114238ac614933c851412a812c3c7095
Opcode Fuzzy Hash: f8eab3ccee004a20ca3a440a7690d9be06c2d2c0d611d008d50eaa0c84b4a150
Instruction Fuzzy Hash: 43D10831C2061E8ADB11EF78D990A99B7B1FFD5300F209B9AE50977224EF706AC5CB51

Function 053E0006 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089054014.00000000053E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffcb5192901adca770142c51d6783658d450ff8e9bfe061947487aa22400ae8
Instruction ID: 858daf6ee5960e10a7ab774323adf1b9556975009c035add25b000261291c29b
Opcode Fuzzy Hash: dffcb5192901adca770142c51d6783658d450ff8e9bfe061947487aa22400ae8
Instruction Fuzzy Hash: F4C104B0CC0745CADB11CF66E85818E7BB1BB8631CFD54A09E2616F2E1DBB414AACF45

Function 05A26718 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8424082c211ca8062d23ef4283d02fdb6be48d1737c92702bcd0a6c8595d8b91
Instruction ID: c3ac0735c891e6d9a7a5667829acf4f0a21b899814b6cbbdf4d90d2a05f52384
Opcode Fuzzy Hash: 8424082c211ca8062d23ef4283d02fdb6be48d1737c92702bcd0a6c8595d8b91
Instruction Fuzzy Hash: 5F418235F05129DBCB04CFACD9C2DAEFBB7EF88210B50446AE905EB254DA319D518B91

Function 05A26728 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2089942706.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a20000_AWB DHL#40882993049403.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcbc9367e18cfa8e8cf9d4c925d2400174e3a70d137132427b64a526b6d5bb8
Instruction ID: c42c7fe3fc04faaaf08f15e54f0b53b2cde9315887b455bd5b7bba3456bd24bd
Opcode Fuzzy Hash: 1dcbc9367e18cfa8e8cf9d4c925d2400174e3a70d137132427b64a526b6d5bb8
Instruction Fuzzy Hash: 59419235F15129DBCB04CFACE5C2CAEFBB7EF88210B50446AE905EB250DA319D518BC1

Analysis Process: RegSvcs.exePID: 5660, Parent PID: 1984COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	195
Total number of Limit Nodes:	22

Executed Functions

Function 06A530A0 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A5379F
$]q, xrefs: 06A537AB
$]q, xrefs: 06A537CF
$]q, xrefs: 06A53782
$]q, xrefs: 06A53776
$]q, xrefs: 06A537C3

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 35720457b788136bdcea7f0506d909b40e6f79794954ada9789a4b12d1aceb98
Instruction ID: 56dd2721033c660bc5e83646c2e13bd1bf2ad6c960dceb3f417aeecbd54f42c0
Opcode Fuzzy Hash: 35720457b788136bdcea7f0506d909b40e6f79794954ada9789a4b12d1aceb98
Instruction Fuzzy Hash: 94322E31E1061A8FDB15EF75C89459DF7B2FFC9340F2186AAD409AB254EB30A985CB81

Function 06A57DC0 Relevance: 3.0, Strings: 2, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A58123
$]q, xrefs: 06A5812F

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d2f880118e296b4ad191987f0d066be1585538bb4e2aff98ab009dd08c4efa5d
Instruction ID: 929513ad05e6f4efabd85f9bfbcc081d2c9aae213e97f800b959a17b2d8fcc0b
Opcode Fuzzy Hash: d2f880118e296b4ad191987f0d066be1585538bb4e2aff98ab009dd08c4efa5d
Instruction Fuzzy Hash: F102A130B102169FDB54EF69D4906AEB7E2FF84314F258529D80ADB394DB39DC82CB91

Function 06A551D8 Relevance: 1.9, Strings: 1, Instructions: 603
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06A555C0

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 8c77019808940e2829f8a1029da30d1cd764766709f7a53b7e825b477da80636
Instruction ID: e62bf6319cd2339426eb39aac210f6f67f84da3d4506a17e6b4ebea5ad7ed4ad
Opcode Fuzzy Hash: 8c77019808940e2829f8a1029da30d1cd764766709f7a53b7e825b477da80636
Instruction Fuzzy Hash: 5222B171E002199FDF64EFA5C4906AEB7B2FF89320F258469D809AF354DA35DC42CB91

Function 02F370B8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02F3712F

Memory Dump Source

Source File: 00000003.00000002.4515309497.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 918b6f73817dbfe13f2ed658a3a9596a6001519ff458cbabd86d9c5889f3df0c
Instruction ID: ea62b03309e9886595eb3bf505ce41005c92c62515c826b16ededfec984bc903
Opcode Fuzzy Hash: 918b6f73817dbfe13f2ed658a3a9596a6001519ff458cbabd86d9c5889f3df0c
Instruction Fuzzy Hash: 362137B2D002598FDB10DFAAD884BEEFBF4AF49310F14845AE459A3250D778A944CFA1

Function 06A56630 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1fc9fbd3e77762b362d5891e93a282a30446a796c90bab0be4483331144054
Instruction ID: 637df5f27212af3534fa152f46e2d45657b0014897b648d4c881f05782924d32
Opcode Fuzzy Hash: 8f1fc9fbd3e77762b362d5891e93a282a30446a796c90bab0be4483331144054
Instruction Fuzzy Hash: FB62A130B002059FDB54EB68D594AADB7F2FF84314F658469E806EB361DB35EC86CB90

Function 06A5C1C8 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542355c6114d94d16103bde54c4bd6feab57c3d49f0e0a7ba43bb0dbb174fafb
Instruction ID: a5c0842bdf63f10a4dc737e0b987a0972880402c206cdbcdefb9e2233f9eb7a1
Opcode Fuzzy Hash: 542355c6114d94d16103bde54c4bd6feab57c3d49f0e0a7ba43bb0dbb174fafb
Instruction Fuzzy Hash: 9032C774B102059FDB54EF68D980BADB7B2FB48320F218529E906DB355DB39DC82CB91

Function 06A5B278 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e91308d3a812812423f3d446c613b8b1eb3cdff2982e37a150bb46a7ec0ed4
Instruction ID: 8712d04f259939e31b15a6ca3367e3a9d2013614837e01e27e464598df8883e3
Opcode Fuzzy Hash: 33e91308d3a812812423f3d446c613b8b1eb3cdff2982e37a150bb46a7ec0ed4
Instruction Fuzzy Hash: 0B227274E101099BDF64EB69D4A07AEB7B2FB49311F218825E809DF391DB38DC81CB61

Function 06A5AD20 Relevance: 10.4, Strings: 8, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A5AE4D
$]q, xrefs: 06A5AEA0
$]q, xrefs: 06A5AE41
$]q, xrefs: 06A5AEEC
$]q, xrefs: 06A5AE94
$]q, xrefs: 06A5AEF8
$]q, xrefs: 06A5AECF
$]q, xrefs: 06A5AEC3

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 9ec1001d1da2d87ec5ed04e9df72fbcb4a9e9ab754f5cc8c7c10b39fadbd9c09
Instruction ID: 78fa42a6bcaad90551650cc7e43f6e8d3f5b98e1685b21639e25ae35ff093d55
Opcode Fuzzy Hash: 9ec1001d1da2d87ec5ed04e9df72fbcb4a9e9ab754f5cc8c7c10b39fadbd9c09
Instruction Fuzzy Hash: ABE16070F1020A9FCB65EB69D4906AEB7B2FF85304F218629D906DB344DB35DC46CB91

Function 06A5B698 Relevance: 8.0, Strings: 6, Instructions: 470COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A5BC23
$]q, xrefs: 06A5BC2F
$]q, xrefs: 06A5BBEF
$]q, xrefs: 06A5BBBB
$]q, xrefs: 06A5BBFB
$]q, xrefs: 06A5BBC7

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: de7eff5fed5a2e61ddb5e19a304990bef29abc775b133a671f8e7498625a8477
Instruction ID: 9c2f10417d32a3b1d1100dbba2a4dd35e444a81e5c68a66e4cd22aca38eb2e72
Opcode Fuzzy Hash: de7eff5fed5a2e61ddb5e19a304990bef29abc775b133a671f8e7498625a8477
Instruction Fuzzy Hash: 08028370E1020A9FDB64EF58D4A06ADB7B2FB45311F22856AE815DF351DB34EC81CBA1

Function 06A59198 Relevance: 5.2, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A591EB
$]q, xrefs: 06A591DF
$]q, xrefs: 06A5921A
$]q, xrefs: 06A59226

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 1f84594beee15d759d4905d867edbf86487ed6927443bbaf61e70f0a7b9b45ab
Instruction ID: 7e1593278d1d5206b792258c0b0668ba61010dc9fb68eecdea9c22ac45907c72
Opcode Fuzzy Hash: 1f84594beee15d759d4905d867edbf86487ed6927443bbaf61e70f0a7b9b45ab
Instruction Fuzzy Hash: 99912E70B1021A9BDB54DF65D8907AFB7F6BF88204F108569D80DEF344EB349D868B92

Function 06A5CF88 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A5D37F
$]q, xrefs: 06A5D387
$]q, xrefs: 06A5D393

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 41a76d5b3421734714ea16eb4595ed8222463334dea85498ca4a856c023796d5
Instruction ID: 98aedc6cd57f2d361d1fc6132544ebbe2c2fb1edefde10acc231b04e33ecf4ac
Opcode Fuzzy Hash: 41a76d5b3421734714ea16eb4595ed8222463334dea85498ca4a856c023796d5
Instruction Fuzzy Hash: A9626C7070020A9BCB65EB69D580A5DB7F2FF84304F218A29E409DF354DB39ED96CB85

Function 06A547A8 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06A548D5
fbq, xrefs: 06A54EB5
\Obq, xrefs: 06A5495F

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: fec2e3a1af0bff1d9a0db178aae3ae0eedc359c52efe5b7b651fe93967a8abbd
Instruction ID: e1db72f3de8900a756c22de622e56a3b5bb3591e78f6105a7cba14dd8dcfbca4
Opcode Fuzzy Hash: fec2e3a1af0bff1d9a0db178aae3ae0eedc359c52efe5b7b651fe93967a8abbd
Instruction Fuzzy Hash: A5617170F002199FEB54EFA5C8547AEBAF6FB8C710F208429D50AAB395DB758C41CB91

Function 06A5A3F2 Relevance: 2.8, Strings: 2, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x!@, xrefs: 06A5A609
X!@, xrefs: 06A5A5E8

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: X!@$x!@
API String ID: 0-2527372166
Opcode ID: 8b65645b8b4200fa0af5d87728fad7f2da2b2a0de78981281f6db2c2f7fbefe6
Instruction ID: f5f4e9398e60f91aa12d1c6c208cc8d7ed51faa5a4359b1e48e20ac968a2bf9f
Opcode Fuzzy Hash: 8b65645b8b4200fa0af5d87728fad7f2da2b2a0de78981281f6db2c2f7fbefe6
Instruction Fuzzy Hash: E681A431B002059FCF55EBA9E85069DB7F2EF88314F118529EA0AEB750DB35DD46CB90

Function 06A5918A Relevance: 2.7, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A591DF
$]q, xrefs: 06A5921A

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: a9913e961e65b9743fe843b459cc666443df7763b9bb3bdb7701200cf95b2d18
Instruction ID: 761d114f3273fce1ec30136ad6b48ae8c16f0a963f27a64bd6b9fdb58bdbec8a
Opcode Fuzzy Hash: a9913e961e65b9743fe843b459cc666443df7763b9bb3bdb7701200cf95b2d18
Instruction Fuzzy Hash: 25516270B101059FDB55DB79D890BAFB7F6FB88210F108969D809DF384EA349C42CBA2

Function 06A429CF Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A42AEA

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3bd867d05ebc8ce2a259a433d827396b856ab0795d9e6b33014756b0eeea773c
Instruction ID: 611bdb3a73588318b0e876e62f1c9cf8e5cffba5f4276e1d73e8726fa025bd21
Opcode Fuzzy Hash: 3bd867d05ebc8ce2a259a433d827396b856ab0795d9e6b33014756b0eeea773c
Instruction Fuzzy Hash: 7551D3B1C00309EFDB15DF99D984ADEBBB5FF88350F24812AE818AB210D771A945CF51

Function 02F3F178 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4515309497.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a244d5f4319875e2674d41e0e20cc40116ec04b29294994c9dff14191729581
Instruction ID: 5446a2a12feeddaa5e9fc6fd9ce04f93044244fdae2c0373a07037dd66c0c321
Opcode Fuzzy Hash: 4a244d5f4319875e2674d41e0e20cc40116ec04b29294994c9dff14191729581
Instruction Fuzzy Hash: 5A416872D043959FCB04DFB9D8046EEBFF5AF89310F14866AD409A7641EB389840CBE1

Function 06A429D8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A42AEA

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bd71b1e0087c1b3407d69fbe945d056748b935851ef043b7d6bbd0cf161972ea
Instruction ID: 6a31d4ea55c8c2b1e8907c896e7242fc321d464ac2ddffd424668fd47c33b7dd
Opcode Fuzzy Hash: bd71b1e0087c1b3407d69fbe945d056748b935851ef043b7d6bbd0cf161972ea
Instruction Fuzzy Hash: 2F41A0B1D10349DFDB14DF9AC884ADEBBB5BF88310F24812AE819AB210D775A945CF90

Function 06A4632C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06A47689

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ca7c19c6bebfcb162dd681b7d3156803e05dea87d836593e5707a6ac80c4a916
Instruction ID: dcbf9ac4a9cd8050f3903f9c7415809356798b5af9c6c63daa370a33e01e36bc
Opcode Fuzzy Hash: ca7c19c6bebfcb162dd681b7d3156803e05dea87d836593e5707a6ac80c4a916
Instruction Fuzzy Hash: 0D4126B4900349CFDB54EF99C888AAAFBF5FF88314F258459D519AB321C775A841CFA0

Function 06A48309 Relevance: 1.6, APIs: 1, Instructions: 75comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06A48398

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: e79b7980228cfaaa953aab6b74e2c00f779e15ba4bd1a976b028455aa0433d9d
Instruction ID: 8d6c76d9d562064c97ba8a35943e7e25d6af673aa7978a0b85347c70fc0b3ced
Opcode Fuzzy Hash: e79b7980228cfaaa953aab6b74e2c00f779e15ba4bd1a976b028455aa0433d9d
Instruction Fuzzy Hash: 1731E2B0D01208DFDB54EF99D984BCEBBF5AB48304F248029E505BB290DB74A945CBA5

Function 06A47D40 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06A48398

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 124afd0b5d152a980b95d6998eb353e0066434c97a890d41ea35bf548c325c46
Instruction ID: d6ade94e5d6969b789f1f87701a05714510c22c25d7c7c8d40553da5486cc3b1
Opcode Fuzzy Hash: 124afd0b5d152a980b95d6998eb353e0066434c97a890d41ea35bf548c325c46
Instruction Fuzzy Hash: F93102B0D01208DFDB50EF99D984BDEBBF5EB48304F208029E504BB290DB78A845CBA5

Function 02F370B3 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 02F3712F

Memory Dump Source

Source File: 00000003.00000002.4515309497.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 0e8dca9416a488a02827ca26d28e4c19227f5675e57ebe3fd292c05321d313cd
Instruction ID: 316d23be02ec4b831bd72c0daccf68aa86d5dbe58b88ecb175c5fad67a2b52ee
Opcode Fuzzy Hash: 0e8dca9416a488a02827ca26d28e4c19227f5675e57ebe3fd292c05321d313cd
Instruction Fuzzy Hash: 822148B2C002598FDB10DFAAD484BEEFBF4AF49310F14845AE459B3251C738A945CF61

Function 06A46728 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A467B7

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 70960ff6fe82fa2457236409b92ddda3723c9f5bcf931c8b0eead5ef8fb72e0b
Instruction ID: cba9462fda113d7f2f81de793c39a3043a12cdf453b15cf5054a52ec599f83dd
Opcode Fuzzy Hash: 70960ff6fe82fa2457236409b92ddda3723c9f5bcf931c8b0eead5ef8fb72e0b
Instruction Fuzzy Hash: 9621E3B5D10249AFDB10DFAAD984ADEBFF8EB49310F14801AE958A3311C374A954CFA1

Function 06A46730 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A467B7

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6c367e1d771ec76263457bca0a3be00c55708f62dcccf9777e5097f879dc03f6
Instruction ID: 694c0761abe113348f442f89280347d3387a147207ff0ef504d80b3a56b9e776
Opcode Fuzzy Hash: 6c367e1d771ec76263457bca0a3be00c55708f62dcccf9777e5097f879dc03f6
Instruction Fuzzy Hash: 0C21E4B5D002499FDB10DFAAD884ADEBBF8FB48310F14801AE918A3310C374A944CFA1

Function 06A49E06 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06A49E83

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c3717a621393c3d42370e860577e6b31ef11868511494716ae2aa9770901491b
Instruction ID: 6e912b84dd1583069efb691d39860a6831808ecdcce1b64ff72871ae833ab9ae
Opcode Fuzzy Hash: c3717a621393c3d42370e860577e6b31ef11868511494716ae2aa9770901491b
Instruction Fuzzy Hash: 1B2113B5D002099FCB54DF9AC844BEFFBF5BB89310F10842AE419A7250CB75A944CFA1

Function 06A49E08 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06A49E83

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 06c3f0367f30122faca8ffe7f03ae826f005a36237f1b9642ae9b608302da094
Instruction ID: 942dedf0d358671c4c3187bea5b3d376e0c88007a80f71dbb89b9aed16ec926b
Opcode Fuzzy Hash: 06c3f0367f30122faca8ffe7f03ae826f005a36237f1b9642ae9b608302da094
Instruction Fuzzy Hash: E42113B5D002099FCB14DF9AC844BEFFBF5BB88310F10842AE419A7250CB75A944CFA1

Function 02F3F260 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02F3F2C7

Memory Dump Source

Source File: 00000003.00000002.4515309497.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2f30000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ec365d5b4dc58412cd6b482ab67c9b10fe783710399d561446584a354be51949
Instruction ID: e8d189dd753f4f8ad0533831bb48050df7ab9b5edbdcefd79ba3083dca39e444
Opcode Fuzzy Hash: ec365d5b4dc58412cd6b482ab67c9b10fe783710399d561446584a354be51949
Instruction Fuzzy Hash: 9A1112B1C0065A9BCB10CFAAC444ADEFBF4BB48320F11816AE818A7640D378A944CFA1

Function 06A40BAC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06A41996

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 393acdc4fe5605ed0bf4dbaa038fc9aee2ea6a934128047e650167bd0b24d011
Instruction ID: c9ea784bfe7ff5df87749aeef9fecf625a066ad715e74d24a21ec9dbcc473bd9
Opcode Fuzzy Hash: 393acdc4fe5605ed0bf4dbaa038fc9aee2ea6a934128047e650167bd0b24d011
Instruction Fuzzy Hash: CE11F0B5C002499FDB10EF9AC844AAEFBF4EB89210F10841AD519B7311D375A945CFA5

Function 06A4192B Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06A41996

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1daa42db18e3d51fe1df3c9bad33ffa8d9643e7ee77217b843fd7641e4f0e929
Instruction ID: 8bc3ef72b5639b609d98cf92e04164ccd171a273cc58d8b898c459ec2c4dab73
Opcode Fuzzy Hash: 1daa42db18e3d51fe1df3c9bad33ffa8d9643e7ee77217b843fd7641e4f0e929
Instruction Fuzzy Hash: 671132B5C007498FCB10EFAAD844ADEFBF8AF89220F10841AD468B7210C375A545CFA1

Function 06A464CC Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A4821D

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 606aa8680845fcb3453e08c094f60907d31c8d33aa06ac715ef2bc0831681d05
Instruction ID: f36b0f2f07e8dd0cc9246f7a408d6a305b71f1b006f1761108ca8c6473526a00
Opcode Fuzzy Hash: 606aa8680845fcb3453e08c094f60907d31c8d33aa06ac715ef2bc0831681d05
Instruction Fuzzy Hash: F91115B5C007498FDB50EF9AD848BDEBBF8EB48310F208459D529B7210C379A944CFA5

Function 06A46384 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06A478D5), ref: 06A4795F

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 663c0194d24ec4a4f707abbc807926177c76f208441fd6317b6900a5593a0238
Instruction ID: cf250b1aaf0d268d22ac8ff76e1ed0d36880d1de2d107a9e0d02c83e2f4d6c72
Opcode Fuzzy Hash: 663c0194d24ec4a4f707abbc807926177c76f208441fd6317b6900a5593a0238
Instruction Fuzzy Hash: CF1103B5C003899FCB50EF9AD848BDEBBF8EB88324F208459D519B7251C375A944CFA5

Function 06A478F8 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,06A478D5), ref: 06A4795F

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9ef01aabbf6e4009ac413595b1fba9e04e82351e5dbc400f0db8b21cd74ffe41
Instruction ID: f6a2ca1ac239cecb2a17779023ad0de3260537d10d83aa6fd7c3109e40ab9855
Opcode Fuzzy Hash: 9ef01aabbf6e4009ac413595b1fba9e04e82351e5dbc400f0db8b21cd74ffe41
Instruction Fuzzy Hash: 9C11F2B5C002498FCB50DF9AD844BDEBBF8AB89320F208419D519B7350C375A544CFA5

Function 06A481C1 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06A4821D

Memory Dump Source

Source File: 00000003.00000002.4520548854.0000000006A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a40000_RegSvcs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 35f1790862fecba6120f59489d357a7f7b1f54f42a7c40492a713006c170478c
Instruction ID: a1136132d6841736e8ae17550443b8af7e1b2cdc82eb0752db21b213c8bf79b9
Opcode Fuzzy Hash: 35f1790862fecba6120f59489d357a7f7b1f54f42a7c40492a713006c170478c
Instruction Fuzzy Hash: F51103B5C107498FCB20DFAAD448BDEFBF8AB48310F248459D529A7600C379A544CFA5

Function 06A5479D Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06A548D5

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: 07948d7b7d030c2d46b87c76481ff2800adf23cbbbb0929535488b306f09ff2f
Instruction ID: b71e5afacb15a66ad7138c84db467fcbb3f3c2162688f3d580974592fbe4d436
Opcode Fuzzy Hash: 07948d7b7d030c2d46b87c76481ff2800adf23cbbbb0929535488b306f09ff2f
Instruction Fuzzy Hash: 71418D70B002199FEB54EFA5C854B9EBAF7FF88700F208529E506AB394DB748C41CB91

Function 06A5DAFD Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A5DC59

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: f107f8a1be0c27b6bd52d018a2530c78286b91ef5df7d8cb9d19c90cc9750a1a
Instruction ID: bd4e923a94d009f96b8a5de527edfd98ec380c4ddd2e88c92e68280f26f5865f
Opcode Fuzzy Hash: f107f8a1be0c27b6bd52d018a2530c78286b91ef5df7d8cb9d19c90cc9750a1a
Instruction Fuzzy Hash: CD41A170E1020ADBDB64FF75D89069EBBB2BF85300F214929E805EB244DB74A946CB95

Function 06A52208 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A52343

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: afd1fb53ba691579ad4e8c3e8735ec97b61c69340bc4c6dbfb63e846c5434fc1
Instruction ID: 406e930b9de8c1ab8997bdda2a69c364d1d6f3c94b1c7e5c7b9aff3d2be2b714
Opcode Fuzzy Hash: afd1fb53ba691579ad4e8c3e8735ec97b61c69340bc4c6dbfb63e846c5434fc1
Instruction Fuzzy Hash: 2131B030B102069FDB58EB74D45466E77E3ABC9210F218868D80ADB385DE39DD86CB95

Function 06A54691 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06A5469D

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: \Obq
API String ID: 0-2878401908
Opcode ID: 92e27dd56b44d18c3e6e2dccad005f1e0786600ba9b0f31e5f438c4985c305c1
Instruction ID: 5e8c8568b310f6325e7a5eec8bfcce33ebef86d0fb7592271b52b5d2673e74e9
Opcode Fuzzy Hash: 92e27dd56b44d18c3e6e2dccad005f1e0786600ba9b0f31e5f438c4985c305c1
Instruction Fuzzy Hash: B6F0F430E50219DFDB54DF94D958BAEB7B2FF88701F204519E402A7694CB741C41CF80

Function 06A53ED8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b524c6b5d92c060c5ab77408255b9d0fc2a3d165f197260f294c8481965823
Instruction ID: f3feb1c53cd08de446a61ccf7092185c7c005afcad9191d9316b414d00b8046b
Opcode Fuzzy Hash: 26b524c6b5d92c060c5ab77408255b9d0fc2a3d165f197260f294c8481965823
Instruction Fuzzy Hash: D5816130B002099BDF54DB69D4546AEB7F3FF89304F218529E80ADB395EB35DC868B91

Function 06A55E28 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527a4a12af3a01db5e0a62ef714021a822bbf39e075fc3b4e15f7f9f9b50664a
Instruction ID: b179b3bac2aae99394d8b5dd8e078a7b5609e1d543cc0541c4cf658d7cb7e87b
Opcode Fuzzy Hash: 527a4a12af3a01db5e0a62ef714021a822bbf39e075fc3b4e15f7f9f9b50664a
Instruction Fuzzy Hash: 77619F71F001214FDB64EB6AC88066FBAD7AF95224B254479E80EDB360DE7ADD0287D1

Function 06A541F8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc90ddbd879a66866e8234ed734786da151be04af06bb22a87c937339cb930df
Instruction ID: 5a17abf5c19818cd01eae886a4a572d3ab80107630be642982671eaafb473762
Opcode Fuzzy Hash: fc90ddbd879a66866e8234ed734786da151be04af06bb22a87c937339cb930df
Instruction Fuzzy Hash: E7914C30E1021A8BDF60DF68C890B9DB7B1FF89310F208599D54DAB295DB70AA86CF51

Function 06A54210 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a24ca45618d1ab34067b4b861e7ecab5647e3a0287580db4f9eb9a181250b4
Instruction ID: 4f1836f62a129f4f0c72bc43cb31528e7148d3e2435c4957119f844ae6346942
Opcode Fuzzy Hash: 57a24ca45618d1ab34067b4b861e7ecab5647e3a0287580db4f9eb9a181250b4
Instruction Fuzzy Hash: 93912C30E1061A8BDF60DF68C890B9DB7B1FF89310F208599D54DBB255DB70AA86CF91

Function 06A5EB58 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84924468e2d883207e6f1bed8f6ce9fd0f7f20ad5bd0086ac79c5dc74cab0ac
Instruction ID: 11c003638c327d60b3b80b19f929bb6a4d3daee516b900ec22b402b8cd25e968
Opcode Fuzzy Hash: a84924468e2d883207e6f1bed8f6ce9fd0f7f20ad5bd0086ac79c5dc74cab0ac
Instruction Fuzzy Hash: B6713E71A002099FDB54EFA9C990A9EBBF6FF88300F258529E405EB355DB34ED46CB50

Function 06A5F67A Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c103103215bdc1d013899292ca01b415c35209d2110c188bff1d894e1ade86b
Instruction ID: 2c7883ccf26f6ae7ee6e0335f60ae688a7cf2954ed0c61860e8c03ab10810ea6
Opcode Fuzzy Hash: 6c103103215bdc1d013899292ca01b415c35209d2110c188bff1d894e1ade86b
Instruction Fuzzy Hash: CD51E474B201055FEF64A76DD99472F369AD78D310F214426E90ACB790CA3DCC918BD2

Function 06A5EB68 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4f220e859c44255c9e400a3a30ad1ab4731f46de61fcd613d2fc8ac9090ef3
Instruction ID: 1801c072ec0dce649cacabd8c2659800c294cadae398a863ad54b828bfda84a4
Opcode Fuzzy Hash: 8d4f220e859c44255c9e400a3a30ad1ab4731f46de61fcd613d2fc8ac9090ef3
Instruction Fuzzy Hash: F6711D71A002099FDB54EFA9C990A9DBBF6FF88300F258529D409EB355DB34ED46CB50

Function 06A5FCD0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8182cb6dd04cf378b68e8a40a75407695e906c9a59023385c7031dd0529ebb6c
Instruction ID: 4cb46d82f5452d61d10e532ecc1fafdc1ccf4357b4cf3d85337dfa0e3b7dbec6
Opcode Fuzzy Hash: 8182cb6dd04cf378b68e8a40a75407695e906c9a59023385c7031dd0529ebb6c
Instruction Fuzzy Hash: A6510331E001099FCF64FBB8E9446AEB7B2FB89315F104869E90ADB251DB358D56CF81

Function 06A5F688 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87282b353b75c74da366afe9c2453b86b6908fe3f61ef43db8428689f1215ed7
Instruction ID: a8072fc83e244eb134aefcd8464ae8335687dcbd7a718357276f1530c667d05a
Opcode Fuzzy Hash: 87282b353b75c74da366afe9c2453b86b6908fe3f61ef43db8428689f1215ed7
Instruction Fuzzy Hash: 4D51F5B4B201055FEF60A76DD98472E369AD78D310F21442AE90ADB394CA3DCC918B92

Function 06A55051 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b5c24fec1ebc89b00f532aa95046bb847cc719a4c87084bc1e2db0ca37ac9c
Instruction ID: 552ec994387fe08493e45f704835492883bedd00d9e6bcd8e5fb7fc2a210894a
Opcode Fuzzy Hash: e3b5c24fec1ebc89b00f532aa95046bb847cc719a4c87084bc1e2db0ca37ac9c
Instruction Fuzzy Hash: 8C41A271E002099FDF70EFA9C880AAFFBB1FB45310F11492AE556D7240D331A8458B90

Function 06A520B8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d90aa9c96bc8ba32420c984f5f3f55aa9e7b0a664b765326b25bfd0f55d268
Instruction ID: b919478ee31924a5ef102d4998d0224347a63f215b6883c0e01c8988edec7204
Opcode Fuzzy Hash: 28d90aa9c96bc8ba32420c984f5f3f55aa9e7b0a664b765326b25bfd0f55d268
Instruction Fuzzy Hash: 7931CE30E042469FCB59DF64C89469EBBB2BF8A300F10C41AE906EB751DB35AD46CB51

Function 06A520C8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54085acfb94431d26711ee79000a73ca6e992d38323c6048fddc1925aabbd89a
Instruction ID: 7f09a63c2cb4e453f8009c0cdd5f621e7dac17fecf466c96848ab51b14db0880
Opcode Fuzzy Hash: 54085acfb94431d26711ee79000a73ca6e992d38323c6048fddc1925aabbd89a
Instruction Fuzzy Hash: 1F317A30E0020A9FDB59DF65C89469EB7B2FF89310F11C929E90AEB750DB75AD42CB50

Function 06A53AE0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fb2f66e425b214b088b2d2b5fd6ad4c5466eb3bc871b210304c32fe8f70ec3
Instruction ID: 0c161789f724710c8222ea11166097e02d223b5c6595adedb47f5a5f600c1762
Opcode Fuzzy Hash: 30fb2f66e425b214b088b2d2b5fd6ad4c5466eb3bc871b210304c32fe8f70ec3
Instruction Fuzzy Hash: CF219C75F106059FDF50EF69D880AAEBBF1EB88350F118029E909EB381E734DD418B91

Function 06A53AF0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbcf37bac6d17de5c9a35f9d6cab8a1661b0596e6243aea14a59c2a7c04a4a0
Instruction ID: 9c8da27bc62cdc914cf2fa797e7c22b5086c992dfa9e26f7d54253ee4f320800
Opcode Fuzzy Hash: cbbcf37bac6d17de5c9a35f9d6cab8a1661b0596e6243aea14a59c2a7c04a4a0
Instruction Fuzzy Hash: B4218B75E106059FDF50EF69D880AAEB7F1EB88350F118029E905EB381E735DD418B95

Function 02EED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4515127462.0000000002EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2eed000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae2add9d303fc538d0c2e0be990622bae10f60fe1ae38ccb1f6e5866a7e8597
Instruction ID: b4fbc510cd73e2fb98d969ce404fc513d7850e8cdc1c57d37275c9d9ab87fa2f
Opcode Fuzzy Hash: 9ae2add9d303fc538d0c2e0be990622bae10f60fe1ae38ccb1f6e5866a7e8597
Instruction Fuzzy Hash: 8D21F2B1684240DFDF14DF14D9C4B26BBAAFB84318F28C56DD80B4B286C33AD807CA61

Function 02EED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4515127462.0000000002EED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2eed000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7709887e6215b3ba93ba69b7474f3a45d64b26564b58bb7135bdc7632eb7903b
Instruction ID: 85388d557d429943dde87967ed3693d223c493f742efafbce24f476fc1867fc1
Opcode Fuzzy Hash: 7709887e6215b3ba93ba69b7474f3a45d64b26564b58bb7135bdc7632eb7903b
Instruction Fuzzy Hash: 162165755493C08FDB12CF24D994715BF72EB46214F28C5DAD8498F6A7C33A940ACB62

Function 06A5A350 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8ed6c2e510e8e4830d491dffb890434850970811bc283e08ff4812523f8f1e
Instruction ID: 3ab52d82337a0aefe0892153c524dd9805526970e2158af3eda863fab14ccbd0
Opcode Fuzzy Hash: 5f8ed6c2e510e8e4830d491dffb890434850970811bc283e08ff4812523f8f1e
Instruction Fuzzy Hash: 3811D2347001152BCB61E63DD850B6FBBD6EB86668F118529FA0ECB742EA28CC4687D5

Function 06A53C00 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da87f2e61ece0753c8b66a369243893e9282445477532a96b990b068caa651ec
Instruction ID: fb8382dbe5675059435b96d38b6dd5bf69e9fe277fcacfc673afbde20ee61b87
Opcode Fuzzy Hash: da87f2e61ece0753c8b66a369243893e9282445477532a96b990b068caa651ec
Instruction Fuzzy Hash: CD116132B141258BDF54E769D8246AE73BAEBC8350F018539D90AEB350EF35DC0A8BD1

Function 06A538B8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b2601bb25412117a32262d9407bf13d6c163403f3d6ae3ea98091f059ac1e7
Instruction ID: 75468b26a1a205a27b94f6642f577989258e8026cb15793ac197194287eab9a1
Opcode Fuzzy Hash: 49b2601bb25412117a32262d9407bf13d6c163403f3d6ae3ea98091f059ac1e7
Instruction Fuzzy Hash: 8321E0B5C01259AFCB00DF9AD884ACEFFB8FB48350F10812AE918A7300C374A554CFA5

Function 06A53E37 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56020bda7e4d5a7467e6e08104c3d6e1a65c11667f352645a984636f48e32f1d
Instruction ID: d7a856d49cc9bf101c9208d6acec1eaf389e623d03da407a502d527c2bc72a0b
Opcode Fuzzy Hash: 56020bda7e4d5a7467e6e08104c3d6e1a65c11667f352645a984636f48e32f1d
Instruction Fuzzy Hash: 3501F131B040101BDF21E66EA45475FBBCBDBC6654F10883DE90ECB782E939CC424391

Function 06A5EDD8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a1efc5b6163b340b91ebfaa85426888d2d086fb360345af9353a2c85ac9969
Instruction ID: 9dcfb8f58e2961ac0503fc3590b43c57604acd88823bbaa1f17d6e21b911db56
Opcode Fuzzy Hash: 43a1efc5b6163b340b91ebfaa85426888d2d086fb360345af9353a2c85ac9969
Instruction Fuzzy Hash: 7001F131B100102BCB21EA3C9490B2FB7D7EBCA624F118829E90ECB341DA29DC0743A1

Function 06A53BF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bce8ecf321c706ad554ee2f72e28b5f4b470e6465bc9b6705eefb5610459f01
Instruction ID: bae22e2eea6577a438bd98cc5a8c041bca19dfaf526ecb2a622dc84978ec85a5
Opcode Fuzzy Hash: 7bce8ecf321c706ad554ee2f72e28b5f4b470e6465bc9b6705eefb5610459f01
Instruction Fuzzy Hash: E1018F32B141255BEF55EA69DC206EB72EBEBC8750F018439E90AD7380EF25DC0A47D2

Function 06A5309D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d74de2804fc0904b790f730fca0e2b2ed7e7cebb82ee4854ae7f0bef7ee9c63
Instruction ID: b7793709cdacc2db49920d5de43461a9ee24f72d97cb0244e99b6a8b112390d2
Opcode Fuzzy Hash: 1d74de2804fc0904b790f730fca0e2b2ed7e7cebb82ee4854ae7f0bef7ee9c63
Instruction Fuzzy Hash: 8F116171E002149FCF68EB79D8405DEF7B2BBC9350F15856AD90AEB240EA308941CBA1

Function 06A538C0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81064a31ca5ad501ea61da3733bd8dda2728d4ad38b41da26dd81e92d4d72f5c
Instruction ID: 2220f0258007aa70474ceea34c8db43dda4b923fefae0f416431e1b2f4a5a5e8
Opcode Fuzzy Hash: 81064a31ca5ad501ea61da3733bd8dda2728d4ad38b41da26dd81e92d4d72f5c
Instruction Fuzzy Hash: FE11CFB5D01259AFCB00DF9AD884ADEFBB8FB48310F50812AE918A7200D374A954CFA5

Function 06A53E48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271d02c5435d776f50cc9bf56e7f94e4ae49b9f19b7596fdf77b113267b94182
Instruction ID: a78e3958c0cc7d4aae58939130771d703d8a77fb0ecb5e183c518e633d012b24
Opcode Fuzzy Hash: 271d02c5435d776f50cc9bf56e7f94e4ae49b9f19b7596fdf77b113267b94182
Instruction Fuzzy Hash: 1701AD31B000110BDF60E66EA45472FB3CBDBCA664F218839E90ECB781E979DC024395

Function 06A5EDE8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362df6b380dd4cdeea66f2a49d0cfc78564292bf97732e2e53f1cad34c53d5cf
Instruction ID: fd9438eb31532f80f790c35f9907ded567e53cb8ed789dbc3110c66d88f555ad
Opcode Fuzzy Hash: 362df6b380dd4cdeea66f2a49d0cfc78564292bf97732e2e53f1cad34c53d5cf
Instruction Fuzzy Hash: 1D01D131B100111BCB65E62D945472EB2D7EBCA624F218839E90ECB340DE29DD434395

Function 06A5A360 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dddbc765e7cb0a147b0d19969e3cd7ffe1591e061580e130267fb2fea54752c
Instruction ID: 0ab3275f0eddeec7b9dfd62dd126053fd72a6f4d6479e220e6b677b076af2006
Opcode Fuzzy Hash: 7dddbc765e7cb0a147b0d19969e3cd7ffe1591e061580e130267fb2fea54752c
Instruction Fuzzy Hash: 3E01F435B000151FDB60EB3DD44072EF3D7EB89668F118929EA0ECB340EA39DC428784

Function 06A5C818 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e9fa06f3cc0a1d21d66694296713f2a40d2172644caa5b32897ec2484259dd
Instruction ID: e12f3bc9e9440e635f9f79aa9056238da4ad86a4e2aaa1f746a807d089324307
Opcode Fuzzy Hash: 40e9fa06f3cc0a1d21d66694296713f2a40d2172644caa5b32897ec2484259dd
Instruction Fuzzy Hash: BFF0A736F20234A7DB24A666EC00A9AB73AF784760F014429ED02E7244DA32AC10C7C0

Function 06A564B0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4044368050efacb89c3a62d2ed91baa2997545ef6e3606c88d8e41bb374f7ee9
Instruction ID: ed0bfcfeea1493977b19dedc1dfcdc4250f9c0174112b0bcf555b4d2b8cb3520
Opcode Fuzzy Hash: 4044368050efacb89c3a62d2ed91baa2997545ef6e3606c88d8e41bb374f7ee9
Instruction Fuzzy Hash: 68E0D871E102086BDB50EF74CE4575B76BDD701204F6248B5D809CF202E137CD028351

Non-executed Functions

Function 06A576E0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A57C42
$]q, xrefs: 06A5780D
$]q, xrefs: 06A57C2C
$]q, xrefs: 06A57B99
$]q, xrefs: 06A57C4E
$]q, xrefs: 06A577D0
$]q, xrefs: 06A577DC
$]q, xrefs: 06A57801
$]q, xrefs: 06A57B8D
$]q, xrefs: 06A57C38

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 562ec316256fa9cfb1306557ce88f2fe32177c832252e16371c9633387d19486
Instruction ID: 538de48c101478b2e37ba2c80b674832998a5a8bbda32c45e49315b711126473
Opcode Fuzzy Hash: 562ec316256fa9cfb1306557ce88f2fe32177c832252e16371c9633387d19486
Instruction Fuzzy Hash: 38121C70E002198FDB65EF69C854AADB7F2BF88304F218969D909AB355DB34DD81CF81

Function 06A5A988 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A5AB3A
$]q, xrefs: 06A5AAE5
$]q, xrefs: 06A5AAD9
$]q, xrefs: 06A5AB46
$]q, xrefs: 06A5AB10
$]q, xrefs: 06A5AA7E
$]q, xrefs: 06A5AA8A
$]q, xrefs: 06A5AB04

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 7e563128e8f7bbc65d2d103ae0129b75bd500f5d629865170bf9e48c9160ca74
Instruction ID: 7bb80e42498ab37362fc452c1c7e527a8c27f14851d6e81b74620f678a13bb58
Opcode Fuzzy Hash: 7e563128e8f7bbc65d2d103ae0129b75bd500f5d629865170bf9e48c9160ca74
Instruction Fuzzy Hash: 7A915070B10209DFDB64EFA5D994B6EB7F2FF44340F128629DA019B291DB759C81CB90

Function 06A570E0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A573C2
$]q, xrefs: 06A5741C
$]q, xrefs: 06A5757C
$]q, xrefs: 06A575F4
$]q, xrefs: 06A57428
.5uq, xrefs: 06A5713B
$]q, xrefs: 06A575E8

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 7aebe7f203fd08995ada80d5ccac5ed81b47935eb73047ec8751ee9fbd7b4c1e
Instruction ID: 750d63bdac6b764b86a1b001215e0d0111571907d2c370bd735aa07a68202b88
Opcode Fuzzy Hash: 7aebe7f203fd08995ada80d5ccac5ed81b47935eb73047ec8751ee9fbd7b4c1e
Instruction Fuzzy Hash: F6F11C70A10205DFDB59EF69C994A6EB7B3FF88340F218569D805AB354DB35EC82CB81

Function 06A58418 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A5867E
$]q, xrefs: 06A58672
$]q, xrefs: 06A586D7
$]q, xrefs: 06A586E3

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 65ac50cb8e2321cabf03e2cbb8c4e338eff3d9f64dc5a399f29aebe25e78cd8a
Instruction ID: fea75a62704f30d4d7d29e9c4e74b6fc756032906d1f4dfe878acd445310e493
Opcode Fuzzy Hash: 65ac50cb8e2321cabf03e2cbb8c4e338eff3d9f64dc5a399f29aebe25e78cd8a
Instruction Fuzzy Hash: 93B11A70A11219CFDB54EF69C89466EB7B3FF88304F258829D8069B355DB79DC82CB81

Function 06A58830 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06A58972
LR]q, xrefs: 06A58923
$]q, xrefs: 06A588AF
$]q, xrefs: 06A588BB

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 3b32e031918c1339bed793ed962910b19615564ca77a05c8745c79bfbbf9e2ce
Instruction ID: ab5e31656976b54afa6dc3c47e6b83d6b471c266e8dcce71444c4c8456366043
Opcode Fuzzy Hash: 3b32e031918c1339bed793ed962910b19615564ca77a05c8745c79bfbbf9e2ce
Instruction Fuzzy Hash: 7451B430B002159FDB54EB29D980A6AB7F2FF88344B118569E8069F3A5DB39EC41CB91

Function 06A5AD1A Relevance: 5.2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A5AE41
$]q, xrefs: 06A5AEEC
$]q, xrefs: 06A5AE94
$]q, xrefs: 06A5AEC3

Memory Dump Source

Source File: 00000003.00000002.4520594546.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 7af0ba3b32fe729287bc27368b5fa0d1626c4712323d661582225e0efae3093d
Instruction ID: d91fde15560b39463c0ac614a4a86df9fa576a557b800381a592ee9856f04590
Opcode Fuzzy Hash: 7af0ba3b32fe729287bc27368b5fa0d1626c4712323d661582225e0efae3093d
Instruction Fuzzy Hash: 6E517270B102059BDF65EB64D9806AEB3B2FF85311F218A2AEE06DB340DB35DC41CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AWB DHL#40882993049403.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AWB DHL#40882993049403.pdf.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
AWB DHL#40882993049403.pdf.exe

Function 02D3ADA8 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 05A2E8D8 Relevance: 1.6, Strings: 1, Instructions: 370
COMMON

Function 02D344B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02D3590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 053E4040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 02D3D751 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Function 02D3D27C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 02D3D689 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 02D3A130 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 02D3B218 Relevance: 1.6, APIs: 1, Instructions: 51
libraryCOMMON

Function 02D3AF98 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre