Edit tour

Windows Analysis Report
SumatraPDF-3.5.2-64.exe

Overview

General Information

Sample name:	SumatraPDF-3.5.2-64.exe
Analysis ID:	1467016
MD5:	c02dc2ca96fe9841963883c0fe177399
SHA1:	7e42e66e9198c258da48a6194577e3dbd424463a
SHA256:	290e4aa7ed64c728138711c011e89aab7aa48dbc1ae430371dc2be4100b92bf0
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Contains capabilities to detect virtual machines

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Classification

Process Tree

System is w7x64

SumatraPDF-3.5.2-64.exe (PID: 2544 cmdline: "C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe" MD5: C02DC2CA96FE9841963883C0FE177399)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: SumatraPDF-3.5.2-64.exe

Static PE information: certificate valid

Source: SumatraPDF-3.5.2-64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Bookmark Shortcuts%.2flnkfitwidthfitpage"%s" -page %d -view "%s" -zoom %s -scroll %d,%dfitcontentSelect folder with PDF filesBookmark shortcut to page %s of %s.xps;.oxps.pdf.ps;.eps.djvu.chm.cbz;.cbr;.cb7;.cbt.svgSVG documents.mobi.epub.pdb;.prc.fb2;.fb2z;.zfb2;.fb2.zip.bmp;.dib;.gif;.jpg;.jpeg;.jxr;.png;.tga;.tif;.tiff;.webp;.heic;.avifImagesAll supported documents.txt;.log;.nfo;file_id.diz;read.me;*.tcrVK_DOWN source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: SumatraPDF-dll.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\kjk\src\sumatrapdf\out\rel64\SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: -64.pdb.lzsa source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: </html>.pdb<<html> source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\user\Desktop\crashinfo\SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\crashinfo\libmupdf.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\user\Desktop\crashinfo\SumatraPDF-dll.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF.pdbSumatraPDF-dll.pdblibmupdf.pdbInstallCrashHandler: skipping because !crashDumpPath source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa% source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libmupdf.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: ITSF.txt.js.json.xml.logfile_id.dizread.me.nfo.tcr.ps.ps.gz.eps.fb2.fb2z.fbz.zfb2.fb2.zip.cbz.cbr.cb7.cbt.pdf.xps.oxps.chm.png.jpg.jpeg.gif.tif.tiff.bmp.tga.jxr.hdp.wdp.webp.epub.mobi.prc.azw.azw1.azw3.pdb.html.htm.xhtml.svg.djvu.jp2.zip.rar.7z.heic.avif.tarfoo.epubfoo.JP2Rar! source: SumatraPDF-3.5.2-64.exe

Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0/documentstructure
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0/fixedrepresentation
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://www.daisy.org/z3986/2005/ncx/
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://www.gribuser.ru/xml/fictionbook/2.0
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://www.idpf.org/2007/opf
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: http://www.idpf.org/2007/opfapplication/xhtml
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://://https://translate.google.com/?op=translate&sl=auto&tl=$
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORS
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORShttps://github.com/sumatrapdfreade
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/blob/master/TRANSLATORS
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/%s)
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175
Source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175)
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussions
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://github.com/sumatrapdfreader/sumatrapdf/discussionsSumatraPDF
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://sumatra-website.onrender.com/update-check-rel.txt
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.deepl.com/translator#-/$
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.google.com/search?q=$
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2
Source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa
Source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa%
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Contribute-translation
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Corrupted-installation
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Keyboard-shortcuts
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Submit-crash-report.html
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Submit-crash-report.htmlShowCrashHandlerMessage:
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/docs/Version-history.html
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/download-free-pdf-viewer
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/manual
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/manualArialwebsiteArial
Source: SumatraPDF-3.5.2-64.exe, SumatraPDF-settings.txt.0.dr	String found in binary or memory: https://www.sumatrapdfreader.org/settings/settings3-5-1.html
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/update-check-rel.txt
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress

Source: classification engine

Classification label: clean1.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

File created: C:\Users\user\Desktop\SumatraPDF-settings.txt

Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Mutant created: NULL

Source: SumatraPDF-3.5.2-64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: 64-.\n\n 64- tl:Nag-i-install ka n
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: sv:Kunde inte hitta SumatraPDF-installation. ta:PDF . th:
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: run-install-now
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: ssilentprint-to-defaultprint-dialogh?helpexit-when-doneexit-on-printrestrictpresentationfullscreeninvertcolorsinvert-colorsconsoleinstalluninstallwith-filterwith-searchwith-previewrandregressxtestertestappnew-windowlogcrash-on-openreuse-instanceesc-to-exitenum-printerssleep-msprint-toprint-settingsinverse-searchforward-searchfwdsearchnameddestnamed-destpageviewzoomscrollappdatapluginstress-testnmaxrenderextract-textbenchdinstall-dirlangupdate-self-todelete-filebgcolorbg-colorfwdsearch-offsetfwdsearch-widthfwdsearch-colorfwdsearch-permanentmanga-modesearchall-usersallusersrun-install-nowtest-browseraddeset-color-rangeCall to EnumPrinters failed with error %#xSumatraPDF - EnumeratePrinters, default%s (Port: %s, attributes: %#x%s)
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: sumatra-install-log.txt
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: -run-install-now
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: -install-dir "
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: Re-launching '%s' as elevated, args
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: allUsers but not elevated: re-starting as elevated
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: TopRightBottomLeftDxDy#000000#ffffff#f5fc0cTextColorBackgroundColorSelectionColorWindowMarginPageSpacingGradientColorsInvertColorsHideScrollbarsWindowMarginPageSpacingCbxMangaModeUseFixedPageUIURLNameCommandLineNameFiltershrinkPrintScale#6581ffHighlightOffsetHighlightWidthHighlightColorHighlightPermanent#ffff00#00ff00#ff00ff#ff0000HighlightColorUnderlineColorSquigglyColorStrikeOutColorFreeTextColorFreeTextSizeFreeTextBorderWidthTextIconColorTextIconTypeDefaultAuthorCmdKeyXYDxDyNamePageNoPageLabel0XYFilePathFavoritesIsPinnedIsMissingOpenCountDecryptionKeyUseDefaultStateDisplayModeScrollPosPageNoZoomRotationWindowStateWindowPosShowTocSidebarDxDisplayR2LReparseIdxTocStateFilePathDisplayModePageNoZoomRotationScrollPosShowTocTocStateTabStatesTabIndexWindowStateWindowPosSidebarDxDwHighDateTimeDwLowDateTimeFor documentation, see https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33 12.5 18 25 33.33 50 66.67 75 100 125 150 200 300 400 600 800 1000 1200 1600 2000 2400 3200 4800 6400#80fff200Settings below are not recognized by the current versionThemeFixedPageUIComicBookUIChmUISelectionHandlersExternalViewersZoomLevelsZoomIncrementPrinterDefaultsForwardSearchAnnotationsDefaultPasswordsRememberOpenedFilesRememberStatePerDocumentRestoreSessionUiLanguageInverseSearchCmdLineEnableTeXEnhancementsDefaultDisplayModeDefaultZoomShortcutsEscToExitReuseInstanceReloadModifiedDocumentsMainWindowBackgroundFullPathInTitleShowMenubarShowToolbarShowFavoritesShowTocNoHomeTabTocDySidebarDxToolbarSizeTabWidthTreeFontSizeTreeFontWeightOffsetTreeFontNameSmoothScrollShowStartPageCheckForUpdatesVersionToSkipWindowStateWindowPosUseTabsUseSysColorsCustomScreenDPIFileStatesSessionDataReopenOnceTimeOfLastUpdateCheckOpenCountWeekSumatraPDF.exesumatra-install-log.txtExtractFiles(): dir '%s'
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: -run-install-now -all-users -with-filter -with-preview -silent -log -install-dir "Re-launching '%s' as elevated, args
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: -run-install-now -all-users -with-filter -with-preview -silent -log -install-dir "Re-launching '%s' as elevated, args
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: Learn more at https://www.sumatrapdfreader.org/docs/Corrupted-installation
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: writes installation log to %LOCALAPPDATA%\sumatra-install-log.txt
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: See more at https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: Learn more at <a href="https://www.sumatrapdfreader.org/docs/Corrupted-installation">www.sumatrapdfreader.org/docs/Corrupted-installation</a>.SumatraPDF installer${appName}${appName} installer options:
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: See more at https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments<a href="https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments">Read more on website</a>SumatraPDF installer usageSumatraPDF is running as admin and cannot open files from a non-admin processNot a valid installerrb<a href="https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316">Read more about this error</a>this is not a SumatraPDF installer, -x option not available
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: re-launching '%s' with args '%s' as elevated
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: -install
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: sumatra-installer
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: Do you want to install new version?New version availableDon't installSumatraPDF UpdateSkip this versionInstall and relaunch -sleep-ms 500 -exit-when-done -update-self-to "%s" -installsumatra-installerNotifyUserOfUpdate: installer cmd: '%s'
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: tl:&Magpatuloy sa pag-install ng 32-bit na bersyon
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: tl:Hindi ma-install ang PDF previewer
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: tl:Hindi ma-install ang PDF search filter
Source: SumatraPDF-3.5.2-64.exe	String found in binary or memory: tl:Huwag i-install

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: cscdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: SumatraPDF-3.5.2-64.exe

Static PE information: certificate valid

Source: SumatraPDF-3.5.2-64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SumatraPDF-3.5.2-64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SumatraPDF-3.5.2-64.exe

Static file information: File size 16065496 > 1048576

Source: SumatraPDF-3.5.2-64.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x59b200
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x279400
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Raw size of .data is bigger than: 0x100000 < 0x62d600

Source: SumatraPDF-3.5.2-64.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SumatraPDF-3.5.2-64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SumatraPDF-3.5.2-64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SumatraPDF-3.5.2-64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Bookmark Shortcuts%.2flnkfitwidthfitpage"%s" -page %d -view "%s" -zoom %s -scroll %d,%dfitcontentSelect folder with PDF filesBookmark shortcut to page %s of %s.xps;.oxps.pdf.ps;.eps.djvu.chm.cbz;.cbr;.cb7;.cbt.svgSVG documents.mobi.epub.pdb;.prc.fb2;.fb2z;.zfb2;.fb2.zip.bmp;.dib;.gif;.jpg;.jpeg;.jxr;.png;.tga;.tif;.tiff;.webp;.heic;.avifImagesAll supported documents.txt;.log;.nfo;file_id.diz;read.me;*.tcrVK_DOWN source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: SumatraPDF-dll.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\kjk\src\sumatrapdf\out\rel64\SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: -64.pdb.lzsa source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: </html>.pdb<<html> source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\user\Desktop\crashinfo\SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\crashinfo\libmupdf.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: C:\Users\user\Desktop\crashinfo\SumatraPDF-dll.pdb source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SumatraPDF.pdbSumatraPDF-dll.pdblibmupdf.pdbInstallCrashHandler: skipping because !crashDumpPath source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa% source: SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libmupdf.pdb source: SumatraPDF-3.5.2-64.exe
Source:	Binary string: ITSF.txt.js.json.xml.logfile_id.dizread.me.nfo.tcr.ps.ps.gz.eps.fb2.fb2z.fbz.zfb2.fb2.zip.cbz.cbr.cb7.cbt.pdf.xps.oxps.chm.png.jpg.jpeg.gif.tif.tiff.bmp.tga.jxr.hdp.wdp.webp.epub.mobi.prc.azw.azw1.azw3.pdb.html.htm.xhtml.svg.djvu.jp2.zip.rar.7z.heic.avif.tarfoo.epubfoo.JP2Rar! source: SumatraPDF-3.5.2-64.exe

Source: SumatraPDF-3.5.2-64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SumatraPDF-3.5.2-64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SumatraPDF-3.5.2-64.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

API coverage: 6.9 %

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Code function: 0_2_0000000140134BD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0000000140134BD8

Source: SumatraPDF-3.5.2-64.exe

Binary or memory string: Shell_TrayWndKillProcessesUsingInstallation()

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe

Code function: 0_2_0000000140134F68 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000140134F68

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SumatraPDF-3.5.2-64.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://github.com/sumatrapdfreader/sumatrapdf/commit/%s)	0%	Avira URL Cloud	safe
http://www.idpf.org/2007/opf	0%	Avira URL Cloud	safe
http://www.idpf.org/2007/opfapplication/xhtml	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Submit-crash-report.htmlShowCrashHandlerMessage:	0%	Avira URL Cloud	safe
https://www.google.com/search?q=$	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/manualArialwebsiteArial	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175)	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/discussionsSumatraPDF	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/discussions	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORShttps://github.com/sumatrapdfreade	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/settings/settings3-5-1.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/update-check-rel.txt	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments	0%	Avira URL Cloud	safe
http://www.gribuser.ru/xml/fictionbook/2.0	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORS	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Contribute-translation	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/	0%	Avira URL Cloud	safe
https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Corrupted-installation	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Keyboard-shortcuts	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Submit-crash-report.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf	0%	Avira URL Cloud	safe
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/TRANSLATORS	0%	Avira URL Cloud	safe
https://sumatra-website.onrender.com/update-check-rel.txt	0%	Avira URL Cloud	safe
https://://https://translate.google.com/?op=translate&sl=auto&tl=$	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa%	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/docs/Version-history.html	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.	0%	Avira URL Cloud	safe
http://www.daisy.org/z3986/2005/ncx/	0%	Avira URL Cloud	safe
https://www.deepl.com/translator#-/$	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/manual	0%	Avira URL Cloud	safe
https://www.sumatrapdfreader.org/download-free-pdf-viewer	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.idpf.org/2007/opf	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/commit/%s)	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://www.idpf.org/2007/opfapplication/xhtml	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/settings/settings3-5-1.html8.33	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Submit-crash-report.htmlShowCrashHandlerMessage:	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?q=$	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/manualArialwebsiteArial	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/discussions/2316	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/discussionsSumatraPDF	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175)	SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/download-free-pdf-viewer-------------	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/discussions	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/settings/settings3-5-1.html	SumatraPDF-3.5.2-64.exe, SumatraPDF-settings.txt.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORShttps://github.com/sumatrapdfreade	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/update-check-rel.txt	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Installer-cmd-line-arguments	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://www.gribuser.ru/xml/fictionbook/2.0	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/AUTHORS	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Contribute-translation	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa	SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/dl/prerel/PRE_RELEASE_VER/SumatraPDF-prerel	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://sumatra-website.onrender.com/update-check-rel.txtInstaller64LatestInstaller32InstallerArm64P	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/update-check-rel.txtnotifUpdateCheckInProgress	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/commit/646d1feddcc80b3b51072c5b27a1446487904175	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Corrupted-installation	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Keyboard-shortcuts	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Keyboard-shortcutssumatrapdfrestrict.inihttps://www.sumatrapdf	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Submit-crash-report.html	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://://https://translate.google.com/?op=translate&sl=auto&tl=$	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://github.com/sumatrapdfreader/sumatrapdf/blob/master/TRANSLATORS	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/dl/rel/SumatraPDF-3.5.2-64.pdb.lzsa%	SumatraPDF-3.5.2-64.exe, 00000000.00000002.651982488.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sumatra-website.onrender.com/update-check-rel.txt	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/docs/Version-history.html	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/URLUpdateInfohttps://www.sumatrapdfreader.org/docs/Version-history.	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
http://www.daisy.org/z3986/2005/ncx/	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.deepl.com/translator#-/$	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/manual	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown
https://www.sumatrapdfreader.org/download-free-pdf-viewer	SumatraPDF-3.5.2-64.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467016
Start date and time:	2024-07-03 16:28:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SumatraPDF-3.5.2-64.exe
Detection:	CLEAN
Classification:	clean1.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, svchost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
VT rate limit hit for: SumatraPDF-3.5.2-64.exe

Simulations

Behavior and APIs

Time	Type	Description
10:29:33	API Interceptor	516x Sleep call for process: SumatraPDF-3.5.2-64.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://www.filemail.com/t/RuKZYfeB	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	199.232.214.172
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6737.3783.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://url7304.disco-mailer.net/ls/click?upn=u001.DWLeRfOXStcSaUNphm6ZnGquuezyvOF0FIuLMCSCrIQ9t3e8n3fjexKHJjVTV-2BQUFT1dnxR3BcyXaxz-2BblhjX71zswvTIlAGm31luuFhJgeOGXb3dn9Itq74-2Fe-2BlKg-2Bs0-2F4odRns7kSdvfqBhyqSbrYsnPmx4SeDwlRdlhHbM3UucitnipcwJ1gR7h8DzOIUWsvEslHUA8FsNTNWtsq3Q-2FU-2FPeBtGbo-2Fx3kgcXxAZuE-3DPmkq_5KlZmZKASPtIpYbHU6HHQmxS-2FHe3g010GX01BBBmlalJnMdBClXoEYQADKPWInqgHw-2B5921oa-2Fum9DxIHV8wgOarlsOnYJwzp6I2lNDfeCQdFcL55956QetBM0U9iihLLCXzc7MWVFcQDUwnaU8PUgQFrTwK63nQhJu8ngVllYSJR-2BUamfX7Ej8Gpp4vMWsL8t65JTtpjdFVQ36IgP-2B2LxLYSj9SfdmLAt97TCVXHWn7xANKqYpl-2BYx09SetkszDOjJuUV9L9bqZ-2FbmClOsUrPLylG74RJ8zQAREr7-2BUktmlWKoc8C7oqqTOKv340mZnTc-2FztCVjFgPMm1Bz5lR5AptUVEvvSBboXVGluKKoNkkMFkS-2BmNybyD3Aa-2BX8UZ5s	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://inpzk.useringimportdulcimer.ink/?=vxkncwole9	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	1C769A32-2CBF-4738-9013-480E0434BAEF_06182024030338389.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	https://u6071375.ct.sendgrid.net/ls/click?upn=u001.jNebCYco-2BJgBMGJDj1kJWP39IKixFvDeSBij1PLovvXT0hkMSWjEhuIEgwQ-2F309CwGFmoY6-2Bl45VLW7K9Sd8-2Fg-3D-3Dm1D8_bgsmQmhs-2BDkrnAcljUiGIti1-2F3303-2FliL2Lyr586-2FN9rAlBFKILfRyjObk6Iz5-2FtMSxC-2FhiWOZXbqnmzeZXBiy3CSpPIYxz2-2BTcFMtFX6z-2FFKaL9cuMNNsd9H8Soth9M-2BiGwIhw5kRyphke6a8RYyV0rtdDONsX7lNk6Cr796v-2FIJZ8nzBJ39o6b-2FDySakEM-2B9nvScrgUWzDogJp7LxfPQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	La1EGA8voq.exe	Get hash	malicious	Remcos	Browse	199.232.210.172
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFhSZp6GshBFVdVLEzBsru52fhlDAZ8Q3OfCA-2F-2Bk2qB9l25yp_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZM3qYZS8WARR8FVyg-2FqvoINWytiD-2FheyMDzu6v-2BoRt5KWyPoztbWkeGPmxB3DyZYTb9a0dAMPLFunr2Ay3ayAFAAvKLYcNXJh5TbSbsyQLthHxBhJhxiFX8keWC7AD3Hw3SgmU-2Be6lkIQuq7tgnHL9CbCr8GEaIyKgtaL1D3uFR7kdAbCakzZIHLBzzIP6uu3b9lr3L70N6m-2FPL5vz2WpJ-2B4Z2WkXjdKV6CAWTeZlidHHDlZecGQIcrIqiWGF6jpeY-3D#Dsonya.buzzard@aggregate.com	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\SumatraPDF-settings.txt

Download File

Process:	C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1900
Entropy (8bit):	5.178903367295074
Encrypted:	false
SSDEEP:	48:bsGMk3jjseCLuvkkKtY/K0iswT415VPv4CBzqjHB:AGMk3kehkkKtY/Fix4BvvQB
MD5:	24F296183D3CB208BBE982476AB93154
SHA1:	93F0BB240742A555FA5477E759D6429BE988D71A
SHA-256:	6255EEAED0A76F17867D6E2CD83D3DA25A027E5B1D7EF63E245F7B73B3CD6946
SHA-512:	2931F4870B41AA7815BECD11E1AEA44220DD7523A6BD6E9138142DC87AB765023BA11D00C8DBA97A1F0D367D458E20CD7583D399DCB5C6B55723DF9212A17664
Malicious:	false
Reputation:	low
Preview:	.# For documentation, see https://www.sumatrapdfreader.org/settings/settings3-5-1.html..Theme = Light..FixedPageUI [...TextColor = #000000...BackgroundColor = #ffffff...SelectionColor = #f5fc0c...WindowMargin = 2 4 2 4...PageSpacing = 4 4...InvertColors = false...HideScrollbars = false..]..ComicBookUI [...WindowMargin = 0 0 0 0...PageSpacing = 4 4...CbxMangaMode = false..]..ChmUI [...UseFixedPageUI = false..]....SelectionHandlers [..]..ExternalViewers [..]....ZoomLevels = 8.33 12.5 18 25 33.33 50 66.67 75 100 125 150 200 300 400 600 800 1000 1200 1600 2000 2400 3200 4800 6400..ZoomIncrement = 0....PrinterDefaults [...PrintScale = shrink..]..ForwardSearch [...HighlightOffset = 0...HighlightWidth = 15...HighlightColor = #6581ff...HighlightPermanent = false..]..Annotations [...HighlightColor = #ffff00...UnderlineColor = #00ff00...SquigglyColor = #ff00ff...StrikeOutColor = #ff0000...FreeTextColor = ...FreeTextSize = 12...FreeTextBorderWidth = 1...TextIconColor = ...TextIconType = ...Defa

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.0278259579196165
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SumatraPDF-3.5.2-64.exe
File size:	16'065'496 bytes
MD5:	c02dc2ca96fe9841963883c0fe177399
SHA1:	7e42e66e9198c258da48a6194577e3dbd424463a
SHA256:	290e4aa7ed64c728138711c011e89aab7aa48dbc1ae430371dc2be4100b92bf0
SHA512:	d7acf551d0764fcfb9a895701679981f76b2ff73f99bce5da2c6c3f2f0556ee33f45d0d98848fee96a6ccfa24e09c26303705c5f094e945e647f53f7e4716faf
SSDEEP:	393216:Y6OPZedL1pUAuPXiuZ08RBCxXJq3oeNy8x:KedJp9uPXiuZ08RBCxXJxWy8x
TLSH:	B0F69D96B2945AB4D142FA3CC91183AEF22DFC5C5B51838342DA7D746E733A81C29FB1
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........................................................................V...............................e............S..b....S.....

File Icon


Icon Hash:	07e1f996ba8aca55

Static PE Info

General

Entrypoint:	0x1405548c4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6538CEF7 [Wed Oct 25 08:16:55 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b60d142e4e08a961cef4281a2d95eda1

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/23/2021 8:00:00 PM 8/23/2024 7:59:59 PM
Subject Chain	CN=Krzysztof Kowalczyk, O=Krzysztof Kowalczyk, L=San Diego, S=California, C=US
Version:	3
Thumbprint MD5:	26EC7DA902C98B5E1B1E6F563968F3AE
Thumbprint SHA-1:	D362E5044F9E7DC7D84B1EA26BB53ADF6A79E84D
Thumbprint SHA-256:	B8FBBAFE0BA712899CA1B03DB143695DD1A1B673FB4FAB386CAB466B4EE3A8F0
Serial:	00C8A79ACFA20CA41509245C1F7F64FFC4

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9C70879C40h
dec eax
add esp, 28h
jmp 00007F9C7087941Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [008CC119h]
jne 00007F9C708795B2h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F9C708795A3h
ret
dec eax
ror ecx, 10h
jmp 00007F9C708798A3h
int3
int3
jmp 00007F9C7088CC98h
int3
int3
int3
jmp 00007F9C70879598h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
lea eax, dword ptr [0004A7DBh]
dec eax
mov ebx, ecx
dec eax
mov dword ptr [ecx], eax
test dl, 00000001h
je 00007F9C708795ACh
mov edx, 00000018h
call 00007F9C7087957Bh
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
sub esp, 28h
call 00007F9C7087A130h
test eax, eax
je 00007F9C708795C3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F9C708795A7h
dec eax
cmp ecx, eax
je 00007F9C708795B6h
xor eax, eax
dec eax
cmpxchg dword ptr [008EFB30h], ecx
jne 00007F9C70879590h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F9C70879599h
int3
int3
int3
inc eax
push ebx
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x812a98	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xed2000	0xe0258	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xeaf000	0x21e7c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf4d800	0x4bd8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfb3000	0x9170	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7f1f60	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x7f2000	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a9c60	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x59d000	0x1128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x81147c	0xe0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x59b1e4	0x59b200	503b41bd8b2c2ba39327e60a2b1797f1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x59d000	0x279290	0x279400	14ef811286d37dbb54bcc47206717044	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x817000	0x697278	0x62d600	de4ad32ce98fd7772fa90ca2d0ed8b5a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xeaf000	0x21e7c	0x22000	d2221f544567f88c907ea454206c35dd	False	0.5113381778492647	data	6.3091803857365685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xed1000	0x15c	0x200	089d101f3919aa13556907694bc92ddf	False	0.419921875	data	3.292991650879148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xed2000	0xe0258	0xe0400	5e5589d2ac272c4d073f658deb8ec97f	False	0.4159688109671126	data	6.65346150992118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfb3000	0x9170	0x9200	d29ee96fa252a54bb44b8f4291855f74	False	0.1701359160958904	data	5.460504125280082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xfb2108	0x134	data	English	United States	0.29545454545454547
RT_BITMAP	0xfb0768	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768	English	United States	0.7091584158415841
RT_ICON	0xf598c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.3829957356076759
RT_ICON	0xf5a768	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.4381768953068592
RT_ICON	0xf5b010	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.33598265895953755
RT_ICON	0xf5b578	0x3add	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9757780874643307
RT_ICON	0xf5f058	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.312551867219917
RT_ICON	0xf61600	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.3785178236397749
RT_ICON	0xf626a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5815602836879432
RT_ICON	0xf62b78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.6060767590618337
RT_ICON	0xf63a20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.7635379061371841
RT_ICON	0xf642c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.7695086705202312
RT_ICON	0xf64830	0xeec1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9984457060584742
RT_ICON	0xf736f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.42012448132780084
RT_ICON	0xf75ca0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.5684803001876173
RT_ICON	0xf76d48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7092198581560284
RT_ICON	0xf77218	0x42a9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9773220041019631
RT_ICON	0xf7b4c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 131072	English	United States	0.07738376907606767
RT_ICON	0xf8bcf0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 32768	English	United States	0.11118327822390174
RT_ICON	0xf8ff18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 18432	English	United States	0.12531120331950207
RT_ICON	0xf924c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	English	United States	0.15196998123827393
RT_ICON	0xf93568	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 2048	English	United States	0.2473404255319149
RT_ICON	0xf93a30	0x47ce	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9778043738439778
RT_ICON	0xf98200	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 131072	English	United States	0.08258902164911866
RT_ICON	0xfa8a28	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 32768	English	United States	0.11478507321681625
RT_ICON	0xfacc50	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 18432	English	United States	0.13101659751037345
RT_ICON	0xfaf1f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	English	United States	0.16064727954971858
RT_ICON	0xfb02a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 2048	English	United States	0.2526595744680851
RT_DIALOG	0xfb0a90	0x140	data	English	United States	0.55
RT_DIALOG	0xfb0e70	0x1c0	data	English	United States	0.515625
RT_DIALOG	0xfb0d68	0x102	data	English	United States	0.624031007751938
RT_DIALOG	0xfb1030	0xd0	dBase III DBT, next free block index 4294901761	English	United States	0.6586538461538461
RT_DIALOG	0xfb1100	0x4b4	data	English	United States	0.4418604651162791
RT_DIALOG	0xfb0bd0	0x198	data	English	United States	0.5563725490196079
RT_DIALOG	0xfb15b8	0x10c	data	English	United States	0.5970149253731343
RT_DIALOG	0xfb16c8	0x2ac	data	English	United States	0.4283625730994152
RT_DIALOG	0xfb1978	0x148	data	English	United States	0.5914634146341463
RT_RCDATA	0xed2bd0	0x86ceb	Unicode text, UTF-8 text	English	United States	0.41135626463541186
RT_GROUP_CURSOR	0xfb2240	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xf62b10	0x68	data	English	United States	0.7019230769230769
RT_GROUP_ICON	0xf771b0	0x68	data	English	United States	0.7211538461538461
RT_GROUP_ICON	0xf939d0	0x5a	data	English	United States	0.7777777777777778
RT_GROUP_ICON	0xfb0708	0x5a	data	English	United States	0.7777777777777778
RT_VERSION	0xed2960	0x26c	data	English	United States	0.5145161290322581
RT_MANIFEST	0xfb1ac0	0x643	XML 1.0 document, ASCII text	English	United States	0.42732376793512167

Imports

DLL	Import
COMCTL32.dll	ImageList_EndDrag, ImageList_Add, ImageList_DragEnter, ImageList_DragMove, ImageList_BeginDrag, ImageList_Create, ImageList_AddMasked, InitCommonControlsEx, ImageList_Destroy, CreatePropertySheetPageW, ImageList_GetIconSize, ImageList_Draw
KERNEL32.dll	SystemTimeToFileTime, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetLogicalDrives, CloseHandle, FindResourceW, GetModuleHandleW, MulDiv, VerSetConditionMask, VerifyVersionInfoW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, HeapCreate, HeapFree, GetCurrentProcess, TerminateProcess, GetEnvironmentVariableA, WaitForSingleObject, GetCurrentThreadId, GetLocaleInfoA, CreateToolhelp32Snapshot, QueryPerformanceFrequency, Sleep, IsDebuggerPresent, DebugBreak, CreateMutexW, ReleaseMutex, DecodePointer, LoadLibraryExA, WriteConsoleW, GetStringTypeW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExW, GetTimeZoneInformation, HeapSize, GetProcessHeap, SetStdHandle, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetConsoleOutputCP, ReadConsoleW, SetEnvironmentVariableW, GetModuleHandleExW, FreeLibraryAndExitThread, SetFilePointerEx, LCMapStringEx, TlsFree, InitializeCriticalSectionAndSpinCount, EncodePointer, RtlUnwind, RtlPcToFileHeader, RtlUnwindEx, InitializeCriticalSectionEx, GetStartupInfoW, InitializeSListHead, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, IsProcessorFeaturePresent, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, CreateSemaphoreW, GetProcessAffinityMask, ReleaseSemaphore, GetConsoleMode, MoveFileW, FlushFileBuffers, GetFileType, SetEndOfFile, CreateHardLinkW, RemoveDirectoryW, DeviceIoControl, SetThreadPriority, SetLastError, SetConsoleCtrlHandler, GetCurrentDirectoryW, FoldStringW, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, TzSpecificLocalTimeToSystemTime, IsDBCSLeadByte, GetCPInfo, CompareStringW, AreFileApisANSI, LocalFileTimeToFileTime, RaiseException, FileTimeToDosDateTime, FileTimeToLocalFileTime, SetThreadContext, FlushInstructionCache, VirtualAlloc, VirtualFree, VirtualProtect, GetSystemDirectoryW, OpenThread, VirtualQuery, GetThreadContext, GetModuleHandleA, ResumeThread, SuspendThread, Thread32First, Thread32Next, AllocConsole, FormatMessageA, CreateProcessW, InitializeSRWLock, InitializeConditionVariable, GetThreadGroupAffinity, InitOnceBeginInitialize, InitOnceComplete, WakeConditionVariable, GetEnvironmentVariableW, FreeLibrary, LoadLibraryW, OutputDebugStringW, LoadLibraryExW, GetProcAddress, GetModuleFileNameW, GetFileAttributesW, OutputDebugStringA, GetTempPathW, GetUserDefaultUILanguage, MapViewOfFile, CreateFileMappingW, UnmapViewOfFile, SetErrorMode, GetDateFormatW, GetTimeFormatW, MoveFileExW, LoadResource, LockResource, SizeofResource, SetThreadExecutionState, GlobalAddAtomW, GlobalDeleteAtom, GetTickCount, GetSystemTime, GlobalUnlock, GlobalLock, GlobalFree, GlobalAlloc, GetCurrentThread, Process32FirstW, Process32NextW, OpenProcess, ExitProcess, GetCommandLineW, GetLastError, SetUnhandledExceptionFilter, Module32NextW, PeekNamedPipe, LocalFree, SetCurrentDirectoryW, LoadLibraryA, AttachConsole, GetVersionExW, GetStdHandle, SetConsoleScreenBufferSize, GetCurrentProcessId, HeapDestroy, AddVectoredExceptionHandler, GlobalMemoryStatusEx, Module32FirstW, HeapAlloc, CreateThread, GetSystemInfo, HeapReAlloc, SetEvent, GetConsoleScreenBufferInfo, ReadDirectoryChangesW, QueueUserAPC, ResetEvent, ExitThread, WaitForMultipleObjectsEx, CompareFileTime, CancelIo, GetFileTime, GetDriveTypeW, GetTempFileNameW, CopyFileW, DeleteFileW, GetFileAttributesExW, GetFileInformationByHandle, SetFileAttributesW, GetVolumePathNameW, SetFileTime, GetDriveTypeA, GetPrivateProfileIntW, CreateEventW, GetShortPathNameW, GetLongPathNameW, WritePrivateProfileStringW, GetFileSizeEx, GetACP, MultiByteToWideChar, GetExitCodeProcess, ReadFile, SetFilePointer, TlsSetValue, TlsAlloc, TlsGetValue, CreateEventA, GetModuleFileNameA, GetFullPathNameA, FindClose, FindFirstFileW, GetFullPathNameW, FindNextFileW, lstrcpynW, GetWindowsDirectoryW, WideCharToMultiByte, GetLocaleInfoW, SetNamedPipeHandleState, WriteFile, CreateFileW, CreateDirectoryW
USER32.dll	SystemParametersInfoW, GetMessagePos, WindowFromDC, IsWindowEnabled, GetUpdateRect, SetRectEmpty, GetClassInfoExW, RegisterWindowMessageW, GetCursorPos, ClientToScreen, SetLayeredWindowAttributes, DeferWindowPos, GetPropW, RemovePropW, BeginDeferWindowPos, SetPropW, EndDeferWindowPos, HideCaret, SetClassLongPtrW, ShowCaret, IsCharAlphaNumericW, WindowFromPoint, GetWindowThreadProcessId, GetMessageW, AllowSetForegroundWindow, LoadBitmapW, TranslateAcceleratorW, LoadCursorW, GetClassNameW, SetParent, MapVirtualKeyW, ScreenToClient, IsWindow, CharLowerBuffW, GetAncestor, IsCharUpperW, CheckRadioButton, EndDialog, SetDlgItemTextW, SendDlgItemMessageW, DialogBoxIndirectParamW, IsDlgButtonChecked, BringWindowToTop, SetWindowLongW, CheckDlgButton, DialogBoxParamW, MoveWindow, OpenClipboard, CloseClipboard, EmptyClipboard, ReuseDDElParam, ShowWindowAsync, IsWindowUnicode, UnpackDDElParam, ModifyMenuW, CheckMenuRadioItem, GetMenuItemID, GetMenu, SetMenuItemInfoW, SetMenu, DrawTextExW, InsertMenuW, GetWindowLongW, GetWindow, FindWindowExW, GetFocus, IsChild, MessageBeep, GetDesktopWindow, UpdateWindow, MessageBoxW, MsgWaitForMultipleObjects, DispatchMessageW, SendMessageW, PeekMessageW, TranslateMessage, GetDlgItem, PostQuitMessage, PostMessageW, EnableWindow, MessageBoxA, CreateMenu, LoadIconW, SetActiveWindow, DestroyWindow, GetMenuItemInfoW, GetSystemMenu, CallWindowProcW, GetWindowRect, IsWindowVisible, SetWindowPos, GetMenuItemCount, SetWindowLongPtrW, CreateWindowExW, CreatePopupMenu, GetWindowLongPtrW, RegisterClassExW, GetClassLongPtrW, SendInput, DdeFreeStringHandle, DdeDisconnect, DrawTextW, CheckMenuItem, SetClipboardData, DdeFreeDataHandle, DdeClientTransaction, DdeUninitialize, DdeInitializeW, TrackMouseEvent, GetMonitorInfoW, GetWindowInfo, DdeConnect, DdeCreateStringHandleW, DestroyCursor, EnumDisplayMonitors, MonitorFromWindow, MonitorFromRect, CopyImage, GetKeyState, AdjustWindowRectEx, OemToCharA, CharToOemA, OemToCharBuffA, CharLowerW, CharUpperW, CharToOemBuffW, TrackPopupMenu, ShowWindow, InvalidateRgn, OffsetRect, RedrawWindow, MapWindowPoints, SetMenuDefaultItem, GetSysColor, GetForegroundWindow, DestroyAcceleratorTable, DestroyMenu, FindWindowW, GetWindowDC, TrackPopupMenuEx, RemoveMenu, GetClientRect, IsZoomed, AppendMenuW, DrawIconEx, EnableMenuItem, DrawEdge, GetParent, DrawFrameControl, InvalidateRect, SetScrollInfo, DefWindowProcW, ShowScrollBar, GetDC, FillRect, GetCursor, GetScrollInfo, GetScrollPos, GetCapture, SetTimer, SetFocus, SetCapture, SetCursor, KillTimer, ReleaseCapture, IsIconic, ReleaseDC, GetSystemMetrics, BeginPaint, SetForegroundWindow, EndPaint, CreateAcceleratorTableW, IsDialogMessageW
GDI32.dll	SetROP2, GetObjectA, GetTextExtentPoint32W, ExtTextOutW, GetObjectW, CreateDIBSection, GetTextExtentPoint32A, SetLayout, CreateRoundRectRgn, SelectClipRgn, RoundRect, BitBlt, StartPage, AbortDoc, EndDoc, CreateDCW, GetDeviceCaps, SetMapMode, StartDocW, EndPage, Polyline, LineTo, MoveToEx, SetBkColor, Ellipse, CreateFontIndirectW, CreatePatternBrush, CreateBitmap, SetBkMode, GetClipBox, CreateRectRgn, SetViewportOrgEx, ExcludeClipRect, ExtSelectClipRgn, SetBrushOrgEx, SelectObject, CreateCompatibleDC, PatBlt, StretchBlt, GetStockObject, DeleteDC, SetTextColor, CreatePen, Rectangle, DeleteObject, CreateSolidBrush, GetDIBColorTable, SetWorldTransform, SetStretchBltMode, SetDIBits, TextOutW, GetDIBits, SetGraphicsMode, SetDIBColorTable, CreateCompatibleBitmap
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, GetPrinterW, EnumPrintersW, DeviceCapabilitiesW, ClosePrinter
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW, PrintDlgExW
ADVAPI32.dll	CryptDestroyHash, RegQueryInfoKeyW, RegCloseKey, RegQueryValueExW, RegGetValueW, RegEnumKeyW, InitializeSecurityDescriptor, CheckTokenMembership, FreeSid, OpenProcessToken, RegSetKeySecurity, SetFileSecurityW, LookupPrivilegeValueW, AdjustTokenPrivileges, CryptAcquireContextW, CryptCreateHash, CryptHashData, RegOpenKeyExW, CryptGetHashParam, CryptReleaseContext, SetSecurityDescriptorDacl, AllocateAndInitializeSid
SHELL32.dll	SHGetDesktopFolder, ShellExecuteExW, DragAcceptFiles, SHChangeNotify, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHGetMalloc, DragFinish, DragQueryFileW, SHBindToParent, SHAddToRecentDocs, SHGetFolderPathW, SHFileOperationW, CommandLineToArgvW
ole32.dll	CoSetProxyBlanket, CreateStreamOnHGlobal, CoInitialize, CoCreateInstance, OleUninitialize, OleInitialize, CoTaskMemAlloc, CoTaskMemFree, CoGetMalloc, ReleaseStgMedium, CoUninitialize
OLEAUT32.dll	VariantInit, VariantClear, SysFreeString, SysAllocString, SafeArrayPutElement, SafeArrayCreateVector

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 16:29:50.589545012 CEST	8.8.8.8	192.168.2.22	0xdd47	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:29:50.589545012 CEST	8.8.8.8	192.168.2.22	0xdd47	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:29:50.598968029 CEST	8.8.8.8	192.168.2.22	0x9680	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:29:50.598968029 CEST	8.8.8.8	192.168.2.22	0x9680	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: SumatraPDF-3.5.2-64.exePID: 2544, Parent PID: 1244

General

Target ID:	0
Start time:	10:29:33
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SumatraPDF-3.5.2-64.exe"
Imagebase:	0x13fbe0000
File size:	16'065'496 bytes
MD5 hash:	C02DC2CA96FE9841963883C0FE177399
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SumatraPDF-3.5.2-64.exePID: 2544, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	344
Total number of Limit Nodes:	6

Executed Functions

Function 000000014015B2F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000000014015B46C
GetProcAddress.KERNEL32 ref: 000000014015B478

Strings

api-ms-, xrefs: 000000014015B3B6
ext-ms-, xrefs: 000000014015B3C9

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: e4fe48c854c3e632869e80c64ec8db9cc9bffe49cd316b8c20fb2922860ce4b0
Instruction ID: e3218a152bfe04c22a0af94630b868af027dd858a7bb6cee305732e82f1e1fa2
Opcode Fuzzy Hash: e4fe48c854c3e632869e80c64ec8db9cc9bffe49cd316b8c20fb2922860ce4b0
Instruction Fuzzy Hash: BB41F372312A4482EB67CB17A880BD523A1F74DFD0F4C452A9E1E6B7A5EE39C545C300

Function 000000014015BB14 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32 ref: 000000014015BBE5

Strings

LCMapStringEx, xrefs: 000000014015BB30, 000000014015BB41

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 625c65ffab90239088a480d68690d8096d19c9efb5ff1c2381dc515d1cd8623e
Instruction ID: 0c5f4f08a0ae18792b0d135b99ffe82b0cddcd8699ed273463abf2e4269eecfa
Opcode Fuzzy Hash: 625c65ffab90239088a480d68690d8096d19c9efb5ff1c2381dc515d1cd8623e
Instruction Fuzzy Hash: E1211536208B8486DB658B16F88078AB7A5F78DBC4F484126EF8D83B29DE38C540CB40

Function 000000014014A428 Relevance: 2.5, APIs: 2, Instructions: 18
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32 ref: 000000014014A43E
GetLastError.KERNEL32 ref: 000000014014A448

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 958567044e3adab993be22d6434b9c4d9d2f1fc4369be7e5e4818822e37ff867
Instruction ID: 28674671389976eb2f4a5d91eb66883d8e86851b75e5565fd696bae9f1c170a7
Opcode Fuzzy Hash: 958567044e3adab993be22d6434b9c4d9d2f1fc4369be7e5e4818822e37ff867
Instruction Fuzzy Hash: 74E01271B1164482FF1A67F398593E911916B9CF44F4944358B09536B6ED38C9554601

Function 000000014014A3B0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,000000014015B0B6,?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014014A405

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 124df37cf2e7ea381b88c17281b8b67a5854621d9b2628d22826c8ac1dbdc82a
Instruction ID: aebca8f54d11be06d4be81388b3ad4fa9431ec5a76da1b69390e57ddb537a2d9
Opcode Fuzzy Hash: 124df37cf2e7ea381b88c17281b8b67a5854621d9b2628d22826c8ac1dbdc82a
Instruction Fuzzy Hash: EDF0B43431230481FE57AB6399193E912946B5CF40F8E48324F0A8B7F2EE7CC8808221

Non-executed Functions

Function 0000000140134F68 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000000140134F94
GetCurrentThreadId.KERNEL32 ref: 0000000140134FA2
GetCurrentProcessId.KERNEL32 ref: 0000000140134FAE
QueryPerformanceCounter.KERNEL32 ref: 0000000140134FBE

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 3be227cb8252aac31629724096c608187ebffdc99491d3ac1e2d2a14734ec97e
Instruction ID: 462e5b193dfe814c50b3f4728cea5c78e451836a499c0f4844e6a04239cc6b88
Opcode Fuzzy Hash: 3be227cb8252aac31629724096c608187ebffdc99491d3ac1e2d2a14734ec97e
Instruction Fuzzy Hash: B511D676710B088AEB01CF61E8557E833B4F75DB58F441E25EB6D87BA4DB78D1948340

Function 0000000140134BD8 Relevance: 4.5, APIs: 3, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140134BE3
UnhandledExceptionFilter.KERNEL32 ref: 0000000140134BEC
GetCurrentProcess.KERNEL32(?,?,00000000,0000000140134CD9,?,?,?,?,?,?,000000013FBE1096), ref: 0000000140134BF2

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CurrentProcess
String ID:
API String ID: 1249254920-0
Opcode ID: 6bef131a2eac4467d255269b65b5e6b0247de1cdc79986c0592ece5c9143e238
Instruction ID: 3527a1b3730c3c9fb4dd558087daede72df6eb68bf440c3774a43e74b52647bc
Opcode Fuzzy Hash: 6bef131a2eac4467d255269b65b5e6b0247de1cdc79986c0592ece5c9143e238
Instruction Fuzzy Hash: 63D092B1B11A088AEB1A6B63A8153A92270A79CF45F0410269B0657334AE3CC5868302

Function 000000013FBE1760 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 241
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013FBE1C99: RegOpenKeyExW.ADVAPI32 ref: 000000013FBE1D13

Part of subcall function 000000013FBE1C99: RegQueryValueExW.ADVAPI32 ref: 000000013FBE1D61
Part of subcall function 000000013FBE1C99: RegCloseKey.ADVAPI32 ref: 000000013FBE1D6E

GetModuleHandleW.KERNEL32 ref: 000000013FBE1AC8
GetProcAddress.KERNEL32 ref: 000000013FBE1AD8

Strings

Microsoft.WebView2Runtime.Stable_8wekyb3d8bbwe, xrefs: 000000013FBE17D5
Microsoft.WebView2Runtime.Canary_8wekyb3d8bbwe, xrefs: 000000013FBE17FC
kernelbase.dll, xrefs: 000000013FBE1AC1
dev, xrefs: 000000013FBE1B1B
canary, xrefs: 000000013FBE1B2A
Microsoft.WebView2Runtime.Beta_8wekyb3d8bbwe, xrefs: 000000013FBE17E1
beta, xrefs: 000000013FBE1B0F
internal, xrefs: 000000013FBE1B39
Microsoft.WebView2Runtime.Internal_8wekyb3d8bbwe, xrefs: 000000013FBE180B
GetCurrentPackageInfo, xrefs: 000000013FBE1AD1
Microsoft.WebView2Runtime.Dev_8wekyb3d8bbwe, xrefs: 000000013FBE17ED

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProcQueryValue
String ID: GetCurrentPackageInfo$Microsoft.WebView2Runtime.Beta_8wekyb3d8bbwe$Microsoft.WebView2Runtime.Canary_8wekyb3d8bbwe$Microsoft.WebView2Runtime.Dev_8wekyb3d8bbwe$Microsoft.WebView2Runtime.Internal_8wekyb3d8bbwe$Microsoft.WebView2Runtime.Stable_8wekyb3d8bbwe$beta$canary$dev$internal$kernelbase.dll
API String ID: 696543570-4251609998
Opcode ID: 44a0b3c7aa43c496d420b8976d1d367078d38f49d7ce270ae9f75b82d73d0cf3
Instruction ID: 59cd487e75a01621bd1f47d11427cee20b2b5ea8f55f84fdf7c1257d0a15154d
Opcode Fuzzy Hash: 44a0b3c7aa43c496d420b8976d1d367078d38f49d7ce270ae9f75b82d73d0cf3
Instruction Fuzzy Hash: 2FB174B1604B4085FA11AF16F4507EAF3E0FBA9B84F605129EE8D177A9DF38C646CB40

Function 000000014015AEDC Relevance: 18.1, APIs: 12, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AEEB
FlsGetValue.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF00
FlsSetValue.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF21
FlsSetValue.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF4E
FlsSetValue.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF5F
FlsSetValue.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF70
SetLastError.KERNEL32(?,?,?,000000014013E06B,?,?,?,000000014014B707,?,?,?,?,?,?,?,?), ref: 000000014015AF8B
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000000014013E06B,?,?,?,000000014014B707), ref: 000000014015AFC1
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000000014013E06B,?,?,?,000000014014B707), ref: 000000014015AFE0

Part of subcall function 000000014014A3B0: RtlAllocateHeap.NTDLL(?,?,00000000,000000014015B0B6,?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014014A405

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000000014013E06B,?,?,?,000000014014B707), ref: 000000014015B008

Part of subcall function 000000014014A428: HeapFree.KERNEL32 ref: 000000014014A43E
Part of subcall function 000000014014A428: GetLastError.KERNEL32 ref: 000000014014A448

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000000014013E06B,?,?,?,000000014014B707), ref: 000000014015B019
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000000014013E06B,?,?,?,000000014014B707), ref: 000000014015B02A

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocateFree
String ID:
API String ID: 3174826731-0
Opcode ID: c7bb338fa4416adcaf18ccf7d183bce47325322700dc6a4e6a200ed1c2833003
Instruction ID: 4d950a656023f8783416dde0cd2b7a0e3fa309455053de7c227173da92578a3c
Opcode Fuzzy Hash: c7bb338fa4416adcaf18ccf7d183bce47325322700dc6a4e6a200ed1c2833003
Instruction Fuzzy Hash: C9411E7024220482FA6BA7339495BED22525B8CFB4F6D4726AB360F7F6EE3ED4415600

Function 000000013FBE20F4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 100
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,-5555555555555556,?,BrowserExecutableFolder,000000013FBE257F), ref: 000000013FBE21C9
CoTaskMemFree.OLE32 ref: 000000013FBE21E2
GetModuleHandleW.KERNEL32(?,?,-5555555555555556,?,BrowserExecutableFolder,000000013FBE257F), ref: 000000013FBE2242
GetProcAddress.KERNEL32(?,?,-5555555555555556,?,BrowserExecutableFolder,000000013FBE257F), ref: 000000013FBE2252

Part of subcall function 0000000140134EE0: AcquireSRWLockExclusive.KERNEL32(?,?,?,000000013FBE150D,?,?,?,000000013FBE1363), ref: 0000000140134EF0

Strings

Kernel32.dll, xrefs: 000000013FBE223B
GetCurrentApplicationUserModelId, xrefs: 000000013FBE2248
BrowserExecutableFolder, xrefs: 000000013FBE20F4

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: AcquireAddressErrorExclusiveFreeHandleLastLockModuleProcTask
String ID: BrowserExecutableFolder$GetCurrentApplicationUserModelId$Kernel32.dll
API String ID: 2548195841-1124854693
Opcode ID: 97e529c8c7a084d808807536ffa0f9df3f802a3654eb60b41538ac46ee475aaa
Instruction ID: e86fd0a8c047e6bbde5ab7a1a5445ca7821d92d928c09b13e9f25d64bf4b7651
Opcode Fuzzy Hash: 97e529c8c7a084d808807536ffa0f9df3f802a3654eb60b41538ac46ee475aaa
Instruction Fuzzy Hash: 78417275A04A1082FA11EF26F8513E973A1B79CB94F610239DA8E873B5DF38D647CB01

Function 000000013FBE1336 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000000013FBE145B
GetLastError.KERNEL32 ref: 000000013FBE1485

Strings

GetFileVersionInfoW, xrefs: 000000013FBE1366
VerQueryValueW, xrefs: 000000013FBE1375
\StringFileInfo\040904B0\ProductVersion, xrefs: 000000013FBE142F
GetFileVersionInfoSizeW, xrefs: 000000013FBE1357

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: ErrorLast
String ID: GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$\StringFileInfo\040904B0\ProductVersion
API String ID: 1452528299-1241276684
Opcode ID: 273c81d367476b8ae125a796f6d1839897c3644086a3a7fb4bb9f3339633d617
Instruction ID: fc77732bd0e1ba7ad9c79f3fa201bc66f175d02c6d792e31dddbb422d9e634cb
Opcode Fuzzy Hash: 273c81d367476b8ae125a796f6d1839897c3644086a3a7fb4bb9f3339633d617
Instruction Fuzzy Hash: CC41A4B1B1164845FA51EF66F8507EAF3E0BB98F80F944135AE4D47399EE38C6068B50

Function 000000014015B054 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B063
FlsSetValue.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B099
FlsSetValue.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B0C6
FlsSetValue.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B0D7
FlsSetValue.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B0E8
SetLastError.KERNEL32(?,?,?,0000000140146ECD,?,?,?,?,000000014014A45C), ref: 000000014015B103

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1009f67ed1f647b14a07bb2a06233d5132de5db0981acd1529376a8eb2f992fd
Instruction ID: 9021c006fe6ec66ac95a20c185ad04b38e83159ea671e0df3dead30078be9947
Opcode Fuzzy Hash: 1009f67ed1f647b14a07bb2a06233d5132de5db0981acd1529376a8eb2f992fd
Instruction Fuzzy Hash: 5D113D3030574482FA56A7339595BEE62626B8CFB4F694725AB360B7F6DE7AC4418200

Function 000000014015B11C Relevance: 7.6, APIs: 5, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,00000000,0000000140140C8E,?,?,00000000,0000000140147F3A), ref: 000000014015B13B
FlsSetValue.KERNEL32(?,?,00000000,0000000140140C8E,?,?,00000000,0000000140147F3A), ref: 000000014015B15A
FlsSetValue.KERNEL32(?,?,00000000,0000000140140C8E,?,?,00000000,0000000140147F3A), ref: 000000014015B182
FlsSetValue.KERNEL32(?,?,00000000,0000000140140C8E,?,?,00000000,0000000140147F3A), ref: 000000014015B193
FlsSetValue.KERNEL32(?,?,00000000,0000000140140C8E,?,?,00000000,0000000140147F3A), ref: 000000014015B1A4

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6e7596943cfbddd2575954eefe92a7c8866b816aae988e0558cebd1a57637dfe
Instruction ID: b279dce3733ada6db9005d4320be4bc5b88fe7cee98dec10494295338fa4e2cf
Opcode Fuzzy Hash: 6e7596943cfbddd2575954eefe92a7c8866b816aae988e0558cebd1a57637dfe
Instruction Fuzzy Hash: 27115E30301640C1FA9A9733A9E1FE921816B8CBF4F6D4725A7390A7F6DE3DC4018200

Function 000000013FBE1C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FBE1D13
RegQueryValueExW.ADVAPI32 ref: 000000013FBE1D61
RegCloseKey.ADVAPI32 ref: 000000013FBE1D6E

Strings

EBWebView, xrefs: 000000013FBE1D52

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: EBWebView
API String ID: 3677997916-998646055
Opcode ID: 08ee8a18caff5c7196689b66e41163826835503071b819ee472052c0426b47d6
Instruction ID: 4ebad875447f9df2396194092bdff2e4b3b7b5ec495c6edb9ce41fc79f73881d
Opcode Fuzzy Hash: 08ee8a18caff5c7196689b66e41163826835503071b819ee472052c0426b47d6
Instruction Fuzzy Hash: 8B31F67171464445FB60CF66F8947EAE3E0BB98BC4F509125AE8D07B9DDE7CC2068B00

Function 000000013FBE1DF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringW.KERNEL32 ref: 000000013FBE1E34
OutputDebugStringW.KERNEL32 ref: 000000013FBE1E41
OutputDebugStringW.KERNEL32 ref: 000000013FBE1E4A

Strings

Loader skipped an incompatible version: , xrefs: 000000013FBE1E26

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: DebugOutputString
String ID: Loader skipped an incompatible version:
API String ID: 1166629820-2341185882
Opcode ID: 223367485c23500674fb8c623ed909e3335d27437528c39103a3bb11da8d8459
Instruction ID: 7715f20d8b625f0d621e37b7ad4b1813238d2d4ca36acca8b23728b5a8713da8
Opcode Fuzzy Hash: 223367485c23500674fb8c623ed909e3335d27437528c39103a3bb11da8d8459
Instruction Fuzzy Hash: C5F03A72B4155882EE46AB16FD903E9A6A1A79CBE4F901436CE4E473A4D938CA838740

Function 000000013FBE10EB Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000013FBE1123
GetLastError.KERNEL32 ref: 000000013FBE113A
GetModuleFileNameW.KERNEL32 ref: 000000013FBE116E
GetLastError.KERNEL32 ref: 000000013FBE1198

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID:
API String ID: 2776309574-0
Opcode ID: 41af299ffbbf544cb70119ac2e81e24a7ee66545db3173fe62df78aa00bd12cd
Instruction ID: a07a33e73c29224622622c1901c9740cb328bd7d9bcce60e58e68786e15d8e8d
Opcode Fuzzy Hash: 41af299ffbbf544cb70119ac2e81e24a7ee66545db3173fe62df78aa00bd12cd
Instruction Fuzzy Hash: D7119E70B0511403FA59BA63AD557EE81915B9AFD0F10443CDD4F8BB9ADD3C8A434302

Function 000000013FBE24B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 000000013FBE24EF
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,000000013FBE2447), ref: 000000013FBE24FA

Strings

Software\Policies\Microsoft\Edge\WebView2\, xrefs: 000000013FBE24DF

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Policies\Microsoft\Edge\WebView2\
API String ID: 47109696-3769946317
Opcode ID: f7e0db95aff5fa1ada4a42d155400f24f5c14a6b3d594dd8475134c150a4dd8a
Instruction ID: b232935707b19236c633ac82705bfc700c91f19b1813507d53bb1905de9786ba
Opcode Fuzzy Hash: f7e0db95aff5fa1ada4a42d155400f24f5c14a6b3d594dd8475134c150a4dd8a
Instruction Fuzzy Hash: 73F05E32710B5481F7519B26F951BCA37A0B78CBD4F416111AE8E5B724DE38C45AC740

Function 000000013FBE22A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013FBE228E,?,?,-5555555555555556,?,BrowserExecutableFolder,000000013FBE257F), ref: 000000013FBE22B9

Strings

GetCurrentProcessExplicitAppUserModelID, xrefs: 000000013FBE22C4
shell32.dll, xrefs: 000000013FBE22AA

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: LibraryLoad
String ID: GetCurrentProcessExplicitAppUserModelID$shell32.dll
API String ID: 1029625771-718263829
Opcode ID: ded2ab6559a7689ffd8d6c7926921170430721c5ca290f021354a87eb1309cc3
Instruction ID: 90e8d3e585d9ccbb02cea2dafb41034bec2cb0236a8444f3eafeb70020e9a165
Opcode Fuzzy Hash: ded2ab6559a7689ffd8d6c7926921170430721c5ca290f021354a87eb1309cc3
Instruction Fuzzy Hash: 5DD09E70B52940C1EB099B539C8239067E1BB5DB51FD48425CA0E47374EE3CC29E8B11

Function 000000013FBE1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,000000013FBE151B,?,?,?,000000013FBE1363), ref: 000000013FBE1C6F

Strings

api-ms-win-core-version-l1-1-0.dll, xrefs: 000000013FBE1C60
version.dll, xrefs: 000000013FBE1C7F

Memory Dump Source

Source File: 00000000.00000002.652993532.000000013FBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000000013FBE0000, based on PE: true

Associated: 00000000.00000002.652987533.000000013FBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140301000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.0000000140303000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653068962.000000014030E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653120247.00000001403F7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653200107.0000000140A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653204252.0000000140A02000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653207670.0000000140A05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653211435.0000000140A06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653216229.0000000140A16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653219881.0000000140A19000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653224050.0000000140A1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653227389.0000000140A20000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A29000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653231119.0000000140A35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.653248506.0000000140A8F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13fbe0000_SumatraPDF-3.jbxd

Similarity

API ID: LibraryLoad
String ID: api-ms-win-core-version-l1-1-0.dll$version.dll
API String ID: 1029625771-4294597371
Opcode ID: eb9b05c3bf581bcc3e30dd31f3ef14d7a98471735cb393745bdbbfcd30adc73c
Instruction ID: abbd21840f72bc6f06bd159784bdc142ae6a4bafa821b97447f232ac5a4a3a38
Opcode Fuzzy Hash: eb9b05c3bf581bcc3e30dd31f3ef14d7a98471735cb393745bdbbfcd30adc73c
Instruction Fuzzy Hash: E0D01771F1284080FB8D8B13AC82380A2E1BBADB01F848019820D862B0EE38C24A8B40

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SumatraPDF-3.5.2-64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\SumatraPDF-settings.txt

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SumatraPDF-3.5.2-64.exePID: 2544, Parent PID: 1244

General

Chronological Activities

Disassembly

Analysis Process: SumatraPDF-3.5.2-64.exePID: 2544, Parent PID: 1244COMMON

Execution Graph

Windows Analysis Report
SumatraPDF-3.5.2-64.exe

Function 000000014015B2F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Function 000000014015BB14 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Function 000000014014A428 Relevance: 2.5, APIs: 2, Instructions: 18
memoryCOMMONLIBRARYCODE

Function 000000014014A3B0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 000000013FBE1760 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 241
libraryloaderCOMMON

Function 000000014015AEDC Relevance: 18.1, APIs: 12, Instructions: 112
COMMON

Function 000000013FBE20F4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 100
libraryloaderCOMMON

Function 000000013FBE1336 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 104
COMMON

Function 000000014015B054 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Function 000000014015B11C Relevance: 7.6, APIs: 5, Instructions: 54
COMMON

Function 000000013FBE1C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91
registryCOMMON

Function 000000013FBE1DF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
COMMON