Windows Analysis Report
mirrorto_setup.exe

Overview

General Information

Sample name: mirrorto_setup.exe
Analysis ID: 1467121
MD5: d75d8acc3266e89d6c66fe0e0df367f4
SHA1: c0992c765155d911407745ed8304361b829ea2df
SHA256: 6aeca8fb7a286e161a6cb63e73de78775d2bf6d031b3d1db883bf73f6c1e54b0
Infos:

Detection

Score: 6
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003FEC60 CreateFileW,CryptAcquireContextW,CryptCreateHash,ReadFile,ReadFile,CryptHashData,ReadFile,CryptGetHashParam,_Smanip,CryptDestroyHash,CryptReleaseContext,CloseHandle,std::ios_base::_Ios_base_dtor,CryptDestroyHash,CryptReleaseContext,CloseHandle, 0_2_003FEC60
Uses 32bit PE files
Source: mirrorto_setup.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: mirrorto_setup.exe Static PE information: certificate valid
Source: mirrorto_setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Jenkins\workspace\MF_Downloader\output\Release\MFDownloader.pdb# source: mirrorto_setup.exe
Source: Binary string: D:\Jenkins\workspace\MF_Downloader\output\Release\MFDownloader.pdb source: mirrorto_setup.exe
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003E5070 InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetOpenW,__CxxThrowException@8,InternetConnectA,__CxxThrowException@8,HttpOpenRequestA,__CxxThrowException@8,HttpAddRequestHeadersA,HttpSendRequestA,__CxxThrowException@8,__CxxThrowException@8,_memset,InternetReadFile,InternetReadFile,__CxxThrowException@8,GetLastError, 0_2_003E5070
Source: mirrorto_setup.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mirrorto_setup.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: mirrorto_setup.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mirrorto_setup.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mirrorto_setup.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mirrorto_setup.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: mirrorto_setup.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mirrorto_setup.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mirrorto_setup.exe String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: mirrorto_setup.exe String found in binary or memory: http://ocsp.digicert.com0
Source: mirrorto_setup.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: mirrorto_setup.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: mirrorto_setup.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: mirrorto_setup.exe, 00000000.00000003.2055912540.00000000012C9000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055946392.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055946392.00000000012B8000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2056347486.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2056450567.00000000012BC000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2056114628.00000000012BB000.00000004.00000020.00020000.00000000.sdmp, home.xml, home_rtl.xml String found in binary or memory: http://www.baidu.com
Source: mirrorto_setup.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: mirrorto_setup.exe String found in binary or memory: http://www.openssl.org/support/faq.html
Source: mirrorto_setup.exe String found in binary or memory: https://apipdm.imyfone.club/downloader/carousel?
Source: mirrorto_setup.exe String found in binary or memory: https://apipdm.imyfone.club/downloader/carousel?pid=STR_PID&lang=STR_DIR1_NAMESTR_DIR2_NAMESTR_EXE_N
Source: mirrorto_setup.exe, 00000000.00000003.2054358014.0000000001298000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/productu
Source: mirrorto_setup.exe, 00000000.00000003.2053609311.0000000001296000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key
Source: UrlInfo.ini5.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Chinese
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini6.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=ChineseTW
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Chineseu3
Source: mirrorto_setup.exe, 00000000.00000003.2052077952.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini7.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Dutch
Source: mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Dutchb3?
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052323899.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055595981.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, UrlInfo.ini8.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=English
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=English;/c
Source: mirrorto_setup.exe, 00000000.00000003.2052483855.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=French
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052619697.0000000001295000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini0.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=German
Source: mirrorto_setup.exe, 00000000.00000003.2052767009.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini1.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Indonesian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052996980.0000000001296000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini2.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Italian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2053404413.0000000001296000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini3.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Japanese
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2053575057.0000000001297000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini9.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Korean
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2053907085.0000000001297000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini10.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Malaysian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2054121921.0000000001298000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini11.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Polish
Source: UrlInfo.ini12.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Portuguese
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Portuguese43
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2054910219.0000000001299000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini13.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Russian
Source: mirrorto_setup.exe, 00000000.00000003.2055061787.000000000129A000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini14.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Spanish
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Spanishzv
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055235176.000000000129A000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini15.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Swedish
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055397073.000000000129B000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini16.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=Thai
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini4.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=installed&pid=370&lang=arabic
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini5.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Chinese
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini6.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=ChineseTW
Source: mirrorto_setup.exe, 00000000.00000003.2052077952.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini7.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Dutch
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052323899.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055595981.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, UrlInfo.ini8.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=English
Source: mirrorto_setup.exe, 00000000.00000003.2052483855.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=French
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052619697.0000000001295000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini0.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=German
Source: mirrorto_setup.exe, 00000000.00000003.2052767009.0000000001295000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini1.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Indonesian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052996980.0000000001296000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini2.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Italian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2053404413.0000000001296000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini3.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Japanese
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini9.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Korean
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2053907085.0000000001297000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini10.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Malaysian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2054121921.0000000001298000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini11.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Polish
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2054358014.0000000001298000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini12.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Portuguese
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2054910219.0000000001299000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini13.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Russian
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055061787.000000000129A000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini14.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Spanish
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055235176.000000000129A000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini15.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Swedish
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2055397073.000000000129B000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini16.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=Thai
Source: mirrorto_setup.exe, 00000000.00000003.2051727460.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052269461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052437466.0000000001281000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052160938.0000000001282000.00000004.00000020.00020000.00000000.sdmp, mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp, UrlInfo.ini4.0.dr String found in binary or memory: https://apipdm.imyfone.club/producturl?key=license_agreement&pid=370&lang=arabic
Source: mirrorto_setup.exe, 00000000.00000003.2053158307.0000000001295000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://download.imyfone.com/mirrorto/mi
Source: UrlInfo.ini14.0.dr String found in binary or memory: https://download.imyfone.com/mirrorto/mirrorto_setup.exe
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://download.imyfone.com/mirrorto/mirrorto_setup.exe%
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://download.imyfone.com/mirrorto/mirrorto_setup.exe6)
Source: mirrorto_setup.exe String found in binary or memory: https://www.google-analytics.com/mp/collect?measurement_id=G-5K7RY5G7V4&api_secret=T0joKD2MSiCE0gC58
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0040A7B5 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState, 0_2_0040A7B5
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004A4720: CloseHandle,CreateFileW,GetLastError,DeviceIoControl, 0_2_004A4720
Detected potential crypto function
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0042944B 0_2_0042944B
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004195A2 0_2_004195A2
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0042D5BB 0_2_0042D5BB
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00592640 0_2_00592640
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0040A801 0_2_0040A801
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004149DE 0_2_004149DE
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0041CB20 0_2_0041CB20
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003FD030 0_2_003FD030
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0042E178 0_2_0042E178
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004921A0 0_2_004921A0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0057C3C8 0_2_0057C3C8
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0059B441 0_2_0059B441
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A74A7 0_2_005A74A7
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0058A5DC 0_2_0058A5DC
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0041D5EB 0_2_0041D5EB
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004145F6 0_2_004145F6
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0041F83E 0_2_0041F83E
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003F7910 0_2_003F7910
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0042EA4A 0_2_0042EA4A
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003F9A00 0_2_003F9A00
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0058BAD4 0_2_0058BAD4
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00579B00 0_2_00579B00
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00428B9D 0_2_00428B9D
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00427BBD 0_2_00427BBD
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00593C02 0_2_00593C02
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003FACF0 0_2_003FACF0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00405CA0 0_2_00405CA0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00590DDD 0_2_00590DDD
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003F8D80 0_2_003F8D80
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00420DB5 0_2_00420DB5
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0059EE69 0_2_0059EE69
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003F2FB0 0_2_003F2FB0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0041DFF8 0_2_0041DFF8
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00589F98 0_2_00589F98
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A7F8B 0_2_005A7F8B
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 004B4980 appears 44 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 004ED050 appears 31 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0058B2A0 appears 31 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0057A04F appears 40 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0057B37E appears 57 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 004F02B0 appears 47 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0042A10C appears 38 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0057B788 appears 115 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 0057B51E appears 134 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 00562707 appears 65 times
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: String function: 00409D16 appears 37 times
PE file contains executable resources (Code or Archives)
Source: mirrorto_setup.exe Static PE information: Resource name: ZIPRES type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: mirrorto_setup.exe Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=store
Uses 32bit PE files
Source: mirrorto_setup.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: clean6.winEXE@1/39@0/0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003EE140 GetDiskFreeSpaceExW, 0_2_003EE140
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003EDAB0 _memset,lstrcpyW,_memset,CreateToolhelp32Snapshot,Process32FirstW,lstrcmpW,lstrcmpW,Process32NextW,CloseHandle,CloseHandle,_wprintf, 0_2_003EDAB0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003EF4A0 ImageList_Create,CoInitialize,CoCreateInstance, 0_2_003EF4A0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004195A2 __EH_prolog3_GS,CreateFileW,GetFileSize,CloseHandle,ReadFile,CloseHandle,_wcscmp,FindResourceW,LoadResource,FreeResource,SizeofResource,LockResource,_memmove,FreeResource,CreateFileW,GetFileSize,CloseHandle,ReadFile,CloseHandle,_wcscmp,_memset,CreateDIBSection,_wcscmp,CharNextW,_wcscmp, 0_2_004195A2
Source: C:\Users\user\Desktop\mirrorto_setup.exe File created: C:\Program Files (x86)\imyfone_down Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Mutant created: \Sessions\1\BaseNamedObjects\imyfone-mirrorto_setup.exe
Source: mirrorto_setup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\mirrorto_setup.exe File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: mirrorto_setup.exe String found in binary or memory: set-addPolicy
Source: mirrorto_setup.exe String found in binary or memory: .\crypto\buffer\buffer.c.\crypto\buffer\buf_str.cStack part of OpenSSL 1.0.2u 20 Dec 2019.\crypto\stack\stack.c.\crypto\comp\comp_lib.cbuffer.\crypto\bio\bf_buff.c.\crypto\rsa\rsa_crpt.cDiffie-Hellman part of OpenSSL 1.0.2u 20 Dec 2019.\crypto\dh\dh_lib.clhash part of OpenSSL 1.0.2u 20 Dec 2019.\crypto\lhash\lhash.csetct-CredReqTBSXsetct-CredResDatasetct-CredRevReqTBSsetct-CredRevReqTBSXsetct-CredRevResDatasetct-PCertReqDatasetct-PCertResTBSsetct-BatchAdminReqDatasetct-BatchAdminResDatasetct-CardCInitResTBSsetct-MeAqCInitResTBSsetct-RegFormResTBSsetct-CertReqDatasetct-CertReqTBSsetct-CertResDatasetct-CertInqReqTBSsetct-ErrorTBSsetct-PIDualSignedTBEsetct-PIUnsignedTBEsetct-AuthReqTBEsetct-AuthResTBEsetct-AuthResTBEXsetct-AuthTokenTBEsetct-CapTokenTBEsetct-CapTokenTBEXsetct-AcqCardCodeMsgTBEsetct-AuthRevReqTBEsetct-AuthRevResTBEsetct-AuthRevResTBEBsetct-CapReqTBEsetct-CapReqTBEXsetct-CapResTBEsetct-CapRevReqTBEsetct-CapRevReqTBEXsetct-CapRevResTBEsetct-CredReqTBEsetct-CredReqTBEXsetct-CredResTBEsetct-CredRevReqTBEsetct-CredRevReqTBEXsetct-CredRevResTBEsetct-BatchAdminReqTBEsetct-BatchAdminResTBEsetct-RegFormReqTBEsetct-CertReqTBEsetct-CertReqTBEXsetct-CertResTBEsetct-CRLNotificationTBSsetct-CRLNotificationResTBSsetct-BCIDistributionTBSsetext-genCryptgeneric cryptogramsetext-miAuthmerchant initiated authsetext-pinSecuresetext-pinAnysetext-track2setext-cvadditional verificationset-policy-rootsetCext-hashedRootsetCext-certTypesetCext-merchDatasetCext-cCertRequiredsetCext-tunnelingsetCext-setExtsetCext-setQualfsetCext-PGWYcapabilitiessetCext-TokenIdentifiersetCext-Track2DatasetCext-TokenTypesetCext-IssuerCapabilitiessetAttr-CertsetAttr-PGWYcappayment gateway capabilitiessetAttr-TokenTypesetAttr-IssCapissuer capabilitiesset-rootKeyThumbset-addPolicysetAttr-Token-EMVsetAttr-Token-B0PrimesetAttr-IssCap-CVMsetAttr-IssCap-T2setAttr-IssCap-SigsetAttr-GenCryptgrmgenerate cryptogramsetAttr-T2Encencrypted track 2setAttr-T2cleartxtcleartext track 2setAttr-TokICCsigICC or token signaturesetAttr-SecDevSigsecure device signatureset-brand-IATA-ATAset-brand-Dinersset-brand-AmericanExpressset-brand-JCBset-brand-Visaset-brand-MasterCardset-brand-NovusDES-CDMFdes-cdmfrsaOAEPEncryptionSETITU-Titu-tJOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLoginMicrosoft SmartcardloginmsUPNMicrosoft Universal Principal NameAES-128-CFB1aes-128-cfb1AES-192-CFB1aes-192-cfb1AES-256-CFB1aes-256-cfb1AES-128-CFB8aes-128-cfb8AES-192-CFB8aes-192-cfb8AES-256-CFB8aes-256-cfb8DES-CFB1des-cfb1DES-CFB8des-cfb8DES-EDE3-CFB1des-ede3-cfb1DES-EDE3-CFB8des-ede3-cfb8streetstreetAddresspostalCodeid-pplproxyCertInfoProxy Certificate Informationid-ppl-anyLanguageAny languageid-ppl-inheritAllInherit allnameConstraintsX509v3 Name Constraintsid-ppl-independentIndependentRSA-SHA256sha256WithRSAEncryptionRSA-SHA384sha384WithRSAEncryptionRSA-SHA512sha512WithRSAEncryptionRSA-SHA224sha224WithRSAEncryptionsha256sha384SHA512sha512SHA224sha224identified-organizationc
Source: mirrorto_setup.exe String found in binary or memory: id-cmc-addExtensions
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\mirrorto_setup.exe File written: C:\Program Files (x86)\imyfone_down\mirrorto_setup\language\Arabic\text.ini Jump to behavior
Source: mirrorto_setup.exe Static PE information: certificate valid
Source: mirrorto_setup.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: mirrorto_setup.exe Static file information: File size 2891216 > 1048576
Source: mirrorto_setup.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x204c00
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: mirrorto_setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: mirrorto_setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Jenkins\workspace\MF_Downloader\output\Release\MFDownloader.pdb# source: mirrorto_setup.exe
Source: Binary string: D:\Jenkins\workspace\MF_Downloader\output\Release\MFDownloader.pdb source: mirrorto_setup.exe
Source: mirrorto_setup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mirrorto_setup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mirrorto_setup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mirrorto_setup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mirrorto_setup.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A29E0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_005A29E0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0058B2E5 push ecx; ret 0_2_0058B2F8
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0057B4EC push ecx; ret 0_2_0057B4FF
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0040A801 __EH_prolog3_GS,IsIconic,ScreenToClient,GetCursorPos,ScreenToClient,GetTickCount,GetTickCount,GetActiveWindow,GetWindow,GetWindowLongW,GetParent,SetFocus,DestroyWindow,_memset,BeginPaint,EndPaint,GetClientRect,IsRectEmpty,_memset,BeginPaint,_memset,GetUpdateRect,IsRectEmpty,DeleteDC,DeleteDC,DeleteObject,DeleteObject,_memset,CreateCompatibleDC,CreateCompatibleBitmap,_memset,BeginPaint,SelectObject,SaveDC,IsWindow,IsWindowVisible,IntersectRect,CreateCompatibleDC,_memset,SelectObject,SendMessageW,BitBlt,SelectObject,DeleteObject,DeleteDC,RestoreDC,GetWindowRect,CreateCompatibleDC,_memset,SelectObject,_memset,BitBlt,SelectObject,SelectObject,SelectObject,GetStockObject,SelectObject,Rectangle,SelectObject,SaveDC,RestoreDC,EndPaint,GetFocus,GetParent,GetParent,GetTickCount,GetTickCount,GetTickCount,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,GetTickCount,SetFocus,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,_memmove,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SetFocus,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,GetTickCount,_memset,SendMessageW,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ScreenToClient,GetTickCount,SendMessageW,SetFocus,GetTickCount, 0_2_0040A801
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0040A801 __EH_prolog3_GS,IsIconic,ScreenToClient,GetCursorPos,ScreenToClient,GetTickCount,GetTickCount,GetActiveWindow,GetWindow,GetWindowLongW,GetParent,SetFocus,DestroyWindow,_memset,BeginPaint,EndPaint,GetClientRect,IsRectEmpty,_memset,BeginPaint,_memset,GetUpdateRect,IsRectEmpty,DeleteDC,DeleteDC,DeleteObject,DeleteObject,_memset,CreateCompatibleDC,CreateCompatibleBitmap,_memset,BeginPaint,SelectObject,SaveDC,IsWindow,IsWindowVisible,IntersectRect,CreateCompatibleDC,_memset,SelectObject,SendMessageW,BitBlt,SelectObject,DeleteObject,DeleteDC,RestoreDC,GetWindowRect,CreateCompatibleDC,_memset,SelectObject,_memset,BitBlt,SelectObject,SelectObject,SelectObject,GetStockObject,SelectObject,Rectangle,SelectObject,SaveDC,RestoreDC,EndPaint,GetFocus,GetParent,GetParent,GetTickCount,GetTickCount,GetTickCount,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,GetTickCount,SetFocus,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,_memmove,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SetFocus,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,GetTickCount,_memset,SendMessageW,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ScreenToClient,GetTickCount,SendMessageW,SetFocus,GetTickCount, 0_2_0040A801
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0040A801 __EH_prolog3_GS,IsIconic,ScreenToClient,GetCursorPos,ScreenToClient,GetTickCount,GetTickCount,GetActiveWindow,GetWindow,GetWindowLongW,GetParent,SetFocus,DestroyWindow,_memset,BeginPaint,EndPaint,GetClientRect,IsRectEmpty,_memset,BeginPaint,_memset,GetUpdateRect,IsRectEmpty,DeleteDC,DeleteDC,DeleteObject,DeleteObject,_memset,CreateCompatibleDC,CreateCompatibleBitmap,_memset,BeginPaint,SelectObject,SaveDC,IsWindow,IsWindowVisible,IntersectRect,CreateCompatibleDC,_memset,SelectObject,SendMessageW,BitBlt,SelectObject,DeleteObject,DeleteDC,RestoreDC,GetWindowRect,CreateCompatibleDC,_memset,SelectObject,_memset,BitBlt,SelectObject,SelectObject,SelectObject,GetStockObject,SelectObject,Rectangle,SelectObject,SaveDC,RestoreDC,EndPaint,GetFocus,GetParent,GetParent,GetTickCount,GetTickCount,GetTickCount,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,GetTickCount,SetFocus,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,_memmove,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SetFocus,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,GetTickCount,_memset,SendMessageW,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ScreenToClient,GetTickCount,SendMessageW,SetFocus,GetTickCount, 0_2_0040A801
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004074F5 GetWindowRect,GetParent,GetWindow,MonitorFromWindow,GetMonitorInfoW,IsIconic,GetWindowRect,SetWindowPos, 0_2_004074F5
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00411979 IsIconic, 0_2_00411979
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00411BDE IsIconic,GetWindowRect,CreateRoundRectRgn,SetWindowRgn,DeleteObject, 0_2_00411BDE
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_004A9810 GetSystemInfo,SetFilePointerEx,SetFilePointerEx,GetLastError,SetFilePointerEx,GetLastError,ReadFile,GetLastError,CreateEventW,ReadFileScatter,GetLastError,GetLastError,GetLastError,CloseHandle,GetOverlappedResult,CloseHandle, 0_2_004A9810
Source: mirrorto_setup.exe, 00000000.00000003.2052355500.0000000001282000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\3>c
Source: mirrorto_setup.exe, 00000000.00000002.3293685103.000000000123E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: C:\Users\user\Desktop\mirrorto_setup.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\mirrorto_setup.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A727E EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_005A727E
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A727E EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_005A727E
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005A29E0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_005A29E0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003FE3B0 GetProcessHeap,HeapAlloc,_memmove,GetFileAttributesW,HeapFree,GetLastError, 0_2_003FE3B0
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00585180 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00585180
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_003C1000 cpuid 0_2_003C1000
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: GetLocaleInfoEx,GetLocaleInfoW, 0_2_0058B0B9
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, 0_2_005A6300
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: EnumSystemLocalesW, 0_2_0058B033
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: EnumSystemLocalesW, 0_2_005A6574
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 0_2_005A65B4
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: _GetPrimaryLen,EnumSystemLocalesW, 0_2_005A6631
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_005A69D3
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s, 0_2_005A6B54
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005635CB GetSystemTimeAsFileTime, 0_2_005635CB
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_0059E7F2 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 0_2_0059E7F2
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_00598E12 GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8, 0_2_00598E12
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\mirrorto_setup.exe Code function: 0_2_005ABE20 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext, 0_2_005ABE20
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1467121 Sample: mirrorto_setup.exe Startdate: 03/07/2024 Architecture: WINDOWS Score: 6 4 mirrorto_setup.exe 1 63 2->4         started       
⊘No contacted IP infos