Windows
Analysis Report
874A7cigvX.exe
Overview
General Information
Sample name: | 874A7cigvX.exerenamed because original name is a hash value |
Original sample name: | Trojan.Autorun.ATA_virussign.com_f7ae445081e10267d2cec9b6b0e2d375.exe |
Analysis ID: | 1506014 |
MD5: | f7ae445081e10267d2cec9b6b0e2d375 |
SHA1: | e12892ea4d092e4b959617c6d00356ee23da0797 |
SHA256: | 569edae4e4c7f5df590c7ee0a96210942e2be22be73beda9bc1528addca234f4 |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- 874A7cigvX.exe (PID: 2796 cmdline:
"C:\Users\ user\Deskt op\874A7ci gvX.exe" MD5: F7AE445081E10267D2CEC9B6B0E2D375) - cmd.exe (PID: 3472 cmdline:
"C:\Window s\System32 \cmd.exe" /C mkdir C :\Windows\ SysWOW64\y cgeofkw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 3680 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 3712 cmdline:
"C:\Window s\System32 \cmd.exe" /C move /Y "C:\Users \user\AppD ata\Local\ Temp\xvksl bws.exe" C :\Windows\ SysWOW64\y cgeofkw\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6624 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 6552 cmdline:
"C:\Window s\System32 \sc.exe" c reate ycge ofkw binPa th= "C:\Wi ndows\SysW OW64\ycgeo fkw\xvkslb ws.exe /d\ "C:\Users\ user\Deskt op\874A7ci gvX.exe\"" type= own start= au to Display Name= "wif i support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 6172 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 6728 cmdline:
"C:\Window s\System32 \sc.exe" d escription ycgeofkw "wifi inte rnet conec tion" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 5268 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 984 cmdline:
"C:\Window s\System32 \sc.exe" s tart ycgeo fkw MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8) - conhost.exe (PID: 5908 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - netsh.exe (PID: 4508 cmdline:
"C:\Window s\System32 \netsh.exe " advfirew all firewa ll add rul e name="Ho st-process for servi ces of Win dows" dir= in action= allow prog ram="C:\Wi ndows\SysW OW64\svcho st.exe" en able=yes>n ul MD5: 4E89A1A088BE715D6C946E55AB07C7DF) - conhost.exe (PID: 2724 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- xvkslbws.exe (PID: 1440 cmdline:
C:\Windows \SysWOW64\ ycgeofkw\x vkslbws.ex e /d"C:\Us ers\user\D esktop\874 A7cigvX.ex e" MD5: 702317DA74C3C1D30ED61EA3A7D7DFCD) - svchost.exe (PID: 6204 cmdline:
svchost.ex e MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Tofsee | According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems. | No Attribution |
{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
Windows_Trojan_Smokeloader_3687686f | unknown | unknown |
| |
Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
Click to see the 24 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
MALWARE_Win_Tofsee | Detects Tofsee | ditekSHen |
| |
Windows_Trojan_Tofsee_26124fe4 | unknown | unknown |
| |
MALWARE_Win_Tofsee | Detects Tofsee | ditekSHen |
| |
JoeSecurity_Tofsee | Yara detected Tofsee | Joe Security | ||
Click to see the 39 entries |
System Summary |
---|
Source: | Author: David Burkett, @signalblur: |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Christian Burkard (Nextron Systems): |
Source: | Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: |
Click to jump to signature section
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Malware Configuration Extractor: |
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Compliance |
---|
Source: | Unpacked PE file: | ||
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior |
Change of critical system settings |
---|
Source: | Registry key created or modified: | Jump to behavior |
Networking |
---|
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior |
Source: | URLs: | ||
Source: | URLs: |
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: | ||
Source: | IP Address: |
Source: | ASN Name: | ||
Source: | ASN Name: | ||
Source: | ASN Name: | ||
Source: | ASN Name: |
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: | ||
Source: | UDP traffic detected without corresponding DNS query: |
Source: | Code function: | 0_2_00402A62 |
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: | ||
Source: | DNS traffic detected: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Spam, unwanted Advertisements and Ransom Demands |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 0_2_00408E26 |
Source: | Code function: | 0_2_00401280 |
Source: | File created: | Jump to behavior |
Source: | Code function: | 0_2_0040C913 | |
Source: | Code function: | 12_2_0040C913 | |
Source: | Code function: | 15_2_030FC913 |
Source: | Static PE information: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_00406A60 |
Source: | Code function: | 0_2_02679066 |
Source: | Code function: | 0_2_00409A6B |
Source: | Code function: | 0_2_00409A6B | |
Source: | Code function: | 12_2_00409A6B | |
Source: | Code function: | 15_2_030F9A6B |
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Virustotal: | ||
Source: | ReversingLabs: |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Source: | Static PE information: |
Data Obfuscation |
---|
Source: | Unpacked PE file: | ||
Source: | Unpacked PE file: |
Source: | Unpacked PE file: | ||
Source: | Unpacked PE file: |
Source: | Code function: | 0_2_00406069 |
Source: | Static PE information: |
Source: | Code function: | 0_2_0267C354 | |
Source: | Code function: | 12_2_0263577C |
Source: | Static PE information: |
Persistence and Installation Behavior |
---|
Source: | Executable created and started: |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to dropped file |
Source: | Registry key value modified: | Jump to behavior |
Source: | Code function: | 0_2_00409A6B |
Source: | Process created: |
Hooking and other Techniques for Hiding and Protection |
---|
Source: | File deleted: | Jump to behavior |
Source: | Code function: | 0_2_00401000 |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Code function: | 15_2_030F199C |
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: |
Source: | Code function: | 0_2_00401D96 |
Source: | Binary or memory string: |
Source: | Code function: | 0_2_00406069 |
Source: | Code function: | 0_2_0261092B | |
Source: | Code function: | 0_2_02610D90 | |
Source: | Code function: | 0_2_02678943 | |
Source: | Code function: | 12_2_02631D6B | |
Source: | Code function: | 12_2_02D7092B | |
Source: | Code function: | 12_2_02D70D90 |
Source: | Code function: | 0_2_0040EBCC |
Source: | Code function: | 0_2_00409A6B | |
Source: | Code function: | 12_2_00409A6B | |
Source: | Code function: | 15_2_030F9A6B |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior |
Source: | Memory allocated: | Jump to behavior |
Source: | Memory written: | Jump to behavior |
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Code function: | 0_2_00407809 |
Source: | Code function: | 0_2_00406EDD |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_0040405E |
Source: | Code function: | 0_2_0040EC54 |
Source: | Code function: | 0_2_00407809 |
Source: | Code function: | 0_2_0040B211 |
Source: | Code function: | 0_2_00409326 |
Lowering of HIPS / PFW / Operating System Security Settings |
---|
Source: | Process created: |
Source: | Process created: |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | Code function: | 0_2_004088B0 | |
Source: | Code function: | 12_2_004088B0 | |
Source: | Code function: | 15_2_030F88B0 |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | 1 Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 DLL Side-Loading | 3 Disable or Modify Tools | OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 1 Ingress Tool Transfer | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | 3 Service Execution | 1 Valid Accounts | 1 Valid Accounts | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 1 Account Discovery | Remote Desktop Protocol | Data from Removable Media | 12 Encrypted Channel | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | 14 Windows Service | 1 Access Token Manipulation | 3 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | 14 Windows Service | 22 Software Packing | NTDS | 15 System Information Discovery | Distributed Component Object Model | Input Capture | 112 Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | 412 Process Injection | 1 DLL Side-Loading | LSA Secrets | 11 Security Software Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 File Deletion | Cached Domain Credentials | 1 Virtualization/Sandbox Evasion | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 12 Masquerading | DCSync | 1 Process Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 Valid Accounts | Proc Filesystem | 1 System Owner/User Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
Network Topology | Malvertising | Exploit Public-Facing Application | Command and Scripting Interpreter | At | At | 1 Virtualization/Sandbox Evasion | /etc/passwd and /etc/shadow | 1 System Network Configuration Discovery | Direct Cloud VM Connections | Data Staged | Web Protocols | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | Internal Defacement |
IP Addresses | Compromise Infrastructure | Supply Chain Compromise | PowerShell | Cron | Cron | 1 Access Token Manipulation | Network Sniffing | Network Service Discovery | Shared Webroot | Local Data Staging | File Transfer Protocols | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | External Defacement |
Network Security Appliances | Domains | Compromise Software Dependencies and Development Tools | AppleScript | Launchd | Launchd | 412 Process Injection | Input Capture | System Network Connections Discovery | Software Deployment Tools | Remote Data Staging | Mail Protocols | Exfiltration Over Unencrypted Non-C2 Protocol | Firmware Corruption |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
68% | Virustotal | Browse | ||
68% | ReversingLabs | Win32.Trojan.Convagent | ||
100% | Joe Sandbox ML |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Joe Sandbox ML |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Virustotal | Browse | ||
1% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
16% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse | ||
0% | Virustotal | Browse |
Name | IP | Active | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|---|
mxs.mail.ru | 217.69.139.150 | true | true |
| unknown |
mta7.am0.yahoodns.net | 67.195.204.74 | true | true |
| unknown |
microsoft-com.mail.protection.outlook.com | 52.101.42.0 | true | true |
| unknown |
vanaheim.cn | 77.232.41.29 | true | true |
| unknown |
smtp.google.com | 64.233.166.26 | true | false |
| unknown |
google.com | unknown | unknown | true |
| unknown |
yahoo.com | unknown | unknown | true |
| unknown |
mail.ru | unknown | unknown | true |
| unknown |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true |
| unknown | |
true |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
52.101.42.0 | microsoft-com.mail.protection.outlook.com | United States | 8075 | MICROSOFT-CORP-MSN-AS-BLOCKUS | true | |
64.233.166.26 | smtp.google.com | United States | 15169 | GOOGLEUS | false | |
217.69.139.150 | mxs.mail.ru | Russian Federation | 47764 | MAILRU-ASMailRuRU | true | |
77.232.41.29 | vanaheim.cn | Russian Federation | 28968 | EUT-ASEUTIPNetworkRU | true | |
67.195.204.74 | mta7.am0.yahoodns.net | United States | 26101 | YAHOO-3US | true |
Joe Sandbox version: | 40.0.0 Tourmaline |
Analysis ID: | 1506014 |
Start date and time: | 2024-09-07 15:13:59 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 19s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 18 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | 874A7cigvX.exerenamed because original name is a hash value |
Original Sample Name: | Trojan.Autorun.ATA_virussign.com_f7ae445081e10267d2cec9b6b0e2d375.exe |
Detection: | MAL |
Classification: | mal100.troj.evad.winEXE@22/3@9/5 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.76.201.171, 20.70.246.20, 20.236.44.162, 20.231.239.246
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtEnumerateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
Time | Type | Description |
---|---|---|
09:15:37 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
52.101.42.0 | Get hash | malicious | Tofsee | Browse | ||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
217.69.139.150 | Get hash | malicious | Tofsee | Browse | ||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
77.232.41.29 | Get hash | malicious | Tofsee | Browse | ||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
67.195.204.74 | Get hash | malicious | Tofsee | Browse | ||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Tofsee | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Phorpiex, Xmrig | Browse | |||
Get hash | malicious | Phorpiex | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse | |||
Get hash | malicious | Unknown | Browse |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
mta7.am0.yahoodns.net | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
microsoft-com.mail.protection.outlook.com | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
vanaheim.cn | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
mxs.mail.ru | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
MICROSOFT-CORP-MSN-AS-BLOCKUS | Get hash | malicious | Unknown | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | HTMLPhisher | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
MAILRU-ASMailRuRU | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
Get hash | malicious | LummaC Stealer | Browse |
| ||
EUT-ASEUTIPNetworkRU | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Cryptbot | Browse |
| ||
YAHOO-3US | Get hash | malicious | Tofsee | Browse |
| |
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Tofsee | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
Process: | C:\Users\user\Desktop\874A7cigvX.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 11205632 |
Entropy (8bit): | 4.427228358082004 |
Encrypted: | false |
SSDEEP: | 6144:AtRdHbfGeyTf8CJH1ci6aZRVDqQP4n48rMI8gVzuhZIIQFa0lw+QFa0lw+QFa0lr:AtRdHbfByTU3OTBtP44cMYW |
MD5: | 702317DA74C3C1D30ED61EA3A7D7DFCD |
SHA1: | 7D65AF1304C2AA77DF791E21DE687F3302F1170F |
SHA-256: | 409942DBC4AE0F7F3EE1D2EEF70180AB21CCD2707621500BDA9F4B3D28632FF6 |
SHA-512: | F9A432E5D7168701766262EDFEA02E0BFD37651A3F64731DA822B6FB20FE43F5E3541A7AE5E0C825A9B1D1CE1064F1FE2CBFAD2139A2F4D85796961416739CDD |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Windows\SysWOW64\cmd.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 11205632 |
Entropy (8bit): | 4.427228358082004 |
Encrypted: | false |
SSDEEP: | 6144:AtRdHbfGeyTf8CJH1ci6aZRVDqQP4n48rMI8gVzuhZIIQFa0lw+QFa0lw+QFa0lr:AtRdHbfByTU3OTBtP44cMYW |
MD5: | 702317DA74C3C1D30ED61EA3A7D7DFCD |
SHA1: | 7D65AF1304C2AA77DF791E21DE687F3302F1170F |
SHA-256: | 409942DBC4AE0F7F3EE1D2EEF70180AB21CCD2707621500BDA9F4B3D28632FF6 |
SHA-512: | F9A432E5D7168701766262EDFEA02E0BFD37651A3F64731DA822B6FB20FE43F5E3541A7AE5E0C825A9B1D1CE1064F1FE2CBFAD2139A2F4D85796961416739CDD |
Malicious: | true |
Preview: |
Process: | C:\Windows\SysWOW64\netsh.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 3773 |
Entropy (8bit): | 4.7109073551842435 |
Encrypted: | false |
SSDEEP: | 48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w |
MD5: | DA3247A302D70819F10BCEEBAF400503 |
SHA1: | 2857AA198EE76C86FC929CC3388A56D5FD051844 |
SHA-256: | 5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8 |
SHA-512: | 48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8 |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 5.975423801517119 |
TrID: |
|
File name: | 874A7cigvX.exe |
File size: | 409'088 bytes |
MD5: | f7ae445081e10267d2cec9b6b0e2d375 |
SHA1: | e12892ea4d092e4b959617c6d00356ee23da0797 |
SHA256: | 569edae4e4c7f5df590c7ee0a96210942e2be22be73beda9bc1528addca234f4 |
SHA512: | 194a260edb0ce0d6c9b74484b55d64e8d593c990ca647acf4c24dd4b58abee0e586485fb06970557d83cc97159933b55a9fa3cc9316f52c28d86552aa039ab04 |
SSDEEP: | 6144:ztRdHbfGeyTf8CJH1ci6aZRVDqQP4n48rMI8gVzuhZIIQFa0lw:ztRdHbfByTU3OTBtP44cMYW |
TLSH: | E594CF10BA93D875D5720534BC34CAB2273BBDA25834418B37943B7F3EF16916EA6392 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.O-6.!~6.!~6.!~Y..~*.!~Y..~/.!~Y..~D.!~?..~1.!~6. ~..!~Y..~7.!~Y..~7.!~Y..~7.!~Rich6.!~................PE..L......d........... |
Icon Hash: | cd4d3d2e4e054903 |
Entrypoint: | 0x406ce0 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE |
DLL Characteristics: | TERMINAL_SERVER_AWARE |
Time Stamp: | 0x64D7AFB0 [Sat Aug 12 16:13:36 2023 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 5 |
OS Version Minor: | 1 |
File Version Major: | 5 |
File Version Minor: | 1 |
Subsystem Version Major: | 5 |
Subsystem Version Minor: | 1 |
Import Hash: | 9875b68adf5a82da587f07ad683d1acb |
Instruction |
---|
call 00007F95E47F3A9Dh |
jmp 00007F95E47EF98Eh |
sub eax, 000003A4h |
je 00007F95E47EFB24h |
sub eax, 04h |
je 00007F95E47EFB19h |
sub eax, 0Dh |
je 00007F95E47EFB0Eh |
dec eax |
je 00007F95E47EFB05h |
xor eax, eax |
ret |
mov eax, 00000404h |
ret |
mov eax, 00000412h |
ret |
mov eax, 00000804h |
ret |
mov eax, 00000411h |
ret |
mov edi, edi |
push esi |
push edi |
mov esi, eax |
push 00000101h |
xor edi, edi |
lea eax, dword ptr [esi+1Ch] |
push edi |
push eax |
call 00007F95E47F1EA5h |
xor eax, eax |
movzx ecx, ax |
mov eax, ecx |
mov dword ptr [esi+04h], edi |
mov dword ptr [esi+08h], edi |
mov dword ptr [esi+0Ch], edi |
shl ecx, 10h |
or eax, ecx |
lea edi, dword ptr [esi+10h] |
stosd |
stosd |
stosd |
mov ecx, 00441040h |
add esp, 0Ch |
lea eax, dword ptr [esi+1Ch] |
sub ecx, esi |
mov edi, 00000101h |
mov dl, byte ptr [ecx+eax] |
mov byte ptr [eax], dl |
inc eax |
dec edi |
jne 00007F95E47EFAF9h |
lea eax, dword ptr [esi+0000011Dh] |
mov esi, 00000100h |
mov dl, byte ptr [eax+ecx] |
mov byte ptr [eax], dl |
inc eax |
dec esi |
jne 00007F95E47EFAF9h |
pop edi |
pop esi |
ret |
mov edi, edi |
push ebp |
mov ebp, esp |
sub esp, 0000051Ch |
mov eax, dword ptr [00441E78h] |
xor eax, ebp |
mov dword ptr [ebp-04h], eax |
push ebx |
push edi |
lea eax, dword ptr [ebp-00000518h] |
push eax |
push dword ptr [esi+04h] |
call dword ptr [00401130h] |
mov edi, 00000100h |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x3f6c4 | 0x50 | .text |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x206f000 | 0xc450 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x3f714 | 0x1c | .text |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x4e40 | 0x40 | .text |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x1000 | 0x1fc | .text |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x3f254 | 0x3f400 | 7ab7433d95fe1f96341728162b638f91 | False | 0.8364045516304348 | data | 7.609251717911276 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.data | 0x41000 | 0x202ce08 | 0x17c00 | 18b35e49e42f21b75c2e03b67ddf0fc8 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.yey | 0x206e000 | 0x400 | 0x400 | 0f343b0931126a20f133d67c2b018a3b | False | 0.0166015625 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.rsrc | 0x206f000 | 0xc450 | 0xc600 | c7fae4b954f7fac03d8f05855fd32d20 | False | 0.3594341856060606 | data | 4.347217336297205 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
AFX_DIALOG_LAYOUT | 0x2075eb8 | 0xe | data | 1.5714285714285714 | ||
RT_CURSOR | 0x2075ec8 | 0x330 | Device independent bitmap graphic, 48 x 96 x 1, image size 0 | 0.1948529411764706 | ||
RT_CURSOR | 0x20761f8 | 0x130 | Device independent bitmap graphic, 32 x 64 x 1, image size 0 | 0.33223684210526316 | ||
RT_CURSOR | 0x2076350 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.26439232409381663 | ||
RT_CURSOR | 0x20771f8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.3686823104693141 | ||
RT_CURSOR | 0x2077aa0 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.49060693641618497 | ||
RT_CURSOR | 0x2078038 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.27238805970149255 | ||
RT_CURSOR | 0x2078ee0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.375 | ||
RT_CURSOR | 0x2079788 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.5057803468208093 | ||
RT_ICON | 0x206f640 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Tamil | India | 0.4621535181236674 |
RT_ICON | 0x206f640 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Tamil | Sri Lanka | 0.4621535181236674 |
RT_ICON | 0x20704e8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Tamil | India | 0.572202166064982 |
RT_ICON | 0x20704e8 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Tamil | Sri Lanka | 0.572202166064982 |
RT_ICON | 0x2070d90 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Tamil | India | 0.6336405529953917 |
RT_ICON | 0x2070d90 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Tamil | Sri Lanka | 0.6336405529953917 |
RT_ICON | 0x2071458 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Tamil | India | 0.6936416184971098 |
RT_ICON | 0x2071458 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Tamil | Sri Lanka | 0.6936416184971098 |
RT_ICON | 0x20719c0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216 | Tamil | India | 0.35383817427385894 |
RT_ICON | 0x20719c0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9216 | Tamil | Sri Lanka | 0.35383817427385894 |
RT_ICON | 0x2073f68 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096 | Tamil | India | 0.4383208255159475 |
RT_ICON | 0x2073f68 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4096 | Tamil | Sri Lanka | 0.4383208255159475 |
RT_ICON | 0x2075010 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2304 | Tamil | India | 0.510655737704918 |
RT_ICON | 0x2075010 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2304 | Tamil | Sri Lanka | 0.510655737704918 |
RT_ICON | 0x2075998 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024 | Tamil | India | 0.6081560283687943 |
RT_ICON | 0x2075998 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1024 | Tamil | Sri Lanka | 0.6081560283687943 |
RT_STRING | 0x2079f88 | 0x51a | data | Tamil | India | 0.44104134762633995 |
RT_STRING | 0x2079f88 | 0x51a | data | Tamil | Sri Lanka | 0.44104134762633995 |
RT_STRING | 0x207a4a8 | 0x582 | data | Tamil | India | 0.4390070921985816 |
RT_STRING | 0x207a4a8 | 0x582 | data | Tamil | Sri Lanka | 0.4390070921985816 |
RT_STRING | 0x207aa30 | 0x2d2 | data | Tamil | India | 0.48753462603878117 |
RT_STRING | 0x207aa30 | 0x2d2 | data | Tamil | Sri Lanka | 0.48753462603878117 |
RT_STRING | 0x207ad08 | 0x4b4 | data | Tamil | India | 0.4543189368770764 |
RT_STRING | 0x207ad08 | 0x4b4 | data | Tamil | Sri Lanka | 0.4543189368770764 |
RT_STRING | 0x207b1c0 | 0x28a | data | Tamil | India | 0.4907692307692308 |
RT_STRING | 0x207b1c0 | 0x28a | data | Tamil | Sri Lanka | 0.4907692307692308 |
RT_ACCELERATOR | 0x2075e78 | 0x40 | data | Tamil | India | 0.875 |
RT_ACCELERATOR | 0x2075e78 | 0x40 | data | Tamil | Sri Lanka | 0.875 |
RT_GROUP_CURSOR | 0x2076328 | 0x22 | data | 1.0294117647058822 | ||
RT_GROUP_CURSOR | 0x2078008 | 0x30 | data | 0.9375 | ||
RT_GROUP_CURSOR | 0x2079cf0 | 0x30 | data | 0.9375 | ||
RT_GROUP_ICON | 0x2075e00 | 0x76 | data | Tamil | India | 0.6610169491525424 |
RT_GROUP_ICON | 0x2075e00 | 0x76 | data | Tamil | Sri Lanka | 0.6610169491525424 |
RT_VERSION | 0x2079d20 | 0x264 | data | 0.5490196078431373 |
DLL | Import |
---|---|
KERNEL32.dll | GetCurrentProcess, SetDefaultCommConfigW, SetEnvironmentVariableW, CreateJobObjectW, UnlockFile, CreateHardLinkA, GetModuleHandleW, GetTickCount, FindNextVolumeMountPointA, GetNumberFormatA, GetWindowsDirectoryA, SetCommState, GlobalAlloc, SetFileShortNameW, LoadLibraryW, GetCalendarInfoA, SetVolumeMountPointA, GetConsoleAliasExesLengthW, GetFileAttributesW, VerifyVersionInfoA, GetModuleFileNameW, CreateActCtxA, GetThreadPriorityBoost, LCMapStringA, InterlockedExchange, GetLogicalDriveStringsA, SetLastError, GetProcAddress, CreateNamedPipeA, GetConsoleDisplayMode, GetProcessVersion, InterlockedDecrement, InterlockedExchangeAdd, CreateFileMappingW, CreateEventW, OpenEventA, GlobalWire, EnumDateFormatsA, EnumResourceNamesA, VirtualProtect, GetCurrentDirectoryA, PeekConsoleInputA, GetShortPathNameW, SetProcessShutdownParameters, GetDiskFreeSpaceExA, ReadConsoleInputW, DebugBreak, GetTempPathA, EnumCalendarInfoExA, LocalFree, TlsFree, CommConfigDialogW, WriteConsoleW, CloseHandle, FlushFileBuffers, GetConsoleMode, GetConsoleCP, HeapSize, EnumCalendarInfoW, GetLocaleInfoA, SetEndOfFile, GetConsoleAliasExesA, MultiByteToWideChar, HeapAlloc, GetLastError, HeapReAlloc, ExitProcess, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, GetCPInfo, InterlockedIncrement, GetACP, GetOEMCP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, GetCurrentThreadId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, HeapFree, IsProcessorFeaturePresent, WriteFile, GetStdHandle, HeapCreate, ReadFile, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, SetFilePointer, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringW, GetStringTypeW, Sleep, RaiseException, SetStdHandle, RtlUnwind, CreateFileW |
USER32.dll | GetMenuStringW, DrawStateA, LoadMenuW, GetWindowLongA, CharUpperW, GetSysColor, GetCaretPos, SetMenu |
GDI32.dll | CreateDCW, GetBitmapBits, GetCharWidthFloatA, GetCharWidth32A |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
Tamil | India | |
Tamil | Sri Lanka |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Sep 7, 2024 15:14:55.493493080 CEST | 49705 | 25 | 192.168.2.5 | 52.101.42.0 |
Sep 7, 2024 15:14:56.500251055 CEST | 49705 | 25 | 192.168.2.5 | 52.101.42.0 |
Sep 7, 2024 15:14:58.515916109 CEST | 49705 | 25 | 192.168.2.5 | 52.101.42.0 |
Sep 7, 2024 15:14:58.574218988 CEST | 49706 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:14:58.574270010 CEST | 443 | 49706 | 77.232.41.29 | 192.168.2.5 |
Sep 7, 2024 15:14:58.574362993 CEST | 49706 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:15:02.515858889 CEST | 49705 | 25 | 192.168.2.5 | 52.101.42.0 |
Sep 7, 2024 15:15:10.531486988 CEST | 49705 | 25 | 192.168.2.5 | 52.101.42.0 |
Sep 7, 2024 15:15:15.502469063 CEST | 49712 | 25 | 192.168.2.5 | 67.195.204.74 |
Sep 7, 2024 15:15:16.515852928 CEST | 49712 | 25 | 192.168.2.5 | 67.195.204.74 |
Sep 7, 2024 15:15:18.515850067 CEST | 49712 | 25 | 192.168.2.5 | 67.195.204.74 |
Sep 7, 2024 15:15:22.515793085 CEST | 49712 | 25 | 192.168.2.5 | 67.195.204.74 |
Sep 7, 2024 15:15:30.515762091 CEST | 49712 | 25 | 192.168.2.5 | 67.195.204.74 |
Sep 7, 2024 15:15:35.532682896 CEST | 49713 | 25 | 192.168.2.5 | 64.233.166.26 |
Sep 7, 2024 15:15:36.546994925 CEST | 49713 | 25 | 192.168.2.5 | 64.233.166.26 |
Sep 7, 2024 15:15:38.547022104 CEST | 49713 | 25 | 192.168.2.5 | 64.233.166.26 |
Sep 7, 2024 15:15:38.562834024 CEST | 49706 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:15:38.562897921 CEST | 443 | 49706 | 77.232.41.29 | 192.168.2.5 |
Sep 7, 2024 15:15:38.562975883 CEST | 49706 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:15:38.673190117 CEST | 49714 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:15:38.673239946 CEST | 443 | 49714 | 77.232.41.29 | 192.168.2.5 |
Sep 7, 2024 15:15:38.673321962 CEST | 49714 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:15:42.547060013 CEST | 49713 | 25 | 192.168.2.5 | 64.233.166.26 |
Sep 7, 2024 15:15:50.546967983 CEST | 49713 | 25 | 192.168.2.5 | 64.233.166.26 |
Sep 7, 2024 15:15:55.549953938 CEST | 49716 | 25 | 192.168.2.5 | 217.69.139.150 |
Sep 7, 2024 15:15:56.562762976 CEST | 49716 | 25 | 192.168.2.5 | 217.69.139.150 |
Sep 7, 2024 15:15:58.578284979 CEST | 49716 | 25 | 192.168.2.5 | 217.69.139.150 |
Sep 7, 2024 15:16:02.593909025 CEST | 49716 | 25 | 192.168.2.5 | 217.69.139.150 |
Sep 7, 2024 15:16:10.593833923 CEST | 49716 | 25 | 192.168.2.5 | 217.69.139.150 |
Sep 7, 2024 15:16:18.672368050 CEST | 49714 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:16:18.672439098 CEST | 443 | 49714 | 77.232.41.29 | 192.168.2.5 |
Sep 7, 2024 15:16:18.672523022 CEST | 49714 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:16:18.782577038 CEST | 49717 | 443 | 192.168.2.5 | 77.232.41.29 |
Sep 7, 2024 15:16:18.782610893 CEST | 443 | 49717 | 77.232.41.29 | 192.168.2.5 |
Sep 7, 2024 15:16:18.782674074 CEST | 49717 | 443 | 192.168.2.5 | 77.232.41.29 |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Sep 7, 2024 15:14:55.461682081 CEST | 54319 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:14:55.492765903 CEST | 53 | 54319 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:14:58.395411015 CEST | 57731 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:14:58.573323011 CEST | 53 | 57731 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:15.485579967 CEST | 62772 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:15.493833065 CEST | 53 | 62772 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:15.494482040 CEST | 63508 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:15.501846075 CEST | 53 | 63508 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:35.516355991 CEST | 62353 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:35.523921967 CEST | 53 | 62353 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:35.524554968 CEST | 53732 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:35.532021999 CEST | 53 | 53732 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:55.531979084 CEST | 51429 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:55.539191961 CEST | 53 | 51429 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:15:55.539833069 CEST | 55641 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:15:55.549460888 CEST | 53 | 55641 | 1.1.1.1 | 192.168.2.5 |
Sep 7, 2024 15:16:57.386473894 CEST | 55072 | 53 | 192.168.2.5 | 1.1.1.1 |
Sep 7, 2024 15:16:57.395345926 CEST | 53 | 55072 | 1.1.1.1 | 192.168.2.5 |
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|
Sep 7, 2024 15:14:55.461682081 CEST | 192.168.2.5 | 1.1.1.1 | 0x9b6e | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Sep 7, 2024 15:14:58.395411015 CEST | 192.168.2.5 | 1.1.1.1 | 0x15f6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Sep 7, 2024 15:15:15.485579967 CEST | 192.168.2.5 | 1.1.1.1 | 0x767 | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
Sep 7, 2024 15:15:15.494482040 CEST | 192.168.2.5 | 1.1.1.1 | 0xf1c7 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Sep 7, 2024 15:15:35.516355991 CEST | 192.168.2.5 | 1.1.1.1 | 0x9c37 | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
Sep 7, 2024 15:15:35.524554968 CEST | 192.168.2.5 | 1.1.1.1 | 0x669 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Sep 7, 2024 15:15:55.531979084 CEST | 192.168.2.5 | 1.1.1.1 | 0xda1e | Standard query (0) | MX (Mail exchange) | IN (0x0001) | false | |
Sep 7, 2024 15:15:55.539833069 CEST | 192.168.2.5 | 1.1.1.1 | 0xf5fc | Standard query (0) | A (IP address) | IN (0x0001) | false | |
Sep 7, 2024 15:16:57.386473894 CEST | 192.168.2.5 | 1.1.1.1 | 0xaf64 | Standard query (0) | A (IP address) | IN (0x0001) | false |
Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
---|---|---|---|---|---|---|---|---|---|---|
Sep 7, 2024 15:14:55.492765903 CEST | 1.1.1.1 | 192.168.2.5 | 0x9b6e | No error (0) | 52.101.42.0 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:14:55.492765903 CEST | 1.1.1.1 | 192.168.2.5 | 0x9b6e | No error (0) | 52.101.11.0 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:14:55.492765903 CEST | 1.1.1.1 | 192.168.2.5 | 0x9b6e | No error (0) | 52.101.40.26 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:14:55.492765903 CEST | 1.1.1.1 | 192.168.2.5 | 0x9b6e | No error (0) | 52.101.8.49 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:14:58.573323011 CEST | 1.1.1.1 | 192.168.2.5 | 0x15f6 | No error (0) | 77.232.41.29 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.493833065 CEST | 1.1.1.1 | 192.168.2.5 | 0x767 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
Sep 7, 2024 15:15:15.493833065 CEST | 1.1.1.1 | 192.168.2.5 | 0x767 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
Sep 7, 2024 15:15:15.493833065 CEST | 1.1.1.1 | 192.168.2.5 | 0x767 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 67.195.204.74 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 67.195.228.94 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 98.136.96.74 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 98.136.96.75 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 67.195.204.73 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 98.136.96.76 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 67.195.204.77 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:15.501846075 CEST | 1.1.1.1 | 192.168.2.5 | 0xf1c7 | No error (0) | 67.195.204.79 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:35.523921967 CEST | 1.1.1.1 | 192.168.2.5 | 0x9c37 | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
Sep 7, 2024 15:15:35.532021999 CEST | 1.1.1.1 | 192.168.2.5 | 0x669 | No error (0) | 64.233.166.26 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:35.532021999 CEST | 1.1.1.1 | 192.168.2.5 | 0x669 | No error (0) | 74.125.133.26 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:35.532021999 CEST | 1.1.1.1 | 192.168.2.5 | 0x669 | No error (0) | 74.125.71.27 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:35.532021999 CEST | 1.1.1.1 | 192.168.2.5 | 0x669 | No error (0) | 64.233.166.27 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:35.532021999 CEST | 1.1.1.1 | 192.168.2.5 | 0x669 | No error (0) | 74.125.71.26 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:55.539191961 CEST | 1.1.1.1 | 192.168.2.5 | 0xda1e | No error (0) | MX (Mail exchange) | IN (0x0001) | false | |||
Sep 7, 2024 15:15:55.549460888 CEST | 1.1.1.1 | 192.168.2.5 | 0xf5fc | No error (0) | 217.69.139.150 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:15:55.549460888 CEST | 1.1.1.1 | 192.168.2.5 | 0xf5fc | No error (0) | 94.100.180.31 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:16:57.395345926 CEST | 1.1.1.1 | 192.168.2.5 | 0xaf64 | No error (0) | 52.101.11.0 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:16:57.395345926 CEST | 1.1.1.1 | 192.168.2.5 | 0xaf64 | No error (0) | 52.101.40.26 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:16:57.395345926 CEST | 1.1.1.1 | 192.168.2.5 | 0xaf64 | No error (0) | 52.101.42.0 | A (IP address) | IN (0x0001) | false | ||
Sep 7, 2024 15:16:57.395345926 CEST | 1.1.1.1 | 192.168.2.5 | 0xaf64 | No error (0) | 52.101.8.49 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 09:14:49 |
Start date: | 07/09/2024 |
Path: | C:\Users\user\Desktop\874A7cigvX.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 409'088 bytes |
MD5 hash: | F7AE445081E10267D2CEC9B6B0E2D375 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 2 |
Start time: | 09:14:50 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\cmd.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x790000 |
File size: | 236'544 bytes |
MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 3 |
Start time: | 09:14:50 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 4 |
Start time: | 09:14:51 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\cmd.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x790000 |
File size: | 236'544 bytes |
MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 5 |
Start time: | 09:14:51 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 6 |
Start time: | 09:14:51 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\sc.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x380000 |
File size: | 61'440 bytes |
MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | moderate |
Has exited: | true |
Target ID: | 7 |
Start time: | 09:14:51 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 8 |
Start time: | 09:14:52 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\sc.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x380000 |
File size: | 61'440 bytes |
MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | moderate |
Has exited: | true |
Target ID: | 9 |
Start time: | 09:14:52 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 10 |
Start time: | 09:14:52 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\sc.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x380000 |
File size: | 61'440 bytes |
MD5 hash: | D9D7684B8431A0D10D0E76FE9F5FFEC8 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | moderate |
Has exited: | true |
Target ID: | 11 |
Start time: | 09:14:52 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 12 |
Start time: | 09:14:53 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\ycgeofkw\xvkslbws.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 11'205'632 bytes |
MD5 hash: | 702317DA74C3C1D30ED61EA3A7D7DFCD |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 13 |
Start time: | 09:14:53 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\netsh.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x1080000 |
File size: | 82'432 bytes |
MD5 hash: | 4E89A1A088BE715D6C946E55AB07C7DF |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 14 |
Start time: | 09:14:53 |
Start date: | 07/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6d64d0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Has exited: | true |
Target ID: | 15 |
Start time: | 09:14:54 |
Start date: | 07/09/2024 |
Path: | C:\Windows\SysWOW64\svchost.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xce0000 |
File size: | 46'504 bytes |
MD5 hash: | 1ED18311E3DA35942DB37D15FA40CC5B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Has exited: | false |
Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02679066 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35sleepfileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119sleepCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02610E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02610920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02678D25 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004088B0 Relevance: .1, Instructions: 108COMMON
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02678943 Relevance: .1, Instructions: 61COMMON
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02610D90 Relevance: .0, Instructions: 43COMMON
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02619EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02617CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02617A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 026114E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02617666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02611FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02613059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0261F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02612F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02616F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 026192CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 026199E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02616CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02616E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02617665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02619966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 026128EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 026169C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 026141F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
APIs |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0261E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02618330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0261E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0261AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02619452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 02613189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Yara matches |
Similarity |
|
Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadprocessinjectionCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0263248E Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D70E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D70920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0263214D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D79EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D77CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D77A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D714E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D77666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D71FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D73059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D72F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D799E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D76CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D76F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D76E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D793AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D728EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D769C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D741F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D78330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D7AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D79452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 02D73189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106memorylibraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85memorylibrarystringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FF26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FEBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FA7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F1280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON
APIs |
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON
APIs |
Strings |
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030FEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|
Function 030F2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON
APIs |
|
Memory Dump Source |
|
Yara matches |
Similarity |
|