Edit tour

Windows Analysis Report
doc_rfq Oferta KH 09281.pdf.com.exe

Overview

General Information

Sample name:	doc_rfq Oferta KH 09281.pdf.com.exe
Analysis ID:	1507753
MD5:	0994bce735fc8bb848d1431edf6338da
SHA1:	6862b41edee8d724004e9ada90d21289c3d45bef
SHA256:	6230049aca6cf64db37be7c35946481041629c4f40311f5a39ba45303bd992e7
Tags:	exe
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Quasar RAT

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

doc_rfq Oferta KH 09281.pdf.com.exe (PID: 6800 cmdline: "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

doc_rfq Oferta KH 09281.pdf.com.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

doc_rfq Oferta KH 09281.pdf.com.exe (PID: 5404 cmdline: "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

schtasks.exe (PID: 732 cmdline: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

workbook.exe (PID: 4960 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

workbook.exe (PID: 600 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

schtasks.exe (PID: 6412 cmdline: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

workbook.exe (PID: 5960 cmdline: C:\Users\user\AppData\Roaming\SubDir\workbook.exe MD5: 0994BCE735FC8BB848D1431EDF6338DA)

workbook.exe (PID: 6796 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

workbook.exe (PID: 7160 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

workbook.exe (PID: 1836 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 0994BCE735FC8BB848D1431EDF6338DA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;", "SubDirectory": "SubDir", "InstallName": "workbook.exe", "MutexName": "0235e291-5d04-4fa3-932c-869aeec51499", "StartupKey": "workbook", "Tag": "Long Leg", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 5404	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 4960	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 4960	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: workbook.exe PID: 5960	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 600	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.2e2a74c.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.workbook.exe.269a704.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef4d:$x1: Quasar.Common.Messages 0x29f276:$x1: Quasar.Common.Messages 0x2ab83a:$x4: Uninstalling... good bye :-( 0x2ad02f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadec:$f1: FileZilla\recentservers.xml 0x2aae2c:$f2: FileZilla\sitemanager.xml 0x2aae6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0ba:$b1: Chrome\User Data\ 0x2ab110:$b1: Chrome\User Data\ 0x2ab3e8:$b2: Mozilla\Firefox\Profiles 0x2ab4e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab63c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6f6:$b5: YandexBrowser\User Data\ 0x2ab764:$b5: YandexBrowser\User Data\ 0x2ab438:$s4: logins.json 0x2ab16e:$a1: username_value 0x2ab18c:$a2: password_value 0x2ab478:$a3: encryptedUsername 0x2fd384:$a3: encryptedUsername 0x2ab49c:$a4: encryptedPassword 0x2fd3a2:$a4: encryptedPassword 0x2fd320:$a5: httpRealm
3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab924:$s3: Process already elevated. 0x28ec4c:$s4: get_PotentiallyVulnerablePasswords 0x278d08:$s5: GetKeyloggerLogsDirectory 0x29e9d5:$s5: GetKeyloggerLogsDirectory 0x28ec6f:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d14d:$x1: Quasar.Common.Messages 0x29d476:$x1: Quasar.Common.Messages 0x2a9a3a:$x4: Uninstalling... good bye :-( 0x2ab22f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fec:$f1: FileZilla\recentservers.xml 0x2a902c:$f2: FileZilla\sitemanager.xml 0x2a906e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a92ba:$b1: Chrome\User Data\ 0x2a9310:$b1: Chrome\User Data\ 0x2a95e8:$b2: Mozilla\Firefox\Profiles 0x2a96e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb640:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a983c:$b4: Opera Software\Opera Stable\Login Data 0x2a98f6:$b5: YandexBrowser\User Data\ 0x2a9964:$b5: YandexBrowser\User Data\ 0x2a9638:$s4: logins.json 0x2a936e:$a1: username_value 0x2a938c:$a2: password_value 0x2a9678:$a3: encryptedUsername 0x2fb584:$a3: encryptedUsername 0x2a969c:$a4: encryptedPassword 0x2fb5a2:$a4: encryptedPassword 0x2fb520:$a5: httpRealm
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9b24:$s3: Process already elevated. 0x28ce4c:$s4: get_PotentiallyVulnerablePasswords 0x276f08:$s5: GetKeyloggerLogsDirectory 0x29cbd5:$s5: GetKeyloggerLogsDirectory 0x28ce6f:$s6: set_PotentiallyVulnerablePasswords 0x2fcc6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef4d:$x1: Quasar.Common.Messages 0x29f276:$x1: Quasar.Common.Messages 0x5ac36d:$x1: Quasar.Common.Messages 0x5bc696:$x1: Quasar.Common.Messages 0x2ab83a:$x4: Uninstalling... good bye :-( 0x5c8c5a:$x4: Uninstalling... good bye :-( 0x2ad02f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ... 0x5ca44f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadec:$f1: FileZilla\recentservers.xml 0x5c820c:$f1: FileZilla\recentservers.xml 0x2aae2c:$f2: FileZilla\sitemanager.xml 0x5c824c:$f2: FileZilla\sitemanager.xml 0x2aae6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5c828e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0ba:$b1: Chrome\User Data\ 0x2ab110:$b1: Chrome\User Data\ 0x5c84da:$b1: Chrome\User Data\ 0x5c8530:$b1: Chrome\User Data\ 0x2ab3e8:$b2: Mozilla\Firefox\Profiles 0x5c8808:$b2: Mozilla\Firefox\Profiles 0x2ab4e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5c8904:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x61a860:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab63c:$b4: Opera Software\Opera Stable\Login Data 0x5c8a5c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6f6:$b5: YandexBrowser\User Data\ 0x2ab764:$b5: YandexBrowser\User Data\ 0x5c8b16:$b5: YandexBrowser\User Data\
0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x482336:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab924:$s3: Process already elevated. 0x5c8d44:$s3: Process already elevated. 0x28ec4c:$s4: get_PotentiallyVulnerablePasswords 0x5ac06c:$s4: get_PotentiallyVulnerablePasswords 0x278d08:$s5: GetKeyloggerLogsDirectory 0x29e9d5:$s5: GetKeyloggerLogsDirectory 0x596128:$s5: GetKeyloggerLogsDirectory 0x5bbdf5:$s5: GetKeyloggerLogsDirectory 0x28ec6f:$s6: set_PotentiallyVulnerablePasswords 0x5ac08f:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x61be8e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\workbook.exe, ParentProcessId: 600, ParentProcessName: workbook.exe, ProcessCommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, ProcessId: 6412, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe", ParentImage: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe, ParentProcessId: 5404, ParentProcessName: doc_rfq Oferta KH 09281.pdf.com.exe, ProcessCommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, ProcessId: 732, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T08:54:04.270441+0200	2035595	1	Domain Observed Used for C2 Detected	213.159.74.80	9792	192.168.2.4	49735	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T08:54:04.270441+0200	2027619	1	Domain Observed Used for C2 Detected	213.159.74.80	9792	192.168.2.4	49735	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;", "SubDirectory": "SubDir", "InstallName": "workbook.exe", "MutexName": "0235e291-5d04-4fa3-932c-869aeec51499", "StartupKey": "workbook", "Tag": "Long Leg", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Multi AV Scanner detection for domain / URL

Source: twart.myfirewall.org	Virustotal: Detection: 10%			Perma Link
Source: twart.myfirewall.org	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: doc_rfq Oferta KH 09281.pdf.com.exe	ReversingLabs: Detection: 26%
Source: doc_rfq Oferta KH 09281.pdf.com.exe	Virustotal: Detection: 32%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.2e2a74c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.269a704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 600, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Joe Sandbox ML: detected

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 213.159.74.80:9792 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 213.159.74.80:9792 -> 192.168.2.4:49735

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: twart.myfirewall.org

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 213.159.74.80:9792

Source: Joe Sandbox View	IP Address: 213.159.74.80 213.159.74.80
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: CTINET-ASCTINETAutonomousSystemRU CTINET-ASCTINETAutonomousSystemRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: twart.myfirewall.org
Source: global traffic	DNS traffic detected: DNS query: ipwho.is

Source: workbook.exe, 00000008.00000002.4143910729.0000000006575000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: workbook.exe, 00000008.00000002.4141849869.0000000005E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/d8/
Source: workbook.exe, 00000008.00000002.4124867943.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: workbook.exe, 00000008.00000002.4124867943.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: workbook.exe, 00000008.00000002.4141849869.0000000005E96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/y8
Source: workbook.exe, 00000008.00000002.4127288420.00000000037F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: workbook.exe, 00000008.00000002.4127288420.00000000037F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: workbook.exe, 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: workbook.exe, 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1708803322.0000000003331000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4127288420.00000000035EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688402907.0000000005E74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: workbook.exe, 00000008.00000002.4127288420.00000000037E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4127288420.00000000037E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4127288420.00000000035F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.2e2a74c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.269a704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 600, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: doc_rfq Oferta KH 09281.pdf.com.exe
Source: initial sample	Static PE information: Filename: doc_rfq Oferta KH 09281.pdf.com.exe

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_00F6D5BC	0_2_00F6D5BC
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DC7470	0_2_02DC7470
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DC0040	0_2_02DC0040
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DC0007	0_2_02DC0007
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DC7460	0_2_02DC7460
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E424A8	0_2_04E424A8
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E4B470	0_2_04E4B470
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E454B0	0_2_04E454B0
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E42499	0_2_04E42499
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E45078	0_2_04E45078
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E45D20	0_2_04E45D20
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E45D10	0_2_04E45D10
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E458E8	0_2_04E458E8
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E458D8	0_2_04E458D8
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E47868	0_2_04E47868
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 3_2_0329F03C	3_2_0329F03C
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_00C0D5BC	6_2_00C0D5BC
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B24A8	6_2_046B24A8
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046BB380	6_2_046BB380
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B54B0	6_2_046B54B0
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B2499	6_2_046B2499
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B5078	6_2_046B5078
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B5D20	6_2_046B5D20
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B5D1A	6_2_046B5D1A
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B7868	6_2_046B7868
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B58E8	6_2_046B58E8
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_04C47470	6_2_04C47470
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_04C40040	6_2_04C40040
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_04C40006	6_2_04C40006
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_04C47463	6_2_04C47463
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_015ED5BC	7_2_015ED5BC
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F724A8	7_2_04F724A8
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F7B470	7_2_04F7B470
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F754B0	7_2_04F754B0
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F72499	7_2_04F72499
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F75078	7_2_04F75078
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F7505F	7_2_04F7505F
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F75D20	7_2_04F75D20
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F75D1A	7_2_04F75D1A
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F758E8	7_2_04F758E8
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F77868	7_2_04F77868
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 8_2_033CF03C	8_2_033CF03C
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 8_2_0858B2C0	8_2_0858B2C0
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 8_2_08587E48	8_2_08587E48
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_01B5F03C	13_2_01B5F03C
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_05BE20D0	13_2_05BE20D0
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_05BE9068	13_2_05BE9068
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_05BE0518	13_2_05BE0518
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_05BE0508	13_2_05BE0508
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 13_2_05BE9EE0	13_2_05BE9EE0

Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1679006437.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1680827727.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688081822.00000000055D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_rfq Oferta KH 09281.pdf.com.exe
Source: doc_rfq Oferta KH 09281.pdf.com.exe	Binary or memory string: OriginalFilenameLwaF.exe@ vs doc_rfq Oferta KH 09281.pdf.com.exe

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: doc_rfq Oferta KH 09281.pdf.com.exe, workbook.exe.3.dr

Binary or memory string: *.slnEError processing directory {0} {1}#Deleting file {0}%Modifying file {0}=Unable to Delete file {0}. {1}.tmpWGlobalSection(TeamFoundationVersionControl)!EndGlobalSection

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/5@2/2

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_rfq Oferta KH 09281.pdf.com.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\0235e291-5d04-4fa3-932c-869aeec51499
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: doc_rfq Oferta KH 09281.pdf.com.exe	ReversingLabs: Detection: 26%
Source: doc_rfq Oferta KH 09281.pdf.com.exe	Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

File read: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static file information: File size 3706880 > 1048576

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x387a00

Source: doc_rfq Oferta KH 09281.pdf.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: doc_rfq Oferta KH 09281.pdf.com.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: workbook.exe.3.dr, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DCB234 push ebx; iretd	0_2_02DCB256
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_02DCB22F push ebx; iretd	0_2_02DCB233
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Code function: 0_2_04E4893E pushfd ; iretd	0_2_04E48949
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_046B893E pushfd ; iretd	6_2_046B8949
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_04F7893E pushfd ; iretd	7_2_04F78949

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

File created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	File opened: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\workbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\workbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 4960, type: MEMORYSTR

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 4DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 8910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 7620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 9C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: AC70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: B040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 4650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 7CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 8CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 9210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A5B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 15A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 4F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 83B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 93B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 98E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A8E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: AC70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 35C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 3320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 1B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 36F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 3600000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Window / User API: threadDelayed 5166			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Window / User API: threadDelayed 4429			Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe TID: 6840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe TID: 736	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 8	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7128	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 736	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: workbook.exe, 00000008.00000002.4143910729.0000000006575000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxg
Source: workbook.exe, 00000008.00000002.4141849869.0000000005EFD000.00000004.00000020.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4143910729.0000000006575000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Memory written: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\workbook.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\workbook.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process created: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process created: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe "C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.2e2a74c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.269a704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 600, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.2e2a74c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.269a704.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.doc_rfq Oferta KH 09281.pdf.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_rfq Oferta KH 09281.pdf.com.exe.415c738.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_rfq Oferta KH 09281.pdf.com.exe PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 4960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 5960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 600, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
doc_rfq Oferta KH 09281.pdf.com.exe	26%	ReversingLabs	Win32.Trojan.Generic
doc_rfq Oferta KH 09281.pdf.com.exe	100%	Joe Sandbox ML
doc_rfq Oferta KH 09281.pdf.com.exe	33%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\SubDir\workbook.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SubDir\workbook.exe	26%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
ipwho.is	0%	Virustotal	Browse
twart.myfirewall.org	10%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designersG	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://www.fontbureau.com	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/?	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/14436606/23354	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designersG	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.fontbureau.com	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
https://api.ipify.org/	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.fontbureau.com/designers/?	0%	Virustotal		Browse
https://stackoverflow.com/q/14436606/23354	0%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/	0%	Virustotal		Browse
http://www.fontbureau.com/designers?	0%	Avira URL Cloud	safe
http://ipwho.isd	0%	Avira URL Cloud	safe
twart.myfirewall.org	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers?	0%	Virustotal		Browse
http://www.goodfont.co.kr	0%	Avira URL Cloud	safe
http://crl.microsoft.	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers	0%	Virustotal		Browse
http://www.typography.netD	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	Virustotal		Browse
http://www.goodfont.co.kr	0%	Virustotal		Browse
http://crl.microsoft.	0%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/d	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
twart.myfirewall.org	10%	Virustotal		Browse
http://www.sajatypeworks.com	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/d	0%	Virustotal		Browse
http://www.fontbureau.com/designers/frere-user.html	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/11564914/23354;	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	Virustotal		Browse
https://ipwho.is	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/11564914/23354;	0%	Virustotal		Browse
http://www.galapagosdesign.com/DPlease	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers8	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/frere-user.html	0%	Virustotal		Browse
http://www.fonts.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	Virustotal		Browse
http://www.sandoll.co.kr	0%	Avira URL Cloud	safe
https://ipwho.is	0%	Virustotal		Browse
http://www.fontbureau.com/designers8	0%	Virustotal		Browse
http://www.galapagosdesign.com/DPlease	0%	Virustotal		Browse
http://www.urwpp.deDPlease	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/2152978/23354sCannot	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.fonts.com	0%	Virustotal		Browse
http://www.sakkal.com	0%	Avira URL Cloud	safe
http://ipwho.is	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Virustotal		Browse
https://stackoverflow.com/q/2152978/23354sCannot	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	0%	Virustotal		Browse
http://www.sakkal.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
ipwho.is	195.201.57.90	true	false	0%, Virustotal, Browse	unknown
twart.myfirewall.org	213.159.74.80	true	true	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
twart.myfirewall.org	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipwho.is/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4127288420.00000000035F2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	workbook.exe, 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ipwho.isd	workbook.exe, 00000008.00000002.4127288420.00000000037F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microsoft.	workbook.exe, 00000008.00000002.4143910729.0000000006575000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.typography.netD	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/d	workbook.exe, 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipwho.is	workbook.exe, 00000008.00000002.4127288420.00000000037E2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fonts.com	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	doc_rfq Oferta KH 09281.pdf.com.exe, 00000003.00000002.1708803322.0000000003331000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000008.00000002.4127288420.00000000035EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688443419.0000000006F42000.00000004.00000800.00020000.00000000.sdmp, doc_rfq Oferta KH 09281.pdf.com.exe, 00000000.00000002.1688402907.0000000005E74000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ipwho.is	workbook.exe, 00000008.00000002.4127288420.00000000037F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.159.74.80	twart.myfirewall.org	Russian Federation		13078	CTINET-ASCTINETAutonomousSystemRU	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507753
Start date and time:	2024-09-09 08:53:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	doc_rfq Oferta KH 09281.pdf.com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 198 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:53:54	API Interceptor	1x Sleep call for process: doc_rfq Oferta KH 09281.pdf.com.exe modified
02:53:58	API Interceptor	11275202x Sleep call for process: workbook.exe modified
07:53:58	Task Scheduler	Run new task: workbook path: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
213.159.74.80	Client.exe	Get hash	malicious	Quasar	Browse
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	bin homebots io.bat	Get hash	malicious	Unknown	Browse	195.201.57.90
	yJrZoOsgfl.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	IMKssbDprn.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	WBmC56ADQF.lnk	Get hash	malicious	Unknown	Browse	195.201.57.90
	uScqjqUS1m.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	CVSIyqGKKK.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	Client.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	AdjustLoader.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	108.181.98.179
bg.microsoft.map.fastly.net	pko_trans_details_20240909_105339#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	199.232.214.172
	https://go.skimresources.com/?id=129857X1600501&url=https://www.freelancer.com/users/login-quick.php?token=30b3628412ea618dcc3f414b266ae263302b3e1b43e6d2d885225319dabe8e68&url=https://secure.adnxs.com/seg?redir=https://link.sbstck.com/redirect/c16392c5-3f33-44df-b0b3-21de244d07c1?j=eyJ1IjoiNGRnZ2x2In0.IkG1h6SLHR3lrFyuSAoQTcZBzKZHtH4uVLaC9IQ4Uu8	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Quotation-Invitation28252-09yzak_1_cdcon.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://onlinesecuritycheck.weebly.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://rakften.click/	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://rdr-centru.blogspot.nl/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://seoservicesiox.firebaseapp.com/0.08157749367335065%22%7D	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://abhishekch20.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	http://kjkesd.godaddysites.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://pub-d32e1723091e4c74b19f3caea6a4ed0a.r2.dev/qiye-revised/index.html	Get hash	malicious	Unknown	Browse	199.232.210.172
twart.myfirewall.org	Client.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse	213.159.74.80
	doc_RFQ NEW ORDER #2400228341.pdf.exe	Get hash	malicious	AsyncRAT	Browse	41.151.251.119
	doc_Rfq_TNTM #U00daj rend TM00002916620 exp_pdf.exe	Get hash	malicious	XWorm	Browse	103.35.191.158
	6KfY269eO6.exe	Get hash	malicious	LodaRAT	Browse	103.35.191.158
	#U00daj megrendel#U00e9s - 00905173088 CPTL #U00e1raj#U00e1nlat - egyenk#U00e9nt 100.exe	Get hash	malicious	MailPassView, XpertRAT	Browse	103.35.191.158

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	Quotation.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	135.181.160.46
	uD9I18eLZ6.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, RedLine, zgRAT	Browse	116.203.232.114
	http://pratikg7028.github.io/Task4	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	IDMan.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	IDMan.exe	Get hash	malicious	Fredy Stealer	Browse	5.161.243.5
	FZ6oyLoqGM.exe	Get hash	malicious	Unknown	Browse	159.69.88.171
	bin homebots io.bat	Get hash	malicious	Unknown	Browse	195.201.57.90
	yJrZoOsgfl.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	WBmC56ADQF.lnk	Get hash	malicious	Unknown	Browse	195.201.57.90
	uScqjqUS1m.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
CTINET-ASCTINETAutonomousSystemRU	Client.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse	213.159.74.80
	yEL4yMV0s4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	213.159.64.146
	AGREEMENT AND APPROVAL REPORT FECRWY RN & FR OF 2024-501144_6.5.24.pdf	Get hash	malicious	HTMLPhisher	Browse	213.159.64.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Quotation.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	pko_trans_details_20240909_105339#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	195.201.57.90
	SKT ____202409_____6__.vbs	Get hash	malicious	Remcos, GuLoader	Browse	195.201.57.90
	filz.exe	Get hash	malicious	FormBook	Browse	195.201.57.90
	waybill_original_invoice_bl_packinglist_shipment_09_09_2024_0000000000000000000000000000_pdf.bat	Get hash	malicious	Remcos, GuLoader	Browse	195.201.57.90
	SecuriteInfo.com.Trojan.Packed2.47861.5875.12260.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	rfqlastquaterproductpurchaseorderimportlist09.bat	Get hash	malicious	GuLoader, Remcos	Browse	195.201.57.90
	Report Of Special Working Allowance (Eng) Aug 2024_xls.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	Zaplata_06092024,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	MV XINHONG PARTICULARS.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.233401259015598
Encrypted:	false
SSDEEP:	6:kKv2L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:H7DImsLNkPlE99SNxAhUe/3
MD5:	94CC5A6A995B73E00098B040539CD899
SHA1:	C2F9A729E596B0D4F463101B1EC8481ABAE64DC4
SHA-256:	E3F0EA6FB63E71A8E091924B7A8913365693DD008715437CDA956F8607AA4123
SHA-512:	E5648F96CEB0A3D02EFFC3BC0C7F7DA2B6727FA839C469DAACDBF49D55D41DD399B3B06004C02FFBB14F9A1419821A87644D6A77F4BDFD99380EA5F39967DF80
Malicious:	false
Reputation:	low
Preview:	p...... ........$%.m....(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_rfq Oferta KH 09281.pdf.com.exe.log

Download File

Process:	C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\workbook.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Download File

Process:	C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3706880
Entropy (8bit):	7.991618423681647
Encrypted:	true
SSDEEP:	98304:JrDJO6ifOJhQGiwCa98Grb6PFMPhQCMmgu1gGHO1P:HOzfOJhBLCaHrk8rbfH6P
MD5:	0994BCE735FC8BB848D1431EDF6338DA
SHA1:	6862B41EDEE8D724004E9ADA90D21289C3D45BEF
SHA-256:	6230049ACA6CF64DB37BE7C35946481041629C4F40311F5A39BA45303BD992E7
SHA-512:	D6D85070BF3DA5DCFF34444C5E5DFB5FB38826852A71FFACDD988E016F620CF01ACD1C7282A6D6615150D966D01C9BE1C2477148A22D61DC18C8AFFB264E00AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....S.f..............0..z8.........Z.8.. ....8...@.. ........................8...........@...................................8.O.....8.......................8...................................................... ............... ..H............text...`x8.. ...z8................. ..`.rsrc.........8......\|8.............@..@.reloc........8.......8.............@..B................<.8.....H.......x?..X6......L....u..8"8............................................}.......}.......}.....(.......(......0..+.........,..{.......+....,...{....o........(.....V..s....}......(.....*....0............(....s....}.....(....s....}.....#........#........s+...s)...}.....s....}.....s....}.....s....}.....(................#........( .....#......$@( ...(......r...p...#.......?( .....#.......@( ...(......r...p...#.......@( .....#.......@( ...(......r...p...#.......@( .....#......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.991618423681647
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	doc_rfq Oferta KH 09281.pdf.com.exe
File size:	3'706'880 bytes
MD5:	0994bce735fc8bb848d1431edf6338da
SHA1:	6862b41edee8d724004e9ada90d21289c3d45bef
SHA256:	6230049aca6cf64db37be7c35946481041629c4f40311f5a39ba45303bd992e7
SHA512:	d6d85070bf3da5dcff34444c5e5dfb5fb38826852a71ffacdd988e016f620cf01acd1c7282a6d6615150d966d01c9be1c2477148a22d61dc18c8affb264e00ab
SSDEEP:	98304:JrDJO6ifOJhQGiwCa98Grb6PFMPhQCMmgu1gGHO1P:HOzfOJhBLCaHrk8rbfH6P
TLSH:	980633D59B29E12AC749133E4931E1379E355E6EF006A30EC7CEFCD7398B2563A58848
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....S.f..............0..z8.........Z.8.. ....8...@.. ........................8...........@................................

File Icon


Icon Hash:	4c9f33415113864d

Static PE Info

General

Entrypoint:	0x78985a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DE5316 [Mon Sep 9 01:44:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x389808	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38a000	0x10f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x387860	0x387a00	4c37bdb0378ef42675d059ddfb905d63	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x38a000	0x10f8	0x1200	ad76c0419b443ad6414b4e417aa5b04c	False	0.7788628472222222	data	6.813404574685928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38c000	0xc	0x200	9259fa573e8be89dee32890977ea1ac9	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x38a0c8	0xc92	PNG image data, 224 x 224, 8-bit/color RGBA, non-interlaced	0.9608452454940957
RT_GROUP_ICON	0x38ad6c	0x14	data	1.15
RT_VERSION	0x38ad90	0x364	data	0.4412442396313364

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-09T08:54:04.270441+0200	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	213.159.74.80	9792	192.168.2.4	49735	TCP
2024-09-09T08:54:04.270441+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	213.159.74.80	9792	192.168.2.4	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 08:54:03.375933886 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:03.380857944 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:03.380934954 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:03.386662006 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:03.391515970 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:04.257688999 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:04.257709026 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:04.257826090 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:04.265639067 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:04.270441055 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:04.615153074 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:04.713011026 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:05.576601028 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:05.576647043 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:05.576716900 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:05.578449965 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:05.578465939 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.445775032 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.445857048 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:06.450097084 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:06.450110912 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.450359106 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.455606937 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:06.500499010 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.652107000 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.652198076 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 9, 2024 08:54:06.652543068 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:06.760364056 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 9, 2024 08:54:06.964142084 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:06.969228029 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:06.969296932 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:06.974375963 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:07.095206022 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:07.182090998 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:07.182194948 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:32.197448015 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:32.202363014 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:54:57.213125944 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:54:57.219733000 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:55:22.228847027 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:55:22.234184980 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:55:47.244429111 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:55:47.249363899 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:56:12.260073900 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:56:12.265010118 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:56:37.275751114 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:56:37.281558037 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:57:02.287677050 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:57:02.292618990 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:57:27.307085037 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:57:27.312212944 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 9, 2024 08:57:52.322737932 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 9, 2024 08:57:52.327620029 CEST	9792	49735	213.159.74.80	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 08:54:03.350178003 CEST	63665	53	192.168.2.4	1.1.1.1
Sep 9, 2024 08:54:03.362927914 CEST	53	63665	1.1.1.1	192.168.2.4
Sep 9, 2024 08:54:05.566492081 CEST	59671	53	192.168.2.4	1.1.1.1
Sep 9, 2024 08:54:05.573278904 CEST	53	59671	1.1.1.1	192.168.2.4
Sep 9, 2024 08:54:14.892574072 CEST	53	61399	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 9, 2024 08:54:03.350178003 CEST	192.168.2.4	1.1.1.1	0x12fa	Standard query (0)	twart.myfirewall.org	A (IP address)	IN (0x0001)	false
Sep 9, 2024 08:54:05.566492081 CEST	192.168.2.4	1.1.1.1	0x3a11	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 9, 2024 08:54:03.362927914 CEST	1.1.1.1	192.168.2.4	0x12fa	No error (0)	twart.myfirewall.org	213.159.74.80	A (IP address)	IN (0x0001)	false
Sep 9, 2024 08:54:04.721565008 CEST	1.1.1.1	192.168.2.4	0x1b9b	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 9, 2024 08:54:04.721565008 CEST	1.1.1.1	192.168.2.4	0x1b9b	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 9, 2024 08:54:05.573278904 CEST	1.1.1.1	192.168.2.4	0x3a11	No error (0)	ipwho.is	195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	195.201.57.90	443	600	C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-09 06:54:06 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-09-09 06:54:06 UTC	223	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 06:54:06 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-09-09 06:54:06 UTC	1019	IN	Data Raw: 33 65 66 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 Data Ascii: 3ef{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.33", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yor

Target ID:	0
Start time:	02:53:53
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe"
Imagebase:	0x6a0000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1680827727.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1692611454.0000000008911000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1681979802.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:53:55
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe"
Imagebase:	0x2b0000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:53:55
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\doc_rfq Oferta KH 09281.pdf.com.exe"
Imagebase:	0xbf0000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1695939479.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1695939479.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:53:57
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Imagebase:	0x5a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:53:57
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:53:57
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x40000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1733061397.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1724896917.000000000269A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:53:58
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Imagebase:	0x7ff7699e0000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1810220246.00000000045A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1771103939.0000000002F6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:53:59
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0xe90000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000008.00000002.4127288420.0000000003841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:54:01
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Imagebase:	0x5a0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:54:01
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:54:04
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x330000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:54:04
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x250000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:54:04
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0xf90000
File size:	3'706'880 bytes
MD5 hash:	0994BCE735FC8BB848D1431EDF6338DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	299
Total number of Limit Nodes:	8

Executed Functions

Function 02DC7470 Relevance: 2.8, Strings: 1, Instructions: 1528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ppkq, xrefs: 02DC7CF3

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID: Ppkq
API String ID: 0-531843880
Opcode ID: 5cdd3de59b65f7dc6c6ab8a306d4b9cf4b0595533b5af8553500177cc0e12fb3
Instruction ID: bbe6ef3160117042ae6b80b5214bc2b2ea7fb86e1dd5eac718dbf8d7df310ce9
Opcode Fuzzy Hash: 5cdd3de59b65f7dc6c6ab8a306d4b9cf4b0595533b5af8553500177cc0e12fb3
Instruction Fuzzy Hash: 12F2C834A4121ACFDB24EF64C998AD9B7B2FF89300F1041E9D409AB365DB31AE85CF50

Function 02DC7460 Relevance: 2.7, Strings: 1, Instructions: 1406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ppkq, xrefs: 02DC7CF3

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID: Ppkq
API String ID: 0-531843880
Opcode ID: fe2cbe0959e57a77a0c8244b6edb17562d5289128334130316792c6725f10daa
Instruction ID: c9fa09f4c44b9e5d1cb0419903e22273e29c46ec40dfb03411d141b8c7da81e8
Opcode Fuzzy Hash: fe2cbe0959e57a77a0c8244b6edb17562d5289128334130316792c6725f10daa
Instruction Fuzzy Hash: 9AE2C834A4121ACFDB24EF64C998A99B7F6FF89300F1141E9E4096B365DB31AE85CF50

Function 04E4B470 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215698e3e03add10ed3a38c85d35c5e890182004cdbf8098c5793b621f218a75
Instruction ID: f6a679322c44304ca034700fd114270ecc526947c6cd840529426249abb48748
Opcode Fuzzy Hash: 215698e3e03add10ed3a38c85d35c5e890182004cdbf8098c5793b621f218a75
Instruction Fuzzy Hash: B6E1BC71B016049FEB29DB76D850BAEB7FAAFC9304F14446DE145AB291DB38F801CB51

Function 04E42499 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e6c00fbbabcb7b34a4b3dfe54cf548bd135650202b54df249c410d0acf3912
Instruction ID: 4be182d5064e6e1cf2268e26676cb7e84e7b80ab5820e47f12dc6b5506307593
Opcode Fuzzy Hash: 94e6c00fbbabcb7b34a4b3dfe54cf548bd135650202b54df249c410d0acf3912
Instruction Fuzzy Hash: BA21B9B1D056188BEB18CF97D8453DEBBF2AFC8300F14D16AD508A6255DB7409468F50

Function 04E424A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72783250c801181df80ffe1a08eb7f6e1d079619fcb9eceb1a7ea868bb51b3a
Instruction ID: d2f821f84ba5f3e7a5af299e35f21b7b33bd06665fd5a74de4d579145b544e3a
Opcode Fuzzy Hash: b72783250c801181df80ffe1a08eb7f6e1d079619fcb9eceb1a7ea868bb51b3a
Instruction Fuzzy Hash: 1F21E7B0E046188BEB18CF9BD8443DEFBF7AFC8300F14D06AE50866264EB7419458F90

Function 00F6D031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F6D0BE
GetCurrentThread.KERNEL32 ref: 00F6D0FB
GetCurrentProcess.KERNEL32 ref: 00F6D138
GetCurrentThreadId.KERNEL32 ref: 00F6D191

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ddabb1fbf6d152ab9eb1bd80ac8e38e6e81a4a9f9f569b5b7ad9b1e71eeba297
Instruction ID: 27693461ea1907b4e096564312dde7bdec73c6489564f27011636a9fe0475f79
Opcode Fuzzy Hash: ddabb1fbf6d152ab9eb1bd80ac8e38e6e81a4a9f9f569b5b7ad9b1e71eeba297
Instruction Fuzzy Hash: BD5156B0E002498FDB14DFA9D948B9EBBF1AF88314F20C459E409A73A1D7759D84CF65

Function 00F6D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F6D0BE
GetCurrentThread.KERNEL32 ref: 00F6D0FB
GetCurrentProcess.KERNEL32 ref: 00F6D138
GetCurrentThreadId.KERNEL32 ref: 00F6D191

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 067f59585c4e4469147dbe01e22f364e2715f7a82e0920ff219bcfd1deb8a4f9
Instruction ID: 346304bdaec8a07d030deb28cf93dc603ad3eb64c0176788579255871dc7fcc6
Opcode Fuzzy Hash: 067f59585c4e4469147dbe01e22f364e2715f7a82e0920ff219bcfd1deb8a4f9
Instruction Fuzzy Hash: 1E5155B0E002098FDB14DFA9D548BDEBBF1AF88314F20C459E419A7361D7759984CF65

Function 04E484B4 Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E486F6

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4d94c05022b69f0ece562a26b58f780ed7973c983abf16ce02d7f70460024dc4
Instruction ID: d9350eeeb0a7ab0601f1f8572580adb8d7fb15513a745920ade954cf77d51d03
Opcode Fuzzy Hash: 4d94c05022b69f0ece562a26b58f780ed7973c983abf16ce02d7f70460024dc4
Instruction Fuzzy Hash: 3FA17B75D002199FEB10DFA9D8407EDBBB2FF88314F1485A9E808A7290DB74A985CF91

Function 04E484C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04E486F6

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ce7c4340f639fc98248a4df933385bf2b64069cf3ed3aeb8f0cf733c0a72d339
Instruction ID: bc85a6793ffcd3031844caaa326a99e569b9a1b3f4a9d1cd2fb680270eb2d1f5
Opcode Fuzzy Hash: ce7c4340f639fc98248a4df933385bf2b64069cf3ed3aeb8f0cf733c0a72d339
Instruction Fuzzy Hash: B1917A75D00219DFEF20DFA9D8407EDBBB2BF88314F0485A9E808A7250DB74A985CF91

Function 00F6ADA8 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F6AFFE

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c696ce6b6aefd757d448f7a87a73dbbacc7f68991946b4aa08dd45f398716dd4
Instruction ID: 9e8367e228583a1bacbc7caf2a03ff385d3a2269f3705f0934c70e841259cc91
Opcode Fuzzy Hash: c696ce6b6aefd757d448f7a87a73dbbacc7f68991946b4aa08dd45f398716dd4
Instruction Fuzzy Hash: 6D8135B0A00B059FD724DF2AC44179ABBF5BF88314F008A2DD096ABA51D775E849DF91

Function 02DC18E4 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DC1A02

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: abd5be2acbff7b54b8e1c905ceeff52b7811c7173b72287fd893e2a8857e8e22
Instruction ID: 5362b1f5e25d910a89530d2c3b99766a5fface3ab40765d5cc82b2520f01c88d
Opcode Fuzzy Hash: abd5be2acbff7b54b8e1c905ceeff52b7811c7173b72287fd893e2a8857e8e22
Instruction Fuzzy Hash: CA51E0B1D003199FDB14CF99C984ADEBFB5BF48310F24822AE819AB261D7719985CF90

Function 02DC18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02DC1A02

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 77cf24a2e593be6cf2d169097975258d2f779e7d58f756776890d7596bc3aba3
Instruction ID: a3606f67eb1c46e26eeeeaa311bdd832e81964b67b74558a7df306ff6af48dd7
Opcode Fuzzy Hash: 77cf24a2e593be6cf2d169097975258d2f779e7d58f756776890d7596bc3aba3
Instruction Fuzzy Hash: 8D41C0B1D003199FDB14CF99C984ADEBBF5BF48310F24812AE819AB221D7719985CF90

Function 00F6590C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F659C9

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ba78a9fdb219f3a07cc8f21305a2fc2e27fd7085b80ffea55c1126b6631a112c
Instruction ID: c3d7ff45f81f8b002f61f00d2bffae94ef3719bc2b293e48aeae8c5c2a54bf36
Opcode Fuzzy Hash: ba78a9fdb219f3a07cc8f21305a2fc2e27fd7085b80ffea55c1126b6631a112c
Instruction Fuzzy Hash: 7A41F1B0C00619CBDB24DFA9C884BCDBBF6BF49704F24819AD408BB255DB75598ACF90

Function 00F644C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00F659C9

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4b7e1e5b1977f65b199cd62f00d675c2c6b11572483f278990dab386e9bac760
Instruction ID: f72d15c3d2ce4fc57e32f089eee897de7dc54e65f6be8a811c40f83174e7d986
Opcode Fuzzy Hash: 4b7e1e5b1977f65b199cd62f00d675c2c6b11572483f278990dab386e9bac760
Instruction Fuzzy Hash: D141D2B0C0061DDBDB24DFA9C88479EBBF6BF48704F24815AD408BB255DB759945CF90

Function 02DC4040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 02DC4101

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: aa05f391bb699f332480219387e9483a001060b2139ef37904556b2cd5ff6c41
Instruction ID: 10db3d0bf42adb7c911b548d6ea6aa3691669fd479adeb983d09f8e32c46d4b4
Opcode Fuzzy Hash: aa05f391bb699f332480219387e9483a001060b2139ef37904556b2cd5ff6c41
Instruction Fuzzy Hash: A841E8B5A00305CFDB14CF99C448AAABBF5FB88314F24C499D559AB361D775A841CFA0

Function 04E47C99 Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04E47D1E

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 24a0ef3ce03a00633390a66002622348576a783c0202d4a6b9b5f5c35b62e3ad
Instruction ID: 6b8677b6267ff69364c7170b704b7ff1b5127bbe58dedf99016d1d1b5ef93240
Opcode Fuzzy Hash: 24a0ef3ce03a00633390a66002622348576a783c0202d4a6b9b5f5c35b62e3ad
Instruction Fuzzy Hash: 73218B719003488FDB10CFAAC4857EEBFF4EF89324F10846AD495A7251D738A545CF94

Function 04E47E30 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04E47EC8

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5102c16a1a3dd0c59ed62d3adc38dd38ca5faff1d901bc8702fb7e6328f7cb4f
Instruction ID: 0d2c633a977007cc62ffb73af29f6e9bccdbb7b7da97a4419984cf855873dca6
Opcode Fuzzy Hash: 5102c16a1a3dd0c59ed62d3adc38dd38ca5faff1d901bc8702fb7e6328f7cb4f
Instruction Fuzzy Hash: FA2137B5900309DFDB10DFA9C885BDEBBF5FF88314F10882AE958A7251D774A944CBA4

Function 04E47E38 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04E47EC8

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6fcd9073af547abd377e69b565e78ee95e86b5374c1c8044d0d2e96132ceb425
Instruction ID: 2adeabba0f83f669f59588134d5c0ebc819b43160b872e9cda7089607edc2141
Opcode Fuzzy Hash: 6fcd9073af547abd377e69b565e78ee95e86b5374c1c8044d0d2e96132ceb425
Instruction Fuzzy Hash: 8A212AB1900359DFDB10DFA9C945BDEBBF5FF48310F108429E558A7250D774A944CBA4

Function 04E47F20 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E47FA8

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b7c34e9efabaed6dc44f01331df738350091aef019bb996a26c50eb12ab231db
Instruction ID: db959de51822b7635f2f6d7c7c3fb977c1c172f0372a399fa123143051d46efa
Opcode Fuzzy Hash: b7c34e9efabaed6dc44f01331df738350091aef019bb996a26c50eb12ab231db
Instruction Fuzzy Hash: 422139B18003599FDB10DFAAC845BEEFBF5FF88320F10842AE558A7250D775A544CBA4

Function 00F6D689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F6D717

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9557acd95ae926f5b39a35ced4fbd88a2e15cbe9357cbc1efcaa80bc8aa67f05
Instruction ID: 521742e3d7bef07bb07f7761129f709443374b091b4924e00a6520a13fbac2f1
Opcode Fuzzy Hash: 9557acd95ae926f5b39a35ced4fbd88a2e15cbe9357cbc1efcaa80bc8aa67f05
Instruction Fuzzy Hash: 6F2103B5D002089FDB10CFAAD984ADEBBF8EB48320F14801AE918A3210C375A940CFA5

Function 04E47CA0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04E47D1E

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 77b316a2fcf13e29f7f74159ed77c4fd62b7ac9dcd80e09ae4a31d6de941ad3b
Instruction ID: 8865c36f1d2d1cef47ae0b1017afefa9e63f0f77c2ffc63b25083fac2359e140
Opcode Fuzzy Hash: 77b316a2fcf13e29f7f74159ed77c4fd62b7ac9dcd80e09ae4a31d6de941ad3b
Instruction Fuzzy Hash: A92138B1D003098FDB10DFAAC4857EEBBF4EF88324F14842AD459A7250DB78A945CFA5

Function 04E47F28 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04E47FA8

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 195ef2f8bad994febb278db8f44b8aa1fc44d5ef664f82df796679e015a46119
Instruction ID: 5f221d2d071cc5652eb585c106859cc1c726156342f4b77c33954a0d9e53b4df
Opcode Fuzzy Hash: 195ef2f8bad994febb278db8f44b8aa1fc44d5ef664f82df796679e015a46119
Instruction Fuzzy Hash: 9A2128B18003599FDB10DFAAC845AEEFBF5FF88320F108429E558A7250D735A544CBA4

Function 00F6B031 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F6AFFE

Part of subcall function 00F6A130: LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F6B079,00000800,00000000,00000000), ref: 00F6B28A

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 944ac18a14793286969870f98bda8f801a8cca0b00e5ed48f8718ec59a4dc5bd
Instruction ID: a2017bb80b7fe45f09887f9a6bae1820acf4fd170b8734d42e004727bc8cb255
Opcode Fuzzy Hash: 944ac18a14793286969870f98bda8f801a8cca0b00e5ed48f8718ec59a4dc5bd
Instruction Fuzzy Hash: E811E272A043449FDB10EF6AD800BABBFF9AF86314F0480AAD058E7252C7749845DFA1

Function 00F6D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F6D717

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 803eb52296edbda7298e020ad83650b600e3e439dfbe40f280825716d18664f9
Instruction ID: 181b2bd74ac8401c5b39b757a80170967f2b905d4adcedc6141e288029d46b17
Opcode Fuzzy Hash: 803eb52296edbda7298e020ad83650b600e3e439dfbe40f280825716d18664f9
Instruction Fuzzy Hash: 1921E2B5D002489FDB10CFAAD984ADEBFF8EB48320F14801AE918A3350D375A940CFA5

Function 04E47D70 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E47DE6

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3e1a896fe7e95d2d0b2f8f071974476369d65343255df3c046ccc04b8d99ad5f
Instruction ID: 087c7618ae778720a823584ef43a1ee5c3b6aeec9e70301d88b8a3c789bcf010
Opcode Fuzzy Hash: 3e1a896fe7e95d2d0b2f8f071974476369d65343255df3c046ccc04b8d99ad5f
Instruction Fuzzy Hash: 661189718002089FDB10DFAAC805AEFBFF9EF88324F10842AE519A7250C735A944CFA0

Function 00F6A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F6B079,00000800,00000000,00000000), ref: 00F6B28A

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1a5bd915ebb7bade3dea3717b54a453db0aab5863f854ef5c8f588708d4e9bf5
Instruction ID: 082ed056cd331654d09a354a3b9ea2488743babcc603b49dd2e23689a52779cd
Opcode Fuzzy Hash: 1a5bd915ebb7bade3dea3717b54a453db0aab5863f854ef5c8f588708d4e9bf5
Instruction Fuzzy Hash: 8311E4B6D002099FDB10DF9AD444ADEFBF4EB88320F10852AD519A7210C375A945CFA5

Function 04E4A981 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04E4A9E5

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: dac160ca3d1ccc5259df0d4fb5daa5040665d0a5cf9b8591d93cd0c154bad745
Instruction ID: e795f82a8d1349b8b75d5f5a2111c069cea53240015f63632e7a9cdfe968f30b
Opcode Fuzzy Hash: dac160ca3d1ccc5259df0d4fb5daa5040665d0a5cf9b8591d93cd0c154bad745
Instruction Fuzzy Hash: 4E1134B6800248CFDB10DF8AE485BDEFBF8EB98320F10841AE568A7600D375A544CFA1

Function 00F6B218 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00F6B079,00000800,00000000,00000000), ref: 00F6B28A

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0ae9de7e90b0d204ef53098455baf2abf42ad309d1439fdcb435bd79e5f3faa5
Instruction ID: e5c4460af30a2f6622d0207faf5d0079e4f9fc4a419abf69db0f7ea0bc5b662a
Opcode Fuzzy Hash: 0ae9de7e90b0d204ef53098455baf2abf42ad309d1439fdcb435bd79e5f3faa5
Instruction Fuzzy Hash: 0B1114B6D002498FDB10DFAAC444ADEFBF4AB49320F14852AD859A7210C375A545CFA5

Function 04E477B0 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04E4781A

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c0a3a08f3b0cb3872df633050306c76c55d3ff57d8ff712edcd423e52387a9e1
Instruction ID: 19874a5679f33f73fbf8deae8fb72a591da4b7c0eeb213b1a24a6546771074fe
Opcode Fuzzy Hash: c0a3a08f3b0cb3872df633050306c76c55d3ff57d8ff712edcd423e52387a9e1
Instruction Fuzzy Hash: 411149B1D002588BDB10DFAAD4457DEFBF8EF88324F108829D459A7250C775A544CF94

Function 04E47D78 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04E47DE6

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bde7af80e93d53fd3e5e975eaba56f3d8ea8c6046979a8d110cce180081bd377
Instruction ID: a0431b0efc52c1062aa617c154023666eee84882cdaa6762c467becb09578fe2
Opcode Fuzzy Hash: bde7af80e93d53fd3e5e975eaba56f3d8ea8c6046979a8d110cce180081bd377
Instruction Fuzzy Hash: 311137719002499FDB10DFAAC845BEFBFF9EF88324F10841AE559A7250C775A554CFA0

Function 04E477B8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04E4781A

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 06573f4634a5a1f3cea090c32493516c0a4fb2c89a1bc672ba1c37cdb5610689
Instruction ID: 6f2d75082a00879524c184868e04349776709b8de1cd0d5634381a43550a7830
Opcode Fuzzy Hash: 06573f4634a5a1f3cea090c32493516c0a4fb2c89a1bc672ba1c37cdb5610689
Instruction Fuzzy Hash: 401128B1D002588BDB10DFAAC44579EFBF9EB88324F248829D459A7250C775A544CF94

Function 04E480B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04E4A9E5

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 77de2d846385e9110ff9b7978f4ab41508ebf6b8814ab28b7e0cd2594ed94562
Instruction ID: de529318a4281d3ad868f8ed99ab6660047997689da1eaf36eb93cc1365ea0cb
Opcode Fuzzy Hash: 77de2d846385e9110ff9b7978f4ab41508ebf6b8814ab28b7e0cd2594ed94562
Instruction Fuzzy Hash: B01122B58003489FDB10DF9AD445BDEBBF8EB48320F108429E558A7200C375A980CFA1

Function 00F6AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F6AFFE

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d882957a1ac8235169737c96dd94079c52a4576166bbbbed5f2d2f8f3c39f036
Instruction ID: 0f8ed44535b2857915298a01e1d2f9f3839836de4352225d7086c82bb66f76de
Opcode Fuzzy Hash: d882957a1ac8235169737c96dd94079c52a4576166bbbbed5f2d2f8f3c39f036
Instruction Fuzzy Hash: 0A1110B5C002499FCB10CF9AC444ADEFBF8AF88324F10842AD428A7210D375A545CFA1

Function 00F0D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b19897eec0229e37733f5270c8a870a778bf04469c5fb1937215474179e09c
Instruction ID: 5bb81a981a12de8bc92eb1beff0904c588db825bd810185c3c378aa8a04f5ca4
Opcode Fuzzy Hash: d7b19897eec0229e37733f5270c8a870a778bf04469c5fb1937215474179e09c
Instruction Fuzzy Hash: 1521377A500204DFDB05DF54D9C0B2BBF65FB98324F20C169E9094B296C336E856FBA2

Function 00F0D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b938764099fee6b559d0b0e8dd120e947178a747b6ef0ae1111843315bdb934a
Instruction ID: e5e096d20b38e867cd850ea8175a0f71b96472bc9a7922dfba8138e14adfd728
Opcode Fuzzy Hash: b938764099fee6b559d0b0e8dd120e947178a747b6ef0ae1111843315bdb934a
Instruction Fuzzy Hash: 3B212576900240DFCB05DF54D9C0B26BF65FB98328F28C569EC090B296C336D856FAA2

Function 00F1D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678855174.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f1d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4241cb9168b443275b13eb99a7a5ec70bf32fec000231ac4fb140f91c0cdb5
Instruction ID: 8b86c33cc68e2577360f38a32aade5ff8174c1547228f3b47634756c5876a6d4
Opcode Fuzzy Hash: bd4241cb9168b443275b13eb99a7a5ec70bf32fec000231ac4fb140f91c0cdb5
Instruction Fuzzy Hash: A821F575504200DFCB14DF14D984B56BB75EB88324F20C56DD80A4B25AC33AD887DA61

Function 00F1D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678855174.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f1d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0581a60090b6af27bd246cd7bcb85cea4b3af54848e75445cf93538388d94a
Instruction ID: 84d2f8296d100258e8cf4b29a43c59f3b1075f1e09a8c79adf52549408944d80
Opcode Fuzzy Hash: bd0581a60090b6af27bd246cd7bcb85cea4b3af54848e75445cf93538388d94a
Instruction Fuzzy Hash: 492180755093808FCB02CF24D994756BF71EB46314F28C5EAD8498F2A7C33A984ADB62

Function 00F0D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 501511c095f53ef4eb63a3e9a813edb89b057594f5a8156ac4ca4eefdf1ddd92
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1A110376804240CFCB16CF44D5C4B16BF71FB94324F24C2A9DC090B256C33AE85AEBA1

Function 00F0D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 8e7c3c3daa4629864de684cd3b2e8031863c7d9cd74ad55bad479412445f3c90
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: B211D676904240CFCB15CF54D9C4B26BF71FB94328F28C5A9DC450B656C336D45ADB91

Function 00F0D731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de44594386b8da6f83c923430535ea1920225c52fa54f61a26c25a049a7a3930
Instruction ID: 0e6e08566c4e4fc3100b6d6b2d64d71a323bcf32815972fb14d510080a10c2e5
Opcode Fuzzy Hash: de44594386b8da6f83c923430535ea1920225c52fa54f61a26c25a049a7a3930
Instruction Fuzzy Hash: E001A7714083449AE7144A69CD84767FFD8EF41334F18C52AED094A1D6D279D840F671

Function 00F0D730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678816125.0000000000F0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c911979eed98f430dc60c9d01fbecef11ac51ef3bcca12cc152e6bf00b3b19a
Instruction ID: db8520b1be97ef69804ab94627f40cf9f67f5d3d3887ef17883199116b7df649
Opcode Fuzzy Hash: 8c911979eed98f430dc60c9d01fbecef11ac51ef3bcca12cc152e6bf00b3b19a
Instruction Fuzzy Hash: A8F062714043449EE7148A1ACD84B66FFE8EF91734F18C55AED084E2C6C2799844DA71

Non-executed Functions

Function 02DC0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7358ea827cff09dda800bfd45c8b741ffab0a7ed949cef4b534350fa0bf4dd15
Instruction ID: 1c410142622e1b2eb199b13520117139ddde22ed05c44b77a24684817600dd33
Opcode Fuzzy Hash: 7358ea827cff09dda800bfd45c8b741ffab0a7ed949cef4b534350fa0bf4dd15
Instruction Fuzzy Hash: 0D1275B24117458BE731CF65E94C1A93BB1BB85328B908309D2616F2FADBB8954FCF44

Function 04E454B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93d288d075082189002035aec876a43fe1e475484b1cfe6923d7376ad7a1818
Instruction ID: 43a0dda44df3527216c17f6787b3ef6d50445def691b8405f5e1975c41149bdf
Opcode Fuzzy Hash: f93d288d075082189002035aec876a43fe1e475484b1cfe6923d7376ad7a1818
Instruction Fuzzy Hash: B0E13B74E00219DFCB14DFA9D5809AEFBB2FF89304F249569E504AB359DB31A942CF60

Function 04E45078 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964b7b2dca0be7358c9c132fbe8afe304cc2c1f87bb514215509e9f1064fc53a
Instruction ID: 7324830cb31ae697c3b2980879830bef744b636c8af52ead8ea10850fbd5a476
Opcode Fuzzy Hash: 964b7b2dca0be7358c9c132fbe8afe304cc2c1f87bb514215509e9f1064fc53a
Instruction Fuzzy Hash: 32E10974E002199FCB14DFA9D5809AEFBF2BF89304F249169E514AB35AD731A942CF60

Function 04E45D20 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c051b319d22000a1932b23ed1114ebd057921fa171d9570cb373d87ee50d8af1
Instruction ID: 4ec6b1ca6d8b9b6cd7b7107ed7db67e00b5783a3fa159c7d0f2374f06b6dbde7
Opcode Fuzzy Hash: c051b319d22000a1932b23ed1114ebd057921fa171d9570cb373d87ee50d8af1
Instruction Fuzzy Hash: 11E11A74E002198FCB14DFA9D5809AEFBF2FF89304F249169E518AB356D731A942CF61

Function 04E458E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8720562cdac13335c11cf4b0abb9232188cbd191b62b9aa860e31cc086da8dbf
Instruction ID: b490f88bb028e9d75f53bfb20f1243e5f7f4d90715e5cb03ab9b17ffd4e9f810
Opcode Fuzzy Hash: 8720562cdac13335c11cf4b0abb9232188cbd191b62b9aa860e31cc086da8dbf
Instruction Fuzzy Hash: 97E1F874E00219DFCB14DFA9D5809AEFBF2BF89304F249169E514AB356D731A942CFA0

Function 04E47868 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09f8cbd9209b48956c7b5baf9e8ca5005a079a505481d8eea281e7877c7c5a6
Instruction ID: b81dc6e8e2a7a6d3de879495443a5797decb79e0ea641fbc7ab3b9d640085280
Opcode Fuzzy Hash: c09f8cbd9209b48956c7b5baf9e8ca5005a079a505481d8eea281e7877c7c5a6
Instruction Fuzzy Hash: A8E1EA74E002598FCB14DFA9D5809AEFBF2FF89304F249169E414AB356D731A942CFA0

Function 00F6D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678983524.0000000000F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8067d36be08808b5fbb05818300698e81104194754c7c3d52dfd778a0f6553
Instruction ID: a4b60af1ab1a56ba47597f5a48ca600d45a61be974242da669cc7c168cc4525b
Opcode Fuzzy Hash: ee8067d36be08808b5fbb05818300698e81104194754c7c3d52dfd778a0f6553
Instruction Fuzzy Hash: DBA17D32E00209CFCF15DFB4D84059EB7B2FF85310B2585BAE806AB265DB75E919DB80

Function 02DC0007 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680792868.0000000002DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2dc0000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea48a4ed673437d7f069f9e4774727661b8c15f2b40dffda0e4d15e1a47b9f1f
Instruction ID: d3ff6cbddc7624923c6e689ff2098f444bdbad35908c9c533a9534d3bed9bda7
Opcode Fuzzy Hash: ea48a4ed673437d7f069f9e4774727661b8c15f2b40dffda0e4d15e1a47b9f1f
Instruction Fuzzy Hash: 0BD127B28017468FD721CF65E9481A93BB1BB85324F548309D1616F2FADBB8A48FCF44

Function 04E45D10 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82835ba809d1b201c513ed8683317288bcfe2cc04180df52e6ec676e6eced0f9
Instruction ID: 9d8bbce7a1f9d3bb5fad78f0a8ed1b28dc03eac34c8414c5715e5dbfeebbd761
Opcode Fuzzy Hash: 82835ba809d1b201c513ed8683317288bcfe2cc04180df52e6ec676e6eced0f9
Instruction Fuzzy Hash: 2C511D75E002198BDB14DFA9D5405AEBBF2FF89304F24D169D518AB316D731AA42CFA0

Function 04E458D8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687654202.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f89669ff418015f80e6a85859e19f3d39cded37e01e7e0eb81890f6e4e4f01
Instruction ID: 09dc28b5195488e7ee8afa0482f73a66af1cd971c2170895d13942204d93dd03
Opcode Fuzzy Hash: 19f89669ff418015f80e6a85859e19f3d39cded37e01e7e0eb81890f6e4e4f01
Instruction Fuzzy Hash: 58513970E002199FCB14DFA9D5805AEFBF2FF89304F24916AD518AB356D731AA41CFA0

Analysis Process: doc_rfq Oferta KH 09281.pdf.com.exePID: 5404, Parent PID: 6800COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	85
Total number of Limit Nodes:	7

Executed Functions

Function 03297364 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03297421

Strings

U, xrefs: 0329736D

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Create
String ID: U
API String ID: 2289755597-3372436214
Opcode ID: 9378bea89589030b1c28299639b50b26f6ed48e8a3fb8128445f12a3d4d8fb11
Instruction ID: 2bc46bbec65adae237404690c7afcc89f74dc7471ca38511726f8369c75ea0ca
Opcode Fuzzy Hash: 9378bea89589030b1c28299639b50b26f6ed48e8a3fb8128445f12a3d4d8fb11
Instruction Fuzzy Hash: 8C41DFB0C10629CFDB24CFA9C944BCEBBB5BF48304F24806AD458AB255DB756985CF90

Function 0329BFF0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0329C256

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ba7d3cb350f87f2b66c958cfb86578d08f6f536eb3cc8ad4d1b9c3021ac2d14
Instruction ID: a2f98afdb3290c86b07d326539c6d5a92c99a20d7a6b5f39a02fc0ad7734cbe3
Opcode Fuzzy Hash: 2ba7d3cb350f87f2b66c958cfb86578d08f6f536eb3cc8ad4d1b9c3021ac2d14
Instruction Fuzzy Hash: D58157B0A10B558FEB24DF29C44075ABBF5FF88300F04896ED486DBA50D775E889CB90

Function 03296414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03297421

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5f945fb0ac6d493d8236274ff33dc8884595477b3afd6c996313ba7a649af412
Instruction ID: d4a973c4036a8cb4aeacb4a2400d57fc683e0d641369c56bcd22887ff2626a02
Opcode Fuzzy Hash: 5f945fb0ac6d493d8236274ff33dc8884595477b3afd6c996313ba7a649af412
Instruction Fuzzy Hash: 7341DFB0C1061DCFDB24CFA9C844BCEBBB5BF48304F24806AD408AB255DBB56985CF90

Function 0329670F Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0329674E,?,?,?,?,?), ref: 0329680F

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 75b9d9122d2267a8483096e209c1ee9c0496d6f45b7368636d3136b39e4910f1
Instruction ID: 12bb43843b2aacdfb447fb9289a3693130ee1c2e742a84b90e9f3d9818ed3fd5
Opcode Fuzzy Hash: 75b9d9122d2267a8483096e209c1ee9c0496d6f45b7368636d3136b39e4910f1
Instruction Fuzzy Hash: DE31487A900248AFDF01CF99D844AEEBFF5FB48320F14806AE954A7321C7759954DFA0

Function 03296780 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0329674E,?,?,?,?,?), ref: 0329680F

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f02b872f6657fe7e8a2483e5895e981c371840952e62463da8617b965415ac8
Instruction ID: bb913c8dba2e50a7203a46352caa68d2639943c5f5a152edd9998586155b4d0a
Opcode Fuzzy Hash: 4f02b872f6657fe7e8a2483e5895e981c371840952e62463da8617b965415ac8
Instruction Fuzzy Hash: AD21F4B59002489FDB10CF9AD884ADEBFF4FB48320F14846AE858A3211D374A944CFA5

Function 0329611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0329674E,?,?,?,?,?), ref: 0329680F

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 28420e90b855805e9885c89f649c8764a0c5488d8669e54a7fe05531ef323967
Instruction ID: 6dab7778afd64c778b6e36d395468bc60e512e757a83bfa2a5d27bd31f30a7a8
Opcode Fuzzy Hash: 28420e90b855805e9885c89f649c8764a0c5488d8669e54a7fe05531ef323967
Instruction Fuzzy Hash: E721E5B59002589FDB10CF9AD984AEEFBF4FB48320F14845AE954A7310D375A944CFA5

Function 0329C294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0329C6D1,00000800,00000000,00000000), ref: 0329C8E2

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 19a12e1518c04c346ad4cbc59db76b24bda9f635c09082064a824bd55cc30300
Instruction ID: 27e140e2a87177920c31211e23e88091b83101770c348d30e63311625d18a0e6
Opcode Fuzzy Hash: 19a12e1518c04c346ad4cbc59db76b24bda9f635c09082064a824bd55cc30300
Instruction Fuzzy Hash: 711112B6D003599FDB20DF9AD448ADEFBF4FB88310F14846AE419A7210C3B5A585CFA4

Function 0329C870 Relevance: 1.6, APIs: 1, Instructions: 51
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0329C6D1,00000800,00000000,00000000), ref: 0329C8E2

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2dffc8f98d3ba0b4a33896ac8c71eee99f76d86e0e3aa95f11787fee99e86e4d
Instruction ID: a71e8b49c622cc7f4af075db0ea1983f79fbe707d8f5880bebba2fa111a9ed4b
Opcode Fuzzy Hash: 2dffc8f98d3ba0b4a33896ac8c71eee99f76d86e0e3aa95f11787fee99e86e4d
Instruction Fuzzy Hash: DE114FB6C003498FDB20CFAAD444ADEFBF0BB48310F14842ED429A7200C379A588CFA4

Function 0329C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0329C256

Memory Dump Source

Source File: 00000003.00000002.1707781990.0000000003290000.00000040.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3290000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5283ef53f1049026dc98bed2ba205a20312ce8345041edf8affab8ba1d155bd9
Instruction ID: 0eb6ecc47eb8f1c6e1e26b134656ca01f21dd212541d0e350a34a9cde4fe48cc
Opcode Fuzzy Hash: 5283ef53f1049026dc98bed2ba205a20312ce8345041edf8affab8ba1d155bd9
Instruction Fuzzy Hash: 7811E0B5C002598FDB10DF9AC444ADEFBF4AB88324F14852AD469BB210C375A585CFA5

Function 0301D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1707291392.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_301d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40e5fda20867bd0861f404ff1c50b5f2f21211bf3f726dfce2ea024156360b1
Instruction ID: 458e2bcc8f488e4f479ac4320810e74dff9c86bc08a01cd19eb1e6334610bef6
Opcode Fuzzy Hash: e40e5fda20867bd0861f404ff1c50b5f2f21211bf3f726dfce2ea024156360b1
Instruction Fuzzy Hash: 7C210475604200DFCB16DF14D9C4B2ABFA5FB84314F24C9ADD90A4B256C33BD467CA61

Function 0301D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1707291392.000000000301D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0301D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_301d000_doc_rfq Oferta KH 09281.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98571ca9a1c7f91300579d2d0c28915f0b47492da43f47c56a0bd8c2adb485b6
Instruction ID: 9093c88671bf1d43ac0e4f92c892cc909082a489aa632a084f8e455d242b0146
Opcode Fuzzy Hash: 98571ca9a1c7f91300579d2d0c28915f0b47492da43f47c56a0bd8c2adb485b6
Instruction Fuzzy Hash: A521A1755093808FCB13CF24D994B15BFB1EB46214F28C5DAD8498F2A7C33AD81ACB62

Analysis Process: workbook.exePID: 4960, Parent PID: 5404COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	243
Total number of Limit Nodes:	5

Executed Functions

Function 046B84B4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 046B86F6

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fd399f2742176c8490d8430ea41b04d8f75ee7de701ebf61c14aa5bb7ffcbc44
Instruction ID: b6aab547b4818c2d38f7e77aacc9467c562358626033444e4ca6fd758ead4aee
Opcode Fuzzy Hash: fd399f2742176c8490d8430ea41b04d8f75ee7de701ebf61c14aa5bb7ffcbc44
Instruction Fuzzy Hash: D5A18C71D00219DFEB20DF69C8417DEBBB6BF48314F1485A9E888A7250EB74A9C5CF91

Function 046B84C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 046B86F6

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e819a655aff6d06add52f210394e7cbc091e0adcaddb89decff1d7d99b98bc92
Instruction ID: 91953a8e4451121f1644467389fca962f4c8c9b9ae94b6630e6421b2474847e9
Opcode Fuzzy Hash: e819a655aff6d06add52f210394e7cbc091e0adcaddb89decff1d7d99b98bc92
Instruction Fuzzy Hash: A5916B71D00219DFEB20DF69C8417DEBBB6BF48314F1485A9E848A7250EB74A9C5CF91

Function 00C0ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C0AFFE

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0608b3e842e2aba96466bc5398ae7885cf667d0a1db0714bdd3795d18e250468
Instruction ID: f0b98f85becb0ca27a029aca4fe96502c4bb30fc5da6032fbd2aae8bd3fdc751
Opcode Fuzzy Hash: 0608b3e842e2aba96466bc5398ae7885cf667d0a1db0714bdd3795d18e250468
Instruction Fuzzy Hash: 30711470A00B058FDB24DF29D44575ABBF5FF88304F008A2DE49AD7A90D775E949CB91

Function 00C0590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C059C9

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fdf0a85355c3c2c040edb8a309e32eaa202e1a151b6397c18cc615bacfb2d65b
Instruction ID: 0f4b91c19390d9decbcb42a1480e0decf5fff2c73fe07a3f09db9ab496893602
Opcode Fuzzy Hash: fdf0a85355c3c2c040edb8a309e32eaa202e1a151b6397c18cc615bacfb2d65b
Instruction Fuzzy Hash: 3F41D4B0D0071DCFDB24CFA9C884B9EBBB5BF48304F24815AD408AB295DB755946CF90

Function 00C044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C059C9

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8714875028fb0dd1a43e071ec4b84ca4a5eee0c6756ab3244d369ceb66a3513
Instruction ID: 4d84a049409411d06385899c390c0eef0ef7fc1b2ae0d2dc38053e07df0e2453
Opcode Fuzzy Hash: e8714875028fb0dd1a43e071ec4b84ca4a5eee0c6756ab3244d369ceb66a3513
Instruction Fuzzy Hash: 7F41C4B0D0071DCFDB24DFA9C884B9EBBB5BF48304F24819AD408AB295DB756945CF90

Function 04C44040 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04C44101

Memory Dump Source

Source File: 00000006.00000002.1740551494.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c40000_workbook.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 494e78206e0d3f2c0fea694c95bd79ebd4f9cb70c5d6929b5d08e869764c9b7d
Instruction ID: 9547faa0e34afa25ea5553f4a1c933c69fc319a579c24bda9dacdde865d9003e
Opcode Fuzzy Hash: 494e78206e0d3f2c0fea694c95bd79ebd4f9cb70c5d6929b5d08e869764c9b7d
Instruction Fuzzy Hash: D8413AB8A00319DFDB14CF99C488B9ABBF5FB88314F24C459D519AB321D774A941CFA4

Function 046B7E30 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 046B7EC8

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a5f843d283e9d5266d89378027ae77e5b45de2ec440acdb0439509fa788de1bd
Instruction ID: ef79acf714945698cceaa7459e3909447b105f28398b7b23992870ed226407a0
Opcode Fuzzy Hash: a5f843d283e9d5266d89378027ae77e5b45de2ec440acdb0439509fa788de1bd
Instruction Fuzzy Hash: CF2126B1900359DFCB10DFA9C985BDEBBF5FF88310F10882AE558A7250D7749954CBA4

Function 046B7E38 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 046B7EC8

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d1e93b5b949c22892f8a735c26ba32bb5e438f2e455d44da052395dc2b9635b8
Instruction ID: e926e06b2596704750ee6d130bb6de3d0e015d55af39ff4a9c91f669e5e7e92f
Opcode Fuzzy Hash: d1e93b5b949c22892f8a735c26ba32bb5e438f2e455d44da052395dc2b9635b8
Instruction Fuzzy Hash: 8D2139B1900359DFCB10CFA9C985BDEBBF5FF88310F10842AE959A7250D778A944CBA4

Function 00C0D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C0D656,?,?,?,?,?), ref: 00C0D717

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62c66975f4aa2e150c40e539fe0e65932f43a54b5e76f379f0786113deabebeb
Instruction ID: 72c6ab05d78a32fbc5c7388c10a14d439ae2549fc0102a0c55691ca7139b4de8
Opcode Fuzzy Hash: 62c66975f4aa2e150c40e539fe0e65932f43a54b5e76f379f0786113deabebeb
Instruction Fuzzy Hash: 4B21E3B59002589FDB10CF9AD984AEEBBF8EB48310F14845AE959A7350D374A950CFA4

Function 046B7C99 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 046B7D1E

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8c4ade829882d4358ab37050c8304b6211b3d279017525e12fb131d4a595d3a3
Instruction ID: 6970a291d6cc5c95fbf1de16107830abdb8af73eb8d56bf1ad43eb2e31a19c2a
Opcode Fuzzy Hash: 8c4ade829882d4358ab37050c8304b6211b3d279017525e12fb131d4a595d3a3
Instruction Fuzzy Hash: 36214CB1D003098FDB10DFA9C4857EEBBF4EF88324F14842AD459A7250DB78A685CF94

Function 046B7F20 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 046B7FA8

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 307901a898ed406243c6991593fc4dc7686629a9557301553906480879ad3f6f
Instruction ID: 2d50064fe251005c9a9a526eaa10f062fe04b487262ec9d5a32290fd5c85db22
Opcode Fuzzy Hash: 307901a898ed406243c6991593fc4dc7686629a9557301553906480879ad3f6f
Instruction Fuzzy Hash: 6D2116B18003599FCB10DFA9C985AEEFBF5FF88320F10842AE558A7250D775A554CBA4

Function 046B7CA0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 046B7D1E

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 36a17c7c1cc1f43d21144748194cf66669602c10693b28de2962b3988870261a
Instruction ID: ab3b2ec05e6f65f6aa4c2ab787075a6d93f90556dcea33cf6fffc033436057d6
Opcode Fuzzy Hash: 36a17c7c1cc1f43d21144748194cf66669602c10693b28de2962b3988870261a
Instruction Fuzzy Hash: B1212CB1D003098FDB10DFAAC4857EEBBF4EF88324F14842AD459A7240D778A585CFA5

Function 046B7F28 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 046B7FA8

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4fa7d04a73625ba8b753065f4e49450a2fa3d88d816015f6adb427e623d00d08
Instruction ID: a508dd739e5a19d4a281d441a49d5f9a24d77d2fe22af89634d742042b6ba9d0
Opcode Fuzzy Hash: 4fa7d04a73625ba8b753065f4e49450a2fa3d88d816015f6adb427e623d00d08
Instruction Fuzzy Hash: 062139B1C003599FCB10DFAAC884ADEFBF5FF48320F10842AE558A7250D774A544CBA4

Function 00C0D689 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00C0D656,?,?,?,?,?), ref: 00C0D717

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f174b146f2b3536357790907b36777f02ed185e3c2135456048fa0a0705d5d62
Instruction ID: a8b6bc3d4fbb396e77b6e65fb93bad2c8ad6ee69a27697b808af4da1313f642c
Opcode Fuzzy Hash: f174b146f2b3536357790907b36777f02ed185e3c2135456048fa0a0705d5d62
Instruction Fuzzy Hash: 7621E4B5D00258DFDB10CF99D584ADEBBF5EB48324F14801AE915B7350C374A944CFA4

Function 00C0A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C0B079,00000800,00000000,00000000), ref: 00C0B28A

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a78a473d49fd79f91b7306397e255bf2aae4e6cdbafe6d05d37542651df81a4f
Instruction ID: a3d831360f287ef31cfa791fb56cf0e53de6ab9d777205ff92164e7834f911b2
Opcode Fuzzy Hash: a78a473d49fd79f91b7306397e255bf2aae4e6cdbafe6d05d37542651df81a4f
Instruction Fuzzy Hash: 211123B6D003099FDB20CF9AC448ADEFBF4EB88310F10842EE519A7250C375A944CFA8

Function 00C0B218 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00C0B079,00000800,00000000,00000000), ref: 00C0B28A

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9cc6b4f5e53ca1db1c609c1b41e5232d18f3812d654da769f89f1141e66749fd
Instruction ID: a71f24bfe11c179c5331fd856a3145d702cbbb4b2ad6cd310ec966c559ad5321
Opcode Fuzzy Hash: 9cc6b4f5e53ca1db1c609c1b41e5232d18f3812d654da769f89f1141e66749fd
Instruction Fuzzy Hash: 931104B6D003499FDB14CFAAD484BDEFBF4EB48310F10852AD529AB250C375AA45CFA5

Function 046B7D70 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 046B7DE6

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 385ef3fbf245904f79433551019f4b059c89d18cd1d5ce7af549ce9958971800
Instruction ID: 6b069e6ca0e2f38d2248592cfad3599c8e46eeea792007999a564c986c2467eb
Opcode Fuzzy Hash: 385ef3fbf245904f79433551019f4b059c89d18cd1d5ce7af549ce9958971800
Instruction Fuzzy Hash: 161147719002498FCB10DFA9C844ADEBFF5EF88320F20841AE555AB250C775A550CF90

Function 046B7D78 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 046B7DE6

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2d4c9e37891e5471d03a73c3670099c58eb65974f9c5af392e33107a789fda37
Instruction ID: dbf82db414d0516e3ac4dff1d4527cfb76a6fe38c74c72435aec0a4b8a0c4dcb
Opcode Fuzzy Hash: 2d4c9e37891e5471d03a73c3670099c58eb65974f9c5af392e33107a789fda37
Instruction Fuzzy Hash: 8B1137719002499FCB10DFAAC844BEFBFF5EF88320F20841AE559A7250CB75A554CFA4

Function 046B77B0 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 046B781A

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a8a2f2c4be78e89a33acd98f22f4fb85d33545f214abd81b6dc8cddedaf0601d
Instruction ID: e35fa8fd8f391dcf7c839df22e3ca5d954246fdeafc98df1d96bb94e55296bbd
Opcode Fuzzy Hash: a8a2f2c4be78e89a33acd98f22f4fb85d33545f214abd81b6dc8cddedaf0601d
Instruction Fuzzy Hash: 6B1158B1D003588FCB20DFAAC4457DEFBF5EB88320F24882AD499A7250C775A944CF94

Function 046B77B8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 046B781A

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 80da8f1edb53f2b3f0202cdd8a16f37aaf9d5a86ffb434e779cd3f64733c06e1
Instruction ID: 909f790c1139d7dcacc5b548e8e88653a76e45a23aa53968c410909059d72886
Opcode Fuzzy Hash: 80da8f1edb53f2b3f0202cdd8a16f37aaf9d5a86ffb434e779cd3f64733c06e1
Instruction Fuzzy Hash: CF113AB1D003588FDB20DFAAC4457DEFBF5EB88324F248429D459A7250CB75A544CF94

Function 00C0AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C0AFFE

Memory Dump Source

Source File: 00000006.00000002.1723732793.0000000000C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c00000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 96709c9e3c0d28d8b5513d95296e846e3d7b77a34b708af9b2f842a37eb517c1
Instruction ID: 916527c012490da7fdcb3cfb89a556a9d3fdabd81af0aa5e1ffa20bd40ccf095
Opcode Fuzzy Hash: 96709c9e3c0d28d8b5513d95296e846e3d7b77a34b708af9b2f842a37eb517c1
Instruction Fuzzy Hash: FF11E0B5C003498FCB14CF9AC444BDEFBF4AB88324F10846AD469A7250D375AA45CFA5

Function 046B8020 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 046BA8E5

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b30314df9864d88259f507d6e905dd8cabe432ea0031f23384284a5d59b4530c
Instruction ID: 694c94e76d341807ac0850519a1a584e2ef1c1e2dc63fbb697c5f59bcf830649
Opcode Fuzzy Hash: b30314df9864d88259f507d6e905dd8cabe432ea0031f23384284a5d59b4530c
Instruction Fuzzy Hash: A91136B5800349DFDB10DF89C488BDEBBF8EB58310F108459E594A7610D375A980CFA5

Function 046BA881 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 046BA8E5

Memory Dump Source

Source File: 00000006.00000002.1734934595.00000000046B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 046B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_46b0000_workbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ab2f55418641f78a603cd98d75217fcab2701be36639ce43aa6bad4ff3c47b7f
Instruction ID: 8216e1c064604c9349b6939cb4a3450f2092d16248f80a284185c722c92f3714
Opcode Fuzzy Hash: ab2f55418641f78a603cd98d75217fcab2701be36639ce43aa6bad4ff3c47b7f
Instruction Fuzzy Hash: 071113B58043899FCB10DF99D488BDEFFF4EB48324F10885AE598A7611D375A580CFA1

Function 008AD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fbb25acdc8d09bb221bdedf770769402147e820483240e18bff716913373cd
Instruction ID: 6cea2f03b92c0396fd39a4edd851a600174c21b2c7adfa95dc08c53fdedf8007
Opcode Fuzzy Hash: 33fbb25acdc8d09bb221bdedf770769402147e820483240e18bff716913373cd
Instruction Fuzzy Hash: 5521F1B1504304DFEB05DF14D9C4B2ABF65FB89314F20C569ED0A8BA56C336E816CBA1

Function 008AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf366f8a23c67b78e27f0cc0c988dc684512abffdbf49d7be13322de3ae772d
Instruction ID: c6c39b2019b94594eae703b36fab0c33853899235a0244c8ca51a14d4fec8b70
Opcode Fuzzy Hash: bdf366f8a23c67b78e27f0cc0c988dc684512abffdbf49d7be13322de3ae772d
Instruction Fuzzy Hash: 78214571900304DFEB01DF14C9C0B2ABF65FB98318F20C569E80ACBA56C336D846CBA1

Function 008BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720969716.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8bd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efea603cf42f962240e9c664c4a146ad3702f3a38a7de76965ff9b0d88646f7c
Instruction ID: ba27ec5adac3dd18061e9e9dfaa7b77c5302466964888864321ebf6a6cde9f2a
Opcode Fuzzy Hash: efea603cf42f962240e9c664c4a146ad3702f3a38a7de76965ff9b0d88646f7c
Instruction Fuzzy Hash: 6021F275604704EFCB14EF14D984B66BFA5FB88318F24C569D80A8B396D33AD847CA61

Function 008BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720969716.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8bd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed5ec78d7394469822efca50f5650301bf5d3615f4ea0418483b2898694fa12
Instruction ID: 83161d054dab9d693766df2a68dd651cdfb0d279c5adfdbcb781591afe96ca19
Opcode Fuzzy Hash: 6ed5ec78d7394469822efca50f5650301bf5d3615f4ea0418483b2898694fa12
Instruction Fuzzy Hash: D52180755087809FCB02DF14D994B11BFB1FB46314F28C5EAD8498F2A7D33A981ACB62

Function 008AD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 8a6c16adef1a61510b2e9b2512375248e81b9f42075034f64b9a170101658b36
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 7221CD76404240CFDB06CF00D9C4B16BF62FB84314F24C1A9DC498BA56C33AE82ACBA1

Function 008AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 45a862e653c353fba749f527451182eef76dee8b02b9f00a1745abdb4641638b
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9211D376904380CFDB16CF14D5C4B16BF71FB94318F24C6A9D84A8BA56C336D85ACBA1

Function 008AD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3018504ea1eb26928f75487af1da13ffc1f347500b7850a9d8c52f0d08f3d5c3
Instruction ID: 68a76965c174833c30cbe6463c950a07ff5061b268ce81e965bf680be10610b2
Opcode Fuzzy Hash: 3018504ea1eb26928f75487af1da13ffc1f347500b7850a9d8c52f0d08f3d5c3
Instruction Fuzzy Hash: 9701A7714093449AF7144A25CDC4767BF98FF42324F28C56AED1ACE996C679D840C6B1

Function 008AD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1720467580.00000000008AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8ad000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4bbcd3e58117ee9c13d185a1234e3a68d7e8ec1d2e8e2de93a9d033687e291
Instruction ID: 7b90608afa1160a0d15044bf8b98d5b94b50041b50d40f982fbff105b0773697
Opcode Fuzzy Hash: 0b4bbcd3e58117ee9c13d185a1234e3a68d7e8ec1d2e8e2de93a9d033687e291
Instruction Fuzzy Hash: DFF0C2714043449AE7148A16CCC8BA6FFA8EB91334F18C45AED098E686C2799844CA70

Analysis Process: workbook.exePID: 5960, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	208
Total number of Limit Nodes:	6

Executed Functions

Function 015ED031 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015ED0BE
GetCurrentThread.KERNEL32 ref: 015ED0FB
GetCurrentProcess.KERNEL32 ref: 015ED138
GetCurrentThreadId.KERNEL32 ref: 015ED191

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 627edae134ac0cd792ff516599a393867518118030373e04e10ea6e11ea3d78d
Instruction ID: 162fda9f613d708053599e36482bd5c17c36da1656a4ac36715c358251e0fdaf
Opcode Fuzzy Hash: 627edae134ac0cd792ff516599a393867518118030373e04e10ea6e11ea3d78d
Instruction Fuzzy Hash: DE5144B09003498FDB58CFA9D948B9EBBF1BF88308F248459D559AB3A0D7359884CF65

Function 015ED040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015ED0BE
GetCurrentThread.KERNEL32 ref: 015ED0FB
GetCurrentProcess.KERNEL32 ref: 015ED138
GetCurrentThreadId.KERNEL32 ref: 015ED191

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b68197fe1655758c7d102462d92c933429dc8bdfde89ef3337037aef6c4e2b0e
Instruction ID: 2e5c50fb77a2f7b037bcb954fca517c336b67559abe6739ac6b3087141dcb4ab
Opcode Fuzzy Hash: b68197fe1655758c7d102462d92c933429dc8bdfde89ef3337037aef6c4e2b0e
Instruction Fuzzy Hash: E35144B09003098FDB58DFAAD948B9EBBF1BF88314F20C419D459AB360D7349884CF65

Function 04F784B4 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04F786F6

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d1c11cdf2336b6b1d570c1169c814392489e4ffbeca1f315a7e8f8f46a0023ca
Instruction ID: b20d9b0fe57eeaeeeadc71130cdc66fdc5c27a9488d032319b578f8a79621fd8
Opcode Fuzzy Hash: d1c11cdf2336b6b1d570c1169c814392489e4ffbeca1f315a7e8f8f46a0023ca
Instruction Fuzzy Hash: 56A18C71D00219DFDB10DF68C944BDDBBB2BF48354F1485AAE809A7290DB789986CF91

Function 04F784C0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04F786F6

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d42db966b457496124942384702e0eaf203fd89686d3dce0168de0c4befdc3fe
Instruction ID: 72088399323be3bdd58f56282374922f1382b14a6a43b3f5a7cf51fa2f0c4fe1
Opcode Fuzzy Hash: d42db966b457496124942384702e0eaf203fd89686d3dce0168de0c4befdc3fe
Instruction Fuzzy Hash: 40918D71D00219DFDB20DF68CC44BDDBBB2BF48354F0485AAE809A7250DB78A986CF91

Function 015EADA8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015EAFFE

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dffc0a242325e3919f508d1c77d0f234ae0ea3826226cc0ba1b9f36cb564e842
Instruction ID: 3b95f4a43de4645bdf0f5c13c40629a1cfd60090c1e1fa71a4183bcd13d98607
Opcode Fuzzy Hash: dffc0a242325e3919f508d1c77d0f234ae0ea3826226cc0ba1b9f36cb564e842
Instruction Fuzzy Hash: E0712370A00B058FD768DF39C55875ABBF1FF88204F008A2ED59ADBA50D775E849CB90

Function 015E44C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015E59C9

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0ee7675c46c147fd83ddbcc343b33cf391eac54f61f9737cd8cb6844c2e591ae
Instruction ID: d414ef3d019905a336f2137f8b36b843d70a36bad61920caf2ab6d222c8d2ee4
Opcode Fuzzy Hash: 0ee7675c46c147fd83ddbcc343b33cf391eac54f61f9737cd8cb6844c2e591ae
Instruction Fuzzy Hash: 7D41D2B4C10719CBDB24CFA9C94468EBBF6BF49304F24806AD409AB255EB755945CF90

Function 015E590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015E59C9

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3925b0fcf9c38dc5110eae7b0ea55f165613fe1de2ee791883fd54882f60b5f1
Instruction ID: 926eaa9531edce046eae0657168c3c9e2ce3b7ce3410233880fe0bffa124fa63
Opcode Fuzzy Hash: 3925b0fcf9c38dc5110eae7b0ea55f165613fe1de2ee791883fd54882f60b5f1
Instruction Fuzzy Hash: EA41D2B0C10719CBDB28CFA9C9847CDBBF6BF49304F24806AD409AB255EB756945CF90

Function 04F77E30 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04F77EC8

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 766e4be97c91eb62f998541381083ad82ca852b67b99b16d0d7bafc1e837e914
Instruction ID: d2a3ba9db61083f86a86c77933651d99ab4e969e3408805c01109101fa925adc
Opcode Fuzzy Hash: 766e4be97c91eb62f998541381083ad82ca852b67b99b16d0d7bafc1e837e914
Instruction Fuzzy Hash: 4C2137B5900349CFDB10DFA9C9817DEBBF1FF48310F10882AD958A7250D778A945CB55

Function 04F77E38 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04F77EC8

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 304810e09849df3acb793bc9be33aea01f97219d8418eb09f128f11d00b4c42c
Instruction ID: c80714b81e95342ab7879521df1ab20db2460b85665abf512beda44b7bc89e02
Opcode Fuzzy Hash: 304810e09849df3acb793bc9be33aea01f97219d8418eb09f128f11d00b4c42c
Instruction Fuzzy Hash: 2A2157B1900309DFCB10DFA9C984BDEBBF5FF48310F10882AE958A7250D778A944CBA1

Function 04F77CA0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 04F77D1E

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 854f24a0b4b58d01e09ece5c3786f9671a037d509fd2582d71431b08ec29c78a
Instruction ID: 51af145db3e3b0c76e06d582904a40784ac142c2e4048cde084d2604fc6a1c85
Opcode Fuzzy Hash: 854f24a0b4b58d01e09ece5c3786f9671a037d509fd2582d71431b08ec29c78a
Instruction Fuzzy Hash: CE2134B19002098FDB10DFAAC4857EEBBF4EF48324F10842AD459A7240DB78A945CFA5

Function 04F77C99 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 04F77D1E

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 23741be1213b5e9abff18701a197720f1fa673852317d1fc269780647ba4e920
Instruction ID: 215389629b5f779ceac3391a8865665d859f7da0f006772bfe01f22c5dc3c2db
Opcode Fuzzy Hash: 23741be1213b5e9abff18701a197720f1fa673852317d1fc269780647ba4e920
Instruction Fuzzy Hash: 852135B1D003098FDB14DFA9C5857EEBBF1AF48324F14C42AD599A7240CB78AA45CF95

Function 04F77F20 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F77FA8

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: aca057a0632bd1cff7bf380d26d251524e8a04b64e85091f73efc75a0cc85ac3
Instruction ID: 5cdb77f9598ff27727b2d35225a7549427680cfb1b37c35fba3286779777cbb2
Opcode Fuzzy Hash: aca057a0632bd1cff7bf380d26d251524e8a04b64e85091f73efc75a0cc85ac3
Instruction Fuzzy Hash: 852145B1900349CFDB10CFA9C5417DEBBF1FF48320F14842AE998A7250DB39A541DBA5

Function 04F77F28 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F77FA8

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e4082e30dd2e3fe02f8955d573861bc9fc1f4e5e78b555b7af0f285d2f2d86f0
Instruction ID: 2e4ba5eb9a4962de2635dcf983e429942c05c2a331f9b3117853b85d2614ad1a
Opcode Fuzzy Hash: e4082e30dd2e3fe02f8955d573861bc9fc1f4e5e78b555b7af0f285d2f2d86f0
Instruction Fuzzy Hash: 302128B18003599FDB10DFAAC944ADEFBF5FF48320F10842AE558A7250D738A544CBA5

Function 015ED690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015ED717

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9e6ce997bb515759b7909feafaedd6a41f8f10bcf02fb319ed7a49e5539bc385
Instruction ID: 67745b7ab8318a553eb0342022590ded16ae4c0e2ff4175b5d9c97666ebb6712
Opcode Fuzzy Hash: 9e6ce997bb515759b7909feafaedd6a41f8f10bcf02fb319ed7a49e5539bc385
Instruction Fuzzy Hash: E421E2B5D002489FDB10CFAAD984ADEBFF8FB48320F14841AE958A7350D374A940CFA5

Function 015ED689 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015ED717

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5f46b485d91f7ebd39baabc204de2ac5e232ea24814c50b009127b838942e1bf
Instruction ID: f0293f62ad86938ff18c5a3c45a9ba53481e0611ede93c69f6441a7942f815c3
Opcode Fuzzy Hash: 5f46b485d91f7ebd39baabc204de2ac5e232ea24814c50b009127b838942e1bf
Instruction Fuzzy Hash: 7C21E0B5D002599FDB10CFA9D984ADEBBF4FB48314F14841AE958B7350D374A940CFA5

Function 015EA130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015EB079,00000800,00000000,00000000), ref: 015EB28A

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 32a54cbae2d228b02240ce50f70098f2c7f96d829a890a5c2a7e6f6e0fbc0c77
Instruction ID: 1a4947fee87e0f10d2a9ceafe5d4019a4c08ccf8a87c820f88f7f1078e184727
Opcode Fuzzy Hash: 32a54cbae2d228b02240ce50f70098f2c7f96d829a890a5c2a7e6f6e0fbc0c77
Instruction Fuzzy Hash: 5311E4B6D002099FDB14CF9AD448ADEFBF4FF48310F10842AD559AB210C775A545CFA5

Function 015EB218 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015EB079,00000800,00000000,00000000), ref: 015EB28A

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 592f42bd0fa4a7cebd7c86f33168cdf9712e5c414ca9cf145d69c7cd22283f83
Instruction ID: 734545997afc22b59eb91cff3defe099abce6b01a16dc0d1b816ebf84a7bbac7
Opcode Fuzzy Hash: 592f42bd0fa4a7cebd7c86f33168cdf9712e5c414ca9cf145d69c7cd22283f83
Instruction Fuzzy Hash: 0911D3B6D003498FDB14CF9AC448ADEFBF4EB48310F14842AD559AB610D375A545CFA5

Function 04F777B0 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04F7781A

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c99c8f074c9b7b4ef7543ffe2163729da6a46dc85e619fa42e839c8d6a31a55f
Instruction ID: eee67c3d30a4978dd5668ad838225bed9536e9c54f159246975ca8cc496dfeee
Opcode Fuzzy Hash: c99c8f074c9b7b4ef7543ffe2163729da6a46dc85e619fa42e839c8d6a31a55f
Instruction Fuzzy Hash: 6D115BB1D003588FDB20DFAAC4457DEFBF9EB48324F24882AD459A7250CA38A945CF95

Function 04F77D70 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04F77DE6

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3531ed03f3c849a8fe4b4d87f016533ab5adff73bb49540b107f4dbaaaa7e876
Instruction ID: bcede9b514c7e90a47fe63a77082621f846792eb0162c37eb655523352f8098c
Opcode Fuzzy Hash: 3531ed03f3c849a8fe4b4d87f016533ab5adff73bb49540b107f4dbaaaa7e876
Instruction Fuzzy Hash: D21156769002498FDB10DFA9C8447EEBFF2EF48320F20881AD559A7250CB79A955CF91

Function 04F77D78 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04F77DE6

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87bee5679035c21206829b6dc8f0b638e17290b9c45044a476caa4fcd8bc9ac4
Instruction ID: eedecd0371a92638ad255ae55b93ecafcb0d973518768e73c2293bf8a0bdf41c
Opcode Fuzzy Hash: 87bee5679035c21206829b6dc8f0b638e17290b9c45044a476caa4fcd8bc9ac4
Instruction Fuzzy Hash: 711137719002499FDB10DFAAC844BEFBFF5EF48320F10881AE559A7250CB75A554CFA1

Function 04F777B8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04F7781A

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 49931b7354f1901ed05364e7079346c3d13aa18201be3d62f2dc3586acd8c415
Instruction ID: ac3082397dd506e0ed1d448e01c946fc8bdb0f0c33f0f611596ebd046a893d23
Opcode Fuzzy Hash: 49931b7354f1901ed05364e7079346c3d13aa18201be3d62f2dc3586acd8c415
Instruction Fuzzy Hash: B21128B1D003488BDB20DFAAC4457DEFBF5EB88324F24882AD559A7250CA79A544CB95

Function 04F7A981 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F7A9E5

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3fcd3f5bb59369997a59937e2a5a0ac19dc7cc50f8818226f6ff6cdf1303fc01
Instruction ID: fedd451397cd7383958d2740da6958e9858d014633be061e92ec981bbb684019
Opcode Fuzzy Hash: 3fcd3f5bb59369997a59937e2a5a0ac19dc7cc50f8818226f6ff6cdf1303fc01
Instruction Fuzzy Hash: 291113B58043499FDB10CF99C484BDEBFF4EB49320F11845AD558A7251C379A944CFA2

Function 015EAF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015EAFFE

Memory Dump Source

Source File: 00000007.00000002.1770275245.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_15e0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dfd57c0b99fc10fb290eca275c09561329015ae110b1c37b5d516e87f6501e15
Instruction ID: aa252ac8d6125e21e0748ec2da7adee1f10e7c60f088f993be9b93051f9ce353
Opcode Fuzzy Hash: dfd57c0b99fc10fb290eca275c09561329015ae110b1c37b5d516e87f6501e15
Instruction Fuzzy Hash: 5B11E0B5C003498FDB24CF9AC448ADEFBF4EF88324F10842AD569A7250D375A545CFA5

Function 04F780B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 04F7A9E5

Memory Dump Source

Source File: 00000007.00000002.1810926185.0000000004F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f70000_workbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: afb9e6ddd8135e4352e3477f108242defc61a6ce8b4b01d6a46906fa33834dd3
Instruction ID: cfdfe57c3a378ab35ad396ea1b6e5b1815b00935975ab07cc7ae4f6abd025b94
Opcode Fuzzy Hash: afb9e6ddd8135e4352e3477f108242defc61a6ce8b4b01d6a46906fa33834dd3
Instruction Fuzzy Hash: E41136B5800348DFDB10CF9AC444BDEFBF8EB48310F10841AE554A7201D374A950CFA1

Function 013FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769772568.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_13fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bdbd0c6c9f471e1f55818bae8d4bf88e9ff09236bb0de0a390181032dd1d3f
Instruction ID: 7a323bf48154467ff22919d66745460eb246cf17eb0d37858e57c3e3ec47028c
Opcode Fuzzy Hash: e4bdbd0c6c9f471e1f55818bae8d4bf88e9ff09236bb0de0a390181032dd1d3f
Instruction Fuzzy Hash: 282122B1500244DFDB05DF98D9C8B2ABF65FB8831CF20C56DEA090B256C336D456CAA2

Function 0140D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769849422.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9682fbbe968578683641b32cb2e5d4c7d2a05dcf7b8732b6a7e65888ca9a5b
Instruction ID: 195b856a8d88b1b1b101f9578e65b575c75f3cf59f1d5e5b6653e5870caae001
Opcode Fuzzy Hash: 1b9682fbbe968578683641b32cb2e5d4c7d2a05dcf7b8732b6a7e65888ca9a5b
Instruction Fuzzy Hash: A02128B1904200DFDB16DF99D984B16BF65EB84318F20C57ED90D4B3A6C336D44BCA61

Function 0140D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769849422.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_140d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0a08b72e9b64bcb21d0a79627bdb4df172ae673d5f1307c5b4ce13efb13ad7
Instruction ID: c2cb4fee91bd4a8da893cdcbc8ed7b7e604de18a409aeae0f9d10a11c3a8236d
Opcode Fuzzy Hash: eb0a08b72e9b64bcb21d0a79627bdb4df172ae673d5f1307c5b4ce13efb13ad7
Instruction Fuzzy Hash: 8B2195755093808FD703CF64D594716BF71EB46214F28C5EBD8498F6A7C33A980ACB62

Function 013FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769772568.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_13fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 728065e0bb3785e43b24ce11c18a480aea4d6e9e7488e675d23f96e93524315f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: DA11E172404280CFCB02CF54D5C8B16BF71FB84318F24C6ADD9090B256C336D45ACBA2

Function 013FD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769772568.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_13fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc95a5b3c6b6be6df9d3a20a176e401d8167df574a92017a736db7f6a6aef53
Instruction ID: 953f2a77155be35d574b17b61b4fd919542a90b916ac8ae15ce6f019d20a1343
Opcode Fuzzy Hash: ddc95a5b3c6b6be6df9d3a20a176e401d8167df574a92017a736db7f6a6aef53
Instruction Fuzzy Hash: 9E01A7710093849AE7119EA9CE88767BFDCEF41328F18C52DEE094E196D2799844C672

Function 013FD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1769772568.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_13fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f1d51b100a4c9274715c3cf305f9666fc7218379f2d3dc126eb88b83215d51
Instruction ID: 2e839aed4eaa55d855075d61d94bfd60f384c6cfaea85b559872be618efad974
Opcode Fuzzy Hash: c0f1d51b100a4c9274715c3cf305f9666fc7218379f2d3dc126eb88b83215d51
Instruction Fuzzy Hash: 3AF068714053849AE7118E59C988766FFE8EF81738F18C55AED084E296C2759844CA71

Analysis Process: workbook.exePID: 600, Parent PID: 4960COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	12

Executed Functions

Function 0858B2C0 Relevance: 3.5, Strings: 2, Instructions: 1031COMMON

Download Yara Rule

Strings

(oq, xrefs: 0858BEEB
(oq, xrefs: 0858B8A0

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-3207256227
Opcode ID: 32b85f721b7f0b4a4e2659b90d9e67d5aef4d06180196f0ae6003503e7aa9727
Instruction ID: 39825d5a8a8f71c1a4491968176676a937bb64f7b494949083f3d320c6a6561b
Opcode Fuzzy Hash: 32b85f721b7f0b4a4e2659b90d9e67d5aef4d06180196f0ae6003503e7aa9727
Instruction Fuzzy Hash: A682BD75A00605CFCB15EF69C49462EBBF6FF84321F14856EE556AB391DB30E842CB82

Function 085828A0 Relevance: 4.1, Strings: 3, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 085829F5
(oq, xrefs: 085829C9
Hoq, xrefs: 08582A21

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq$(oq$Hoq
API String ID: 0-3836682603
Opcode ID: f70d758ad1494a51b91bf797eac9f63864c0430e62508bbd3070a34ddad6312b
Instruction ID: b96181220054d3e64643e2e37567ac7e710e189cc4c732114015b30500133a75
Opcode Fuzzy Hash: f70d758ad1494a51b91bf797eac9f63864c0430e62508bbd3070a34ddad6312b
Instruction Fuzzy Hash: 65E16334A00609DFCB44EFA4D5949ADBBB2FF88300F518569E415AB364DF34ED86CB91

Function 08587920 Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 08587BD2
4'kq, xrefs: 08587C09

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 37b872fad35c4c730aec654f85c88707dc5b13db5153096a9d4c0c0239d4bacc
Instruction ID: b66bccb597a7d6529b2717503bcf88512c742645897604a4b1fc7a36c7e9db31
Opcode Fuzzy Hash: 37b872fad35c4c730aec654f85c88707dc5b13db5153096a9d4c0c0239d4bacc
Instruction Fuzzy Hash: D4C1C474B00618CFDB44EFA8C994AADB7B6FF88300F504569E506AB3A5DB71EC42CB50

Function 08587912 Relevance: 2.8, Strings: 2, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 08587BD2
4'kq, xrefs: 08587C09

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: b39009d9c47912faa1a7cb50054d122c9a75ca53d7fcd82a4d421a356aa373d7
Instruction ID: 7dd15ae2f550b62f2a23780e284398b2c97e7ee016055223f909ded1c89f45a6
Opcode Fuzzy Hash: b39009d9c47912faa1a7cb50054d122c9a75ca53d7fcd82a4d421a356aa373d7
Instruction Fuzzy Hash: E5C1D874B00618CFCB44EFA4C994AADB7B6BF89301F504569E506AB3A5DB71EC42CB50

Function 085873E8 Relevance: 2.7, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 0858758A
Hoq, xrefs: 085875B6

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 88c861d75e5ea85f9982cfefe2c8d0259adb99224b0b96d534977767f24f4ae1
Instruction ID: 2c88c9a4bec9c5a4effa441cea085e55c5ea1d50c078c7ba5b6e3ebebb21bef1
Opcode Fuzzy Hash: 88c861d75e5ea85f9982cfefe2c8d0259adb99224b0b96d534977767f24f4ae1
Instruction Fuzzy Hash: 7061F1347002558FDB28FF3AC41462E7BE6BF89201B24456ED556DB3A1EF38DD068B91

Function 08587238 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,oq, xrefs: 08587251
(oq, xrefs: 085872B1

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq$,oq
API String ID: 0-616274613
Opcode ID: c983a816e1747a1e128161e8d7a47cf0134113dc929f89fa72214c57b21d70b8
Instruction ID: 0b60f94e3955eb2d6ecc9434b0318de30cfaa2146753d2b2400b6fd89e2419e7
Opcode Fuzzy Hash: c983a816e1747a1e128161e8d7a47cf0134113dc929f89fa72214c57b21d70b8
Instruction Fuzzy Hash: C041E3367001596F8F119EAA9C509FFBFEEEB8C211B14406BFA45E3281DA39C91597A0

Function 033CC000 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 02d976e18feec6ded1c136d8b43daafe060859b5b77da2430582e0f042bde909
Instruction ID: 4677213800b2fa2e1d7dc0bad90e17a8b74bc001bd701b810672c93374bafa25
Opcode Fuzzy Hash: 02d976e18feec6ded1c136d8b43daafe060859b5b77da2430582e0f042bde909
Instruction Fuzzy Hash: 247148B4A10B458FD724DF6AD88075ABBF5FF48600F048A2DD48ADBB50D775E84ACB90

Function 033C6780 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,033C674E,?,?,?,?,?), ref: 033C680F

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb438f6e6dc11df55b35e100783143ec50909eb3070b2da03983e74938cb793c
Instruction ID: cdfa0695e87dc1d371efa02cf544d6b3e54ee6c01ff009358b52bcc62e44d5a9
Opcode Fuzzy Hash: cb438f6e6dc11df55b35e100783143ec50909eb3070b2da03983e74938cb793c
Instruction Fuzzy Hash: 6C3148B5900249EFCF00CFA9D885ADEBFF5EB88310F188019E954A7361D735A954DFA0

Function 033C6414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 033C7421

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 976eb55ea0909b2c40a70b18650e22b5ce8ac0ca78094478a8c32b77b004df65
Instruction ID: 37811b19aeae92d81d9ffdd62ab7711aa90a1cd95e0d94135220d1febecc0c08
Opcode Fuzzy Hash: 976eb55ea0909b2c40a70b18650e22b5ce8ac0ca78094478a8c32b77b004df65
Instruction Fuzzy Hash: B841C3B0D0061DCFDB24DFA9C984BDDBBB5BF48304F24805AD418AB255EB756985CF90

Function 033C7364 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 033C7421

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0202a390813f7d01a38e541890ebf771a9c8e57036003911178e13ab763a91b5
Instruction ID: b9e68398cbc2e6af7fb6ad62c4b3e164d8a3b98f1c6efcb270a142d4cee1f37d
Opcode Fuzzy Hash: 0202a390813f7d01a38e541890ebf771a9c8e57036003911178e13ab763a91b5
Instruction Fuzzy Hash: C441D1B1C0061DCFDB24CFA9C884BCEBBB5BF48304F24806AD458AB255EB756985CF90

Function 033C611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,033C674E,?,?,?,?,?), ref: 033C680F

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 62d9be9293ea55a7e8f814d27cddffad5158b681e3d60d6d0c653da4ea78373a
Instruction ID: 2bfec04e9b3b444f40f3417133b06f6e1df3c2f9fe92af8cfcb0ee81d4777ade
Opcode Fuzzy Hash: 62d9be9293ea55a7e8f814d27cddffad5158b681e3d60d6d0c653da4ea78373a
Instruction Fuzzy Hash: 0421E3B59002489FDB10CF9AD984ADEBBF8FB48320F14841AE958A7350D375A944CFA5

Function 08586680 Relevance: 1.6, Strings: 1, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Plkq, xrefs: 0858669F

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: Plkq
API String ID: 0-177148220
Opcode ID: 18149fda263e8aa9b6524661397f00ca75b64f7939185d83b4f2158b22075598
Instruction ID: 97761356d952052bc1a3fb18d080017820ec6f5df66310ea3093b560720fdf79
Opcode Fuzzy Hash: 18149fda263e8aa9b6524661397f00ca75b64f7939185d83b4f2158b22075598
Instruction Fuzzy Hash: 6FD1ED38B11218DFCB44EFA4D994E9EBBB6BF88700F108459E505AB3A5CB75EC46CB50

Function 033CC294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,033CC6D1,00000800,00000000,00000000), ref: 033CC8E2

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 938074301e28bf5d821c6b239eb69dea818b859a1b3423c8ffbb11a29006e3ca
Instruction ID: fe35068250a14861f2954195187174d569c3b8f3f4549149de9cef2188d7ed67
Opcode Fuzzy Hash: 938074301e28bf5d821c6b239eb69dea818b859a1b3423c8ffbb11a29006e3ca
Instruction Fuzzy Hash: F411D0B69003499FDB10DF9AD884A9EFBF4FB88310F14842EE519A7610C375A945CFA5

Function 033CC870 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,033CC6D1,00000800,00000000,00000000), ref: 033CC8E2

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 37eb4dba9842cc1bc86c4984db03d1c42fe789ad9971d752040ba519ceceea1c
Instruction ID: d5f8d94695009e279266df46cd105388f2a45d0fcc1f261b306ab6706bc7ab5c
Opcode Fuzzy Hash: 37eb4dba9842cc1bc86c4984db03d1c42fe789ad9971d752040ba519ceceea1c
Instruction Fuzzy Hash: A611E2BAD003498FDB10CF9AD984ADEFBF4BB48310F14842ED559A7610C379A945CFA5

Function 033CAF60 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,033CC01C), ref: 033CC256

Memory Dump Source

Source File: 00000008.00000002.4126284343.00000000033C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_33c0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1a47189e900ef5439f7adf9e06f21596ce68bac80718d9f520a05f3f1b6da273
Instruction ID: 6da12d26601f8887f56b7d94ec0191c804d401be01728bcf04d7aec815285b7e
Opcode Fuzzy Hash: 1a47189e900ef5439f7adf9e06f21596ce68bac80718d9f520a05f3f1b6da273
Instruction Fuzzy Hash: 871102B5C002498FCB10DF9AC884ADEFBF4EB88214F14842AD429B7210D379A946CFA5

Function 08582E38 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

(oq, xrefs: 08583105

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 7122715daee2a29172c6df109368bf062f6627820a53cfe3cd78bf15c2d4c996
Instruction ID: 00f25a9557656c8e968c2b96b2251a681409f3f9b2f0d8837b6c41aa581e87ce
Opcode Fuzzy Hash: 7122715daee2a29172c6df109368bf062f6627820a53cfe3cd78bf15c2d4c996
Instruction Fuzzy Hash: 50A1C235304200DFC719AF64D994A2A7BA3FF89311F1584AAE5059F3B6CB36EC46DB90

Function 08586650 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

Plkq, xrefs: 0858669F

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: Plkq
API String ID: 0-177148220
Opcode ID: 679daca9266797318c0726d8868591a0ce9b9e9454d008eeff75bae0ff03c134
Instruction ID: b4c2fbd38f0a01d52ef58f52180d47c6b196c7d8a5db7faea1a766514c9404d9
Opcode Fuzzy Hash: 679daca9266797318c0726d8868591a0ce9b9e9454d008eeff75bae0ff03c134
Instruction Fuzzy Hash: 9EB13D34B11318DFCB44EFA8D994E9EBBB6BF88700F144459E502AB3A5CA75EC46CB50

Function 08580F18 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

Hoq, xrefs: 08580FB5

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: Hoq
API String ID: 0-3049094369
Opcode ID: bd707da0b92228f7d28b48a5e3b3e92b5c9c68f5fbbab801e14b14d1ee9db6a6
Instruction ID: c37a4d34221002796827dfb483982bf9de3d8366a9e88c0e6363ba0cb07e4a33
Opcode Fuzzy Hash: bd707da0b92228f7d28b48a5e3b3e92b5c9c68f5fbbab801e14b14d1ee9db6a6
Instruction Fuzzy Hash: DE518034B006158FC744EF69C95496EBBB6FF89701B1081AAE505DB361EF30ED46CB91

Function 08581EF5 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

4'kq, xrefs: 08581FAA

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 02e710576dd217fd38c5270abdf048e5af3755eba2ac0c518bd3ac0d53a6d6c9
Instruction ID: 0eb1e35ade71e57c7f429d33c1a11ac055660335ddc252d83b70349bd3c8f0fa
Opcode Fuzzy Hash: 02e710576dd217fd38c5270abdf048e5af3755eba2ac0c518bd3ac0d53a6d6c9
Instruction Fuzzy Hash: 84513A30B487D49FD716B7288CA46AE7FA6AFC6701F15409BD181EF2D2CEA44C46C792

Function 08581F70 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'kq, xrefs: 08581FAA

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 9638e2ce0846b1283289c49289f245d291662fff35e1fa31563c232a2d6b4bb3
Instruction ID: e5e2eef8b8f91cd63fbc22b32ee76e0d411ffdae8433745b524d0dd79489bd69
Opcode Fuzzy Hash: 9638e2ce0846b1283289c49289f245d291662fff35e1fa31563c232a2d6b4bb3
Instruction Fuzzy Hash: 80419334B107148FCB44BB64C8A4AADB7BBBFC9700F50541AD112AB394DFB4AC46DB91

Function 08583CD9 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

4'kq, xrefs: 08583D8E

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 8c9ca49976dfa8a34e2bfa9e7235c5fb4ef1cf8ce76a45c14137043a271eb7ea
Instruction ID: 55971c9e3a2e83f39752cf1d61d29176b5ab221ff04b493aebb522046da0f292
Opcode Fuzzy Hash: 8c9ca49976dfa8a34e2bfa9e7235c5fb4ef1cf8ce76a45c14137043a271eb7ea
Instruction Fuzzy Hash: 74416D353406009FD318EB29C954F2A7BAAAFC8B05F1044A9E2069F3A5DE75EC42C791

Function 08583CE8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'kq, xrefs: 08583D8E

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: fc366523070985b0a2e47a702198655fe82ed3d3e66c9d2b081cba61e478b4fd
Instruction ID: 82ffaf5b261333dc6529d3056907e54be0784210c28d7d1b19b3eb607d908149
Opcode Fuzzy Hash: fc366523070985b0a2e47a702198655fe82ed3d3e66c9d2b081cba61e478b4fd
Instruction Fuzzy Hash: 9D314A357406149FD358EB29C994B2B77AABFC8B04F104468E2068F3A5DE76EC42CB90

Function 08580E88 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

(oq, xrefs: 08580ED6

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 42c9206debe76c9c804ad1dccb68793816b9f1a52099a035742611f449584740
Instruction ID: 20066d125314fa3356b4919701204f3232e4cd49178ac056703aceb6594ff7a8
Opcode Fuzzy Hash: 42c9206debe76c9c804ad1dccb68793816b9f1a52099a035742611f449584740
Instruction Fuzzy Hash: FD014725319794CBD7467729442023F6FAAAFC2501B1580BBD441DB3C1DE789C068396

Function 0858A551 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

xoq, xrefs: 0858A551

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: xoq
API String ID: 0-2982640460
Opcode ID: c4d7abc0033833e1770f4220878516563a9835a95542b852bbe7ef2c6c4d9821
Instruction ID: 0b0f3a47633646ae4e7f7247c9eb1d087aee58b9079117455a0d1e6dd99ee020
Opcode Fuzzy Hash: c4d7abc0033833e1770f4220878516563a9835a95542b852bbe7ef2c6c4d9821
Instruction Fuzzy Hash: 89F0E5387001109FDB04DB18D941A69BBF5FF88314F158099E109AF361D771FC068F50

Function 085821B0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7806616fc2ff6a5ccf84f858a17fb28570cac3612d2a6438d0489f99e8f5fb
Instruction ID: ae287e1c15e3ad3e6c1e383b0a210513224758bf26fcdb9e1225f4390b975c6e
Opcode Fuzzy Hash: ce7806616fc2ff6a5ccf84f858a17fb28570cac3612d2a6438d0489f99e8f5fb
Instruction Fuzzy Hash: C2120934A00219CFCB54EF64C894A9DBBB2BF89301F5095A9D54AAB355DF30ED85CF50

Function 08586B14 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bf68320e1d8d2416ed21c8c51631444d9d70d5fcfcec2dec5fd384e931b092
Instruction ID: 279970d303dac9c3349a19d3eaaceb10ca50a01308fe66f7bd357302306ab2bf
Opcode Fuzzy Hash: 57bf68320e1d8d2416ed21c8c51631444d9d70d5fcfcec2dec5fd384e931b092
Instruction Fuzzy Hash: 9BA16B34700704CFCB45EB68C4A496E7BB6BF89701B508599E4029F3A4DF35EC469B91

Function 08586B38 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f6432ed6f0f05eb67687e5a6129fdd469169eceb8f5ba75319a1423de65115
Instruction ID: cd3523a525e43b1c21d5ca52d02f77fe8158eb3d4dad0c5321b5e919fe0c10d4
Opcode Fuzzy Hash: 08f6432ed6f0f05eb67687e5a6129fdd469169eceb8f5ba75319a1423de65115
Instruction Fuzzy Hash: E0A15A347007048FCB44EF68C4A4A6E7BB6BFC9700B508559E512AF3A4EF35ED469B91

Function 08586B48 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f783fdee5c0baca4bcb97e6a18ab068b6aabc1a9bfe463d895d8c99411fc8c2
Instruction ID: b023bb8ce1121029c5bb07b427ed8e3f9141d0f7e408fe51bfd24b2d5d91ad41
Opcode Fuzzy Hash: 3f783fdee5c0baca4bcb97e6a18ab068b6aabc1a9bfe463d895d8c99411fc8c2
Instruction Fuzzy Hash: 7AA159347007048FCB44EF68C8A4A6E7BB6BFC8700B508559E506AF3A4EF74ED469B91

Function 08583170 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80677f633509229ce2c3cf844e1a8321d039f8dae3f0f49bde78d5f179e0224d
Instruction ID: 3235b867ce5a4b4370fe56bb936bd50f8e3672f5f1c262df62ce020247e8daa3
Opcode Fuzzy Hash: 80677f633509229ce2c3cf844e1a8321d039f8dae3f0f49bde78d5f179e0224d
Instruction Fuzzy Hash: 13912E34710614CFDB44EF64D894AADBBB6BF89611F1480A9E506EB3A5CF74EC42CB90

Function 08585AC8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9336936980e971b4e09a001ef83110c54b4261c60d3d19c12decf8edbfffb11b
Instruction ID: 0ee0737786db353fad76df085d2d9f6e675f58b3446c203d121c0b2fb2936052
Opcode Fuzzy Hash: 9336936980e971b4e09a001ef83110c54b4261c60d3d19c12decf8edbfffb11b
Instruction Fuzzy Hash: FC816D34B01705DFDB48EB64D494BAEB7B2BF88701F108569D402AB3A4DF75AD86CB90

Function 0858A6CB Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f52bbd5f5239bef51b37e94b93143f5f88dd7c61c84fe96f608bfb9ac9bfa6a
Instruction ID: e0547b220e0c7f4edc5f77f28278e0ffa31b2cf36cbbff8d43f0248b4824c2b6
Opcode Fuzzy Hash: 6f52bbd5f5239bef51b37e94b93143f5f88dd7c61c84fe96f608bfb9ac9bfa6a
Instruction Fuzzy Hash: 1A81F574A21228EFCB15DF98D980EADB7B2FF88310F15455AE505AB362E771EC81CB41

Function 08583161 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf15874039fbf74efb8cd0e66f13913f3e5ef65d78a511e23a38a76d78b5cd8
Instruction ID: 0767a39de23021d91280360c69afff156ac8bcdef7f7f01425305076834f8ff2
Opcode Fuzzy Hash: dcf15874039fbf74efb8cd0e66f13913f3e5ef65d78a511e23a38a76d78b5cd8
Instruction Fuzzy Hash: 80612A34710604DFCB44EF68D894AADB7B6BF88611F1481A9E506AB3A5DF70EC42CB90

Function 08585AB8 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0a5ad1963f6506fdbe58482a75eaeaab601b000edec0cc35580be77a0dc4ae
Instruction ID: d75a4d1d0c0d35a6a67a461667285db99771d3f686593c65db5b1e97acf8687a
Opcode Fuzzy Hash: 5f0a5ad1963f6506fdbe58482a75eaeaab601b000edec0cc35580be77a0dc4ae
Instruction Fuzzy Hash: 24518034B01705DFDB09EF64D494BAEBBB2BF88301F14856AD4026B390DB75AD86CB91

Function 0858B158 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb75db51c7d9602c70cf3c5797e2b9e55c468eb9763e5518d0136aa223c8e3c
Instruction ID: c523320d702ae0ca2b1b2d29d980f18026b2d1af5b600b80c9e5c693b7e72559
Opcode Fuzzy Hash: 1cb75db51c7d9602c70cf3c5797e2b9e55c468eb9763e5518d0136aa223c8e3c
Instruction Fuzzy Hash: 5E41E231B01704CFCB64EB78D55029EBBF5FF84661F54896EC15ADBA84EA30E841CB82

Function 0858AA70 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6526cd834f732e87d061e8c3b1deb9be10719de92c160016929331cd5130d584
Instruction ID: f8550b7f112ce5cc8b159fa8826825c8d2b7ed441304d859e0428edcf16ab800
Opcode Fuzzy Hash: 6526cd834f732e87d061e8c3b1deb9be10719de92c160016929331cd5130d584
Instruction Fuzzy Hash: B541A235B006149FC745EB69C850A9EBBF6FFC8310B2585AAE509EB365DB71EC41CB80

Function 085873DA Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e49b406a116dd812e69b7275f49d79c402abdf639c96b4f579ced710e548e94
Instruction ID: c53db946c6cb996b56883f947fc9bb3328b9017b8a3448e250a18426fe0fdfeb
Opcode Fuzzy Hash: 5e49b406a116dd812e69b7275f49d79c402abdf639c96b4f579ced710e548e94
Instruction Fuzzy Hash: 5F41E430200345CFDB24EF3AC84466A7FF5BF89216F24856EE8959B2A1EB70D945CB91

Function 08585E11 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb19fa6fa2556a46d9856ba096757606274be7f8691e95cb4a62caa52907294b
Instruction ID: f8ec869693ec24283ff9e4443742cea6c57fe1b2a6769987f66f7d3673d3ef40
Opcode Fuzzy Hash: bb19fa6fa2556a46d9856ba096757606274be7f8691e95cb4a62caa52907294b
Instruction Fuzzy Hash: 6E319034B107088FCB44EF28C89456E7BBAAFC9600B10855AD402DB365EF70AD46CBD2

Function 085834A0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c433b22dc377623220c8aa7defcae1384d04b78bab3c52b98f68658849a535
Instruction ID: 00aa08bc89ba941e0735a58715d891f354d9f5212fdd69ba27727e610f1be091
Opcode Fuzzy Hash: c4c433b22dc377623220c8aa7defcae1384d04b78bab3c52b98f68658849a535
Instruction Fuzzy Hash: 25312D35A00219DBDF04EFA4D954AEEB7B6FF88712F108029D811B73A4CB35AD05CBA0

Function 08585E28 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4131c6425133c8aba32aa4bdfb871d03f26a4c17d83d324c804147f49ffb4b
Instruction ID: dcba6e797ef8ad31fc5d834546ef1a3c39c4929973f477b64f0b301d3e33bf59
Opcode Fuzzy Hash: 3c4131c6425133c8aba32aa4bdfb871d03f26a4c17d83d324c804147f49ffb4b
Instruction Fuzzy Hash: E4317E34B107188FCB44EF64C894A6EB7BAAFC8700F10855AD5029B354DF70AD46CBD1

Function 0858ABB8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b970cff8e3440ee283916e1a87c52e7bc52d4fca7ae8b43e75c8071c0b9c2ae
Instruction ID: 7867dd18ebc9164efd44af6f8c43c1dda7f0e42953d9b10e0c675e25a2ee1f01
Opcode Fuzzy Hash: 7b970cff8e3440ee283916e1a87c52e7bc52d4fca7ae8b43e75c8071c0b9c2ae
Instruction Fuzzy Hash: F0217F35A10218DFCB169FA9C4549DE7FB6FB8D321F14412AE415BB390DA319841CFA1

Function 0329D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4125932447.000000000329D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0329D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_329d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673c5a06d13b18133ab127c4554cd61b163f9d3110703ea309b7bb0427078369
Instruction ID: 25d604d1843115c06b08c0f900ec3fe417dbe9eabd90ad681f3fd12c66b3d42b
Opcode Fuzzy Hash: 673c5a06d13b18133ab127c4554cd61b163f9d3110703ea309b7bb0427078369
Instruction Fuzzy Hash: FC212271614200DFEF14DF24D984B26BBA5FB84314F24C5AED80A4B256C37BD487DA61

Function 08582D78 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3adafe318b5970d5071625c1629194270129d47557111c0ea1156a1f02d0cd
Instruction ID: 34df6a0e0602c625f3d094cd735c5991616690888b6e3fac36cce4e0706023c5
Opcode Fuzzy Hash: dd3adafe318b5970d5071625c1629194270129d47557111c0ea1156a1f02d0cd
Instruction Fuzzy Hash: 7821DE307107048FCB54EF24D894AAABBF6BF89311F1445AAE5069B361DB70EC05CBA2

Function 0858ABC8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94b1ee5497dd1264f3c3440d580e22859deaf41527edca494c1be5bae6cce10
Instruction ID: bdf11a02290dcdd48833602b9419a34778fc658f4e239e1a99ec5e060f50643b
Opcode Fuzzy Hash: e94b1ee5497dd1264f3c3440d580e22859deaf41527edca494c1be5bae6cce10
Instruction Fuzzy Hash: FB213D31A00218DFCB159FA9C4549EE7FB6FB8C320F14552AE411BB390DB319841CBA1

Function 0329D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4125932447.000000000329D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0329D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_329d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98571ca9a1c7f91300579d2d0c28915f0b47492da43f47c56a0bd8c2adb485b6
Instruction ID: cc3a4f2dd343018737347f63b3a3e1088d52edf78311452682e5fe7a34a1c408
Opcode Fuzzy Hash: 98571ca9a1c7f91300579d2d0c28915f0b47492da43f47c56a0bd8c2adb485b6
Instruction Fuzzy Hash: 72219A755093808FDB02CF24D994B15BF71EB46314F29C5EBD8498F2A7C33A984ADB62

Function 08582D88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7212c6a290bd248b2dcc1782275a24da76aa82001cbfeb9b33bdb30bea971f
Instruction ID: 8bfadc577f2f5a9a4b0a9a9abff723b7afa4585412f03cee1a342bc7b093276a
Opcode Fuzzy Hash: ee7212c6a290bd248b2dcc1782275a24da76aa82001cbfeb9b33bdb30bea971f
Instruction Fuzzy Hash: D4117934B107048FCB54EF28D994AAAB7F6FF88300F144569E5069B360DB70ED05DBA1

Function 0858A8C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b21d40979c23d271ba83a366a9b98eb03285c9f376e5bc1d8e07015d879946
Instruction ID: 6385cb74bfd19dd3ed6fd972c26a6bd38d4bd2c9d5ba0cf04f14c48dfa3f52ed
Opcode Fuzzy Hash: 23b21d40979c23d271ba83a366a9b98eb03285c9f376e5bc1d8e07015d879946
Instruction Fuzzy Hash: 40115E34A15225DFCB11DB58DC94EAD7BB2FF44224F05015AF411AB3A2CB75AC41CB41

Function 08588EC0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e747041da651008a430d3938ce16a71c0f5bf5047acb17f858dcd774221f109
Instruction ID: 28305b067bab5a409c7700ed11f666192ae222bb2b18042a6ece684fad013872
Opcode Fuzzy Hash: 5e747041da651008a430d3938ce16a71c0f5bf5047acb17f858dcd774221f109
Instruction Fuzzy Hash: 2C115E35119280DFC7039F64DC55D90BF72FF4621571A80DBE1449F573C626E826EB52

Function 0858388F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328ffcbd24ed529c8145a65a744acce174e843bd48793d901c8f9fc200963dad
Instruction ID: f629cd264653b0a9db3f79e631af17cd998fad07adf552d208571b2fe852b625
Opcode Fuzzy Hash: 328ffcbd24ed529c8145a65a744acce174e843bd48793d901c8f9fc200963dad
Instruction Fuzzy Hash: 8501246605E7C09FD3162BB09C654A53F70FE53351B5E84EFC4809A2A3E229884ADB62

Function 085835D9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2eeaedf9df3f73c52c89076974b35b954e0d6b79c91be9718ed79b32962cb7
Instruction ID: 2b01fa1a63e4ce3c8ec26a2935e58aa9a2e3bb9276e1cca98bfb52943c27bd06
Opcode Fuzzy Hash: ee2eeaedf9df3f73c52c89076974b35b954e0d6b79c91be9718ed79b32962cb7
Instruction Fuzzy Hash: 2D01C431300740CFC325AB38D494A7ABBA2BFC9311F5885AED0564B7A1CB35E842DB50

Function 0858B6D0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc890dfed26dba92bb45c3c8ed323e8af536fa2d941f85cc2d8bb929aa220ef
Instruction ID: 0a0c0bd46d75d81670591d9b81374bff401bdf6356d0c1b0a9f1f01829955f3d
Opcode Fuzzy Hash: 2cc890dfed26dba92bb45c3c8ed323e8af536fa2d941f85cc2d8bb929aa220ef
Instruction Fuzzy Hash: 73019231E11745DFCB01EFA9D50459DBFB5BF89321B0185AEE045EB320EB309A08CB62

Function 085835E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e350e2af78f9b550dab8c4d681cd5db489b32fd73bacce32adc8ad6db977ad82
Instruction ID: 18aaad3ba8128d5a30ba6f0d0d7a4477b2240ae8ce200226288996bc95590ffc
Opcode Fuzzy Hash: e350e2af78f9b550dab8c4d681cd5db489b32fd73bacce32adc8ad6db977ad82
Instruction Fuzzy Hash: B601B135300700DFC319AB29D454A6BBBA2BFC9721F5485ADD5164B790CB75EC42DB90

Function 08580991 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aca1e13d146d7d7611b70c5615c243d50aef232ef66e35062d441246480375c
Instruction ID: e4bf3bcbf768169a56d3ce665fa4ef4189269e9d6d3fa7adcf6651677bd03d23
Opcode Fuzzy Hash: 8aca1e13d146d7d7611b70c5615c243d50aef232ef66e35062d441246480375c
Instruction Fuzzy Hash: 4601B539300A408FC305AB65D414959BF62EFCD71171081ADE4468B764CF35EC42CF91

Function 08580718 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3576550058ed516608f7ea96d7a9eea95aebf1c4a0fb4863ce35046368704c35
Instruction ID: 700231b2800543e3f18fbbe3d88065d534dcdddce974cbffe8359fd6c75db8fa
Opcode Fuzzy Hash: 3576550058ed516608f7ea96d7a9eea95aebf1c4a0fb4863ce35046368704c35
Instruction Fuzzy Hash: 7101A4393147009FC7059B19D854E2A7BB5FF8A761B1540AAF986CB361CE31DC42CB91

Function 08580E78 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a9d5fee9e6e38cdff620ee4d0f9d1f5bdc6f869db1014e41224d9eeefcbb31
Instruction ID: 7786829666898da32a85019add353ccf205f72256f343ce7c1ce0e44468a434a
Opcode Fuzzy Hash: 68a9d5fee9e6e38cdff620ee4d0f9d1f5bdc6f869db1014e41224d9eeefcbb31
Instruction Fuzzy Hash: A4F05925308B50DBC70136295814B3F3B9EAFC2162B0440AFE440EF3D1CEB48C4683E2

Function 0858B6E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52659d91bf7a066ebc8ea90f41a8428befa3e64b34501d28992fcdb6d9c593c
Instruction ID: 0e735eec511729fb978de4706a6c5fd36b2eb50d4ae06a2a699a99438f9a760c
Opcode Fuzzy Hash: f52659d91bf7a066ebc8ea90f41a8428befa3e64b34501d28992fcdb6d9c593c
Instruction Fuzzy Hash: A2014F35E00609DFCB00EFA9D54499EBBF9FF89711F10856AE519E7310EB30AA08CB61

Function 085809A0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d69f42db5b78a2884864b44b69fdb046ab7f2eb6691c528877effce73270ee5
Instruction ID: 8781c167c4e2d08a5ddb49fbc999a44419fd6a0e8e2876d6b809b83d98e5cfdb
Opcode Fuzzy Hash: 1d69f42db5b78a2884864b44b69fdb046ab7f2eb6691c528877effce73270ee5
Instruction Fuzzy Hash: 06013C79300A149FC719AB65D46891EBBA7EFCC711B108169E9068B7A4CF36ED43CF90

Function 0328D603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4125872005.000000000328D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0328D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f3e0919e44dde37940579b077b2555b50399ff191ff31012fd66544bd5e468
Instruction ID: 79878504a489299b92fb628914f7b8e70222cdc71fb2f88dfc47de033640b197
Opcode Fuzzy Hash: 33f3e0919e44dde37940579b077b2555b50399ff191ff31012fd66544bd5e468
Instruction Fuzzy Hash: 19F0F976200614AF9720DF0AD884C23FBADFBD4674719C55AE84A4B756C671FC41CEA0

Function 0328D5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4125872005.000000000328D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0328D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981221a0bca3291f411c324931fe547dd12172fdedd74999c2e6c5f5db41ce6c
Instruction ID: 7449dc42c89088b28b0a73ab8987bd6d9830c614fcb17ac5c1e33db2a66ccce9
Opcode Fuzzy Hash: 981221a0bca3291f411c324931fe547dd12172fdedd74999c2e6c5f5db41ce6c
Instruction Fuzzy Hash: BBF03C75104640AFD315DF06CC84C23BBB9FF856607198489E88A4B352C671FC42CF60

Function 0858A96C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2617ccbb2b518718bbf0310395989322db35401e98ead64416257defafc70f
Instruction ID: 71155319b7fd43b7f310fd802404550f05b9d348d6bcd1f65122b6175aec616b
Opcode Fuzzy Hash: 7d2617ccbb2b518718bbf0310395989322db35401e98ead64416257defafc70f
Instruction Fuzzy Hash: 04F09A34A44229DBDB11EF54DC99FEEBBB6FF88221F01801AE406A72A1CB745C05CB81

Function 08580728 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1050fb77477c557a47d8fd74a7df4240605a760f069fcbfb016a59a79472270a
Instruction ID: 5f1e7178232bce60c4d87b3a2e293cc0ae3e2f82b7000014d62a88a6b6aa23df
Opcode Fuzzy Hash: 1050fb77477c557a47d8fd74a7df4240605a760f069fcbfb016a59a79472270a
Instruction Fuzzy Hash: C4F0FE353107009FC714DB19D895D3A77BAEFC9761B154069F9568B760CE72EC42CB90

Function 0858AA20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0d07fc9677809517f906e85f64f30d829bc0b03d54cdc6195e22f172ca3196
Instruction ID: edd4fe1e04f2df8e8a71a0092197fba6ea0b38af040355fe0fc5f272c9b187f6
Opcode Fuzzy Hash: 0d0d07fc9677809517f906e85f64f30d829bc0b03d54cdc6195e22f172ca3196
Instruction Fuzzy Hash: 86D02B767052400FD749E3F458241AE3797CFC5120344C4AFC149CBBA5DD744C038715

Function 08580E51 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba453eb3aa37462806fe6ecae1a4fdb277fccf74efddc0f28f1d553f53354fa
Instruction ID: e899844b4f628a3c0218128d28930c53e98a4bcdfd16e0bec9d0b1665879bfb0
Opcode Fuzzy Hash: 3ba453eb3aa37462806fe6ecae1a4fdb277fccf74efddc0f28f1d553f53354fa
Instruction Fuzzy Hash: 21D05E3810CB818FDB2A4725B81451A3F31FF8335671545DBD086DE156C5358CD6E792

Function 0858AA30 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de4fdc9cd3d89c41449b57523f7f3c1f4521b8424d446edba71df78cdb3693c
Instruction ID: b85004a269cbd46fa5486ba81255449de0706ee0a613353a3ac3d693d8505e7e
Opcode Fuzzy Hash: 5de4fdc9cd3d89c41449b57523f7f3c1f4521b8424d446edba71df78cdb3693c
Instruction Fuzzy Hash: 42D0C93A7102184BCB0CA6FAA8145AF72DFDBC9261B54846A950A87B54CDB4AC0146A9

Function 0858B120 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06150eb54a0b148cfbe97e4de79b33de7796373b84db63b020960085c2754088
Instruction ID: 864a5d874e1a7436052e1aa423417cea2c5426c2c2e18a8201c10076b5bfb28a
Opcode Fuzzy Hash: 06150eb54a0b148cfbe97e4de79b33de7796373b84db63b020960085c2754088
Instruction Fuzzy Hash: 66D05E3800E2C08FC307CB14C851800BF31EF87265728C4CBD0449F163C6269907C753

Function 0858B000 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
Instruction ID: c12b2347baa4506d4b9b0775252a941ea42cb00b0745f27be9e95f8055e2471b
Opcode Fuzzy Hash: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
Instruction Fuzzy Hash: F0C0023B3500149F87009B6DF884C99B7B9EBD9675320816BF209CB230C67298159B50

Function 085806F0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7513fe45aeee413f326979f8c2824296ab76e6bba30175a3655019aaece2d77
Instruction ID: d872a967db28a978c0b0eb49c2043918d33cfc796799ceb6808d578454397424
Opcode Fuzzy Hash: d7513fe45aeee413f326979f8c2824296ab76e6bba30175a3655019aaece2d77
Instruction Fuzzy Hash: ACD09E3504D7809FC3029B24E8558657FB19E56661B2AC4DAE1C8CB173C2358CA5CB12

Function 08580700 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 085838C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca88d1fc480568cc1818dc8828829097fc693fef84d779e1cda7e618d365864
Instruction ID: 1e2973e350cfdb6d215468bc93f9e09787770a2bc36312318141bc1725f43a4b
Opcode Fuzzy Hash: 0ca88d1fc480568cc1818dc8828829097fc693fef84d779e1cda7e618d365864
Instruction Fuzzy Hash: 30B09232004308AB8600AA84E908855BB69EB58600B00C025A609061119B32A822DA94

Non-executed Functions

Function 08581108 Relevance: 5.2, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

(_kq, xrefs: 085817BD
(_kq, xrefs: 085817B3
(_kq, xrefs: 0858182A
(_kq, xrefs: 085817F4

Memory Dump Source

Source File: 00000008.00000002.4154248720.0000000008580000.00000040.00000800.00020000.00000000.sdmp, Offset: 08580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8580000_workbook.jbxd

Similarity

API ID:
String ID: (_kq$(_kq$(_kq$(_kq
API String ID: 0-3111510350
Opcode ID: 8aa0eedc0b08126ba29033f7088219d8a59db27ab1b5f024994d46d989963358
Instruction ID: bb5b48506edef1231dc33cf856eced1f59359036b149f1fde3c38f254e8b698c
Opcode Fuzzy Hash: 8aa0eedc0b08126ba29033f7088219d8a59db27ab1b5f024994d46d989963358
Instruction Fuzzy Hash: 2461D234A44744CFC705EF78D4544AE7FB2BF8A21072444AEE446EB3A2DA35DC86CB91

Analysis Process: workbook.exePID: 1836, Parent PID: 5960COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	463
Total number of Limit Nodes:	38

Executed Functions

Function 05BEC90C Relevance: 1.6, APIs: 1, Instructions: 118
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(EC8B5505,00000000,?), ref: 05BEE259

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: bec10d94735c65875514595820294838b147c07ae3c89b3c8b2ea9885ae6cf3c
Instruction ID: 4465284aac28b45e3eac7fe61007a71be05ab31ca35ab5dcafd3777f330e3f64
Opcode Fuzzy Hash: bec10d94735c65875514595820294838b147c07ae3c89b3c8b2ea9885ae6cf3c
Instruction Fuzzy Hash: 3541B171A042059FDB14DF99C844BAEFBF9EF88310F18846AE419E7350DB38A941CB65

Function 05BE2B64 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05BE4411

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 09e9e1b89a9b677636358e170e46fef70aa5cbf942b76061aa54ce404e5ef8d4
Instruction ID: 0090760e46adf02e70fa5bc028c11cb2b84ae01455ebd3ddad86bcbe268c9c26
Opcode Fuzzy Hash: 09e9e1b89a9b677636358e170e46fef70aa5cbf942b76061aa54ce404e5ef8d4
Instruction Fuzzy Hash: 5A411BB5A00205CFCB14DF99C488AAAFBF5FF88314F28C499D519A7321D775A841CFA0

Function 01B56414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01B57421

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b534f616c2c9a1fce7adf347b4f5fcacbf91092d286119aaf90ba595ae349f0c
Instruction ID: f4b9665a3827bb58f65206468ff5a4a61a39c827dcda25e676a6a434beae144a
Opcode Fuzzy Hash: b534f616c2c9a1fce7adf347b4f5fcacbf91092d286119aaf90ba595ae349f0c
Instruction Fuzzy Hash: 2141C3B1D0061DCFDB24DFA9C84479DBBB5BF48304F64809AD408AB255DB756945CF90

Function 01B57364 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01B57421

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 798ac80556205b315c7488e71f4be115e2eda39b641ee6e31f67480d878b27a6
Instruction ID: ed09c134bd966720c7b30c16a82bb93477a6c157f5cabc2c3bd9dfd2ecf0cffd
Opcode Fuzzy Hash: 798ac80556205b315c7488e71f4be115e2eda39b641ee6e31f67480d878b27a6
Instruction Fuzzy Hash: 6541D2B1D00619CFDB24CFA9C844BDEBFB5BF49304F64809AD408AB255DB796945CF90

Function 01B56780 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01B5674E,?,?,?,?,?), ref: 01B5680F

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 717cf38d4301761ed707f813668a89c72dc667e88f3866f36ecd1efe207d0212
Instruction ID: 3f09db136c61b1ebccc064d84abab2ec2f1d5fc15ad105326dd91cce31cf8ec4
Opcode Fuzzy Hash: 717cf38d4301761ed707f813668a89c72dc667e88f3866f36ecd1efe207d0212
Instruction Fuzzy Hash: EA316CB5A002089FCF00CF99D884AEEBFF5FB88320F14805AE954A3350D739A940CFA4

Function 05BEB168 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 3b2fb07852dfd6318cf77fd07983975ead4daf71690c8064d135b68490893c49
Instruction ID: 2ce29947ae5897701699a0b14ea19650da40cd34f851be03de09623c5d01d8ef
Opcode Fuzzy Hash: 3b2fb07852dfd6318cf77fd07983975ead4daf71690c8064d135b68490893c49
Instruction Fuzzy Hash: 76318B729043599FCB11DFA9D844AEEBFF8FF09350F18809AE554A7221C335A854CFA1

Function 01B5611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,01B5674E,?,?,?,?,?), ref: 01B5680F

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3cbdf95ba07ecec616d0cef57573b43c941aba67ea508e8053ffd5bf848e4b95
Instruction ID: 22eb1bbec49687e6d0c0f848c078dfa5115d0b88868a2a9d8c64680dabb151b7
Opcode Fuzzy Hash: 3cbdf95ba07ecec616d0cef57573b43c941aba67ea508e8053ffd5bf848e4b95
Instruction Fuzzy Hash: 9E21E3B59002489FDB50CF9AD984AEEFFF4EB48320F14845AE954A7310D378A944CFA5

Function 05BEC91C Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(EC8B5505,00000000,?), ref: 05BEE259

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 052373f153769176853a63275e418bbec46a621543fed175113b6e3d1f248c18
Instruction ID: 970f5c800f7517b4fb4c1332018df748d0397a64908d03c2f4271db0ece9fc22
Opcode Fuzzy Hash: 052373f153769176853a63275e418bbec46a621543fed175113b6e3d1f248c18
Instruction Fuzzy Hash: F22147B1904249CFDB14CF9AC844BEEFBF8FB88320F14846AE455A7250D778A944CFA5

Function 05BE9D7C Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,05BEB182,?,?,?,?,?), ref: 05BEB227

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 80fa142a979b51bb683a7dcbcb9a467f2fec51d5dc6dfc770e01662d24405f12
Instruction ID: 28e5a6d8755bb548ed1620e8c0dbac19fd0567ff3a56153ab3388fc9d1298a95
Opcode Fuzzy Hash: 80fa142a979b51bb683a7dcbcb9a467f2fec51d5dc6dfc770e01662d24405f12
Instruction Fuzzy Hash: 7A1126B6804249DFDB10CF9AD844AEEBFF8FF48320F14845AE954A7210C375A950CFA5

Function 01B5C294 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,01B5C6D1,00000800,00000000,00000000), ref: 01B5C8E2

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9174074a28ed90303ce36d3c66634ec4d5cc9bb7cbfb22267ae4f8b79db66cb6
Instruction ID: 9095fff457b3098addc9a22c6e64c3466f8ac1fab0b9a3c7e46aed4fd07e5f3c
Opcode Fuzzy Hash: 9174074a28ed90303ce36d3c66634ec4d5cc9bb7cbfb22267ae4f8b79db66cb6
Instruction Fuzzy Hash: 2D1103B69003498FDB14CF9AD444AAEFBF9EB48320F10846AD919A7210C375A544CFA4

Function 01B5C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01B5C256

Memory Dump Source

Source File: 0000000D.00000002.1788548885.0000000001B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b50000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8db9715f6d1557a704bfa355d6eb909c948fe65d5b94f4b1aa467b72963258c0
Instruction ID: ecf99d76b988a6441628a213c2d5e17abd5d993004219e14d2ab7a4bdff7a556
Opcode Fuzzy Hash: 8db9715f6d1557a704bfa355d6eb909c948fe65d5b94f4b1aa467b72963258c0
Instruction Fuzzy Hash: 2B110FB6C003498FDB14DF9AC444BDEFBF9EB88324F10846AD829A7610C379A545CFA5

Function 05BE2010 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05BE2075

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d51b421a0c38687f9e2852ace9e48050f2dcfa52b4060a75b52af8bd0454c97d
Instruction ID: 1b885dfec06dc812c4d20769ff802faa1c77f8d186822b0597863000e741b7a5
Opcode Fuzzy Hash: d51b421a0c38687f9e2852ace9e48050f2dcfa52b4060a75b52af8bd0454c97d
Instruction Fuzzy Hash: 7A1125B58002488FCB10CF9AC584BEFFBF8EB48310F14841AD859A7350C374A944CFA0

Function 05BE9DC0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05BEB58D

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a16086b1f298a5ece4e2bcdef4a5a727af6403e6a076b55a5c9fb9f79d5527d2
Instruction ID: bf6d21a2615ba83302d8e94e7e4f62e7d8f813c110cca2ab7430f9d52a71e1e7
Opcode Fuzzy Hash: a16086b1f298a5ece4e2bcdef4a5a727af6403e6a076b55a5c9fb9f79d5527d2
Instruction Fuzzy Hash: 9711F2B58003499FCB10DF9AD485BEEBBF8FB48324F14845AE958A7200D375A944CFA5

Function 05BEB52B Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05BEB58D

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6d1894c4961cc2eabe36769f7d20137ecb21dc19a00c6375788d2f7377630bf7
Instruction ID: f196145fa74c50f963c10bb6cb6354be926ee700bd8b9c4192c79e29812f4edd
Opcode Fuzzy Hash: 6d1894c4961cc2eabe36769f7d20137ecb21dc19a00c6375788d2f7377630bf7
Instruction Fuzzy Hash: 781103B58003489FCB10DF9AD885BDEFBF8FB48324F14845AE558A7200C375A944CFA5

Function 05BE2018 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05BE2075

Memory Dump Source

Source File: 0000000D.00000002.1802031477.0000000005BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5be0000_workbook.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2771054b649a2145b62b28a1a24ca27d4e7b74b1de59b1a42f5dcc6802993943
Instruction ID: 3661a60042ea843e89cd4f823ddde31a894a909b3333c94a7dbc1bda4a5eb553
Opcode Fuzzy Hash: 2771054b649a2145b62b28a1a24ca27d4e7b74b1de59b1a42f5dcc6802993943
Instruction Fuzzy Hash: 161112B5800249CFDB10DF9AD484BEEFBF8EB48324F24845AD959A7350C375A944CFA5

Function 01B0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1788210496.0000000001B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b0d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5571eca886e5389d97c218a98e32946f721046cfee7fd4b77d51af4c2433d9e2
Instruction ID: 5fbb5d6508cda43b3387091fab3e52896c9d9dd129a1ac59a87114860ac0f0c9
Opcode Fuzzy Hash: 5571eca886e5389d97c218a98e32946f721046cfee7fd4b77d51af4c2433d9e2
Instruction Fuzzy Hash: 40212271604200DFDB1ADF98D994B26BFA5FB88354F20C6ADD80E4B2D6D33AD447CA61

Function 01B0D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1788210496.0000000001B0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1b0d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96364319b1347acb3d8121327acccf93a35692fb6db1052983f091775d3fa404
Instruction ID: 9aa9acf770b22d393da083cc8010e46b6356b6227b90bc01b4a27093a920a8a1
Opcode Fuzzy Hash: 96364319b1347acb3d8121327acccf93a35692fb6db1052983f091775d3fa404
Instruction Fuzzy Hash: 492192755083809FCB07CF54D994B11BF71EB4A314F28C5DAD8498F2A7D33A980ACB62

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report doc_rfq Oferta KH 09281.pdf.com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_rfq Oferta KH 09281.pdf.com.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\workbook.exe.log

C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
doc_rfq Oferta KH 09281.pdf.com.exe

Function 02DC7470 Relevance: 2.8, Strings: 1, Instructions: 1528
COMMON

Function 02DC7460 Relevance: 2.7, Strings: 1, Instructions: 1406
COMMON

Function 00F6D031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre