Edit tour

Windows Analysis Report
DHL Shipping documents 0020398484995500.exe

Overview

General Information

Sample name:	DHL Shipping documents 0020398484995500.exe
Analysis ID:	1523785
MD5:	1506261e1a6e12c9eadfcbe91a859f76
SHA1:	061aa09172c0daef3fc975919a02413ab3a6f01e
SHA256:	0dc8ced22931e20ec965bc36c06a974016fe223434d9553007b4a6c04973b2cb
Tags:	DHLDHLIndonesiaexeuser-ngokoptmp
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL Shipping documents 0020398484995500.exe (PID: 5016 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

DHL Shipping documents 0020398484995500.exe (PID: 6380 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

DHL Shipping documents 0020398484995500.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe" MD5: 1506261E1A6E12C9EADFCBE91A859F76)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1269cd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1619fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x19c81d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x126a3f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x161a6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x19c88f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x126ac9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x161af9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x19c919:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x126b5b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x161b8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x19c9ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x126bc5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x161bf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x19ca15:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x126c37:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x161c67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x19ca87:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x126ccd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x161cfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x19cb1d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x123d0d:$s2: GetPrivateProfileString 0x15ed3d:$s2: GetPrivateProfileString 0x199b5d:$s2: GetPrivateProfileString 0x123410:$s3: get_OSFullName 0x15e440:$s3: get_OSFullName 0x199260:$s3: get_OSFullName 0x124ae1:$s5: remove_Key 0x124ca9:$s5: remove_Key 0x15fb11:$s5: remove_Key 0x15fcd9:$s5: remove_Key 0x19a931:$s5: remove_Key 0x19aaf9:$s5: remove_Key 0x125bd1:$s6: FtpWebRequest 0x160c01:$s6: FtpWebRequest 0x19ba21:$s6: FtpWebRequest 0x1269af:$s7: logins 0x126f21:$s7: logins 0x129c32:$s7: logins 0x129ce4:$s7: logins 0x12b636:$s7: logins 0x1619df:$s7: logins
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1683fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a342d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1de24d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16846f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a349f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1de2bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1684f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a3529:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1de349:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16858b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a35bb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1de3db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1685f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a3625:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1de445:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x168667:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a3697:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1de4b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1686fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a372d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1de54d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x16573d:$s2: GetPrivateProfileString 0x1a076d:$s2: GetPrivateProfileString 0x1db58d:$s2: GetPrivateProfileString 0x164e40:$s3: get_OSFullName 0x19fe70:$s3: get_OSFullName 0x1dac90:$s3: get_OSFullName 0x166511:$s5: remove_Key 0x1666d9:$s5: remove_Key 0x1a1541:$s5: remove_Key 0x1a1709:$s5: remove_Key 0x1dc361:$s5: remove_Key 0x1dc529:$s5: remove_Key 0x167601:$s6: FtpWebRequest 0x1a2631:$s6: FtpWebRequest 0x1dd451:$s6: FtpWebRequest 0x1683df:$s7: logins 0x168951:$s7: logins 0x16b662:$s7: logins 0x16b714:$s7: logins 0x16d066:$s7: logins 0x1a340f:$s7: logins
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DHL Shipping documents 0020398484995500.exe

Avira: detected

Found malware configuration

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for domain / URL

Source: ftp.concaribe.com	Virustotal: Detection: 6%			Perma Link
Source: http://ftp.concaribe.com	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Source: DHL Shipping documents 0020398484995500.exe	ReversingLabs: Detection: 34%
Source: DHL Shipping documents 0020398484995500.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DHL Shipping documents 0020398484995500.exe

Joe Sandbox ML: detected

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: DHL Shipping documents 0020398484995500.exe	String found in binary or memory: https://github.com/dnSpy/dnSpy/wiki/Debugging-Unity-Games

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL Shipping documents 0020398484995500.exe

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 0_2_0149E00C	0_2_0149E00C
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDA228	3_2_00FDA228
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDE770	3_2_00FDE770
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FDAAB0	3_2_00FDAAB0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD4A58	3_2_00FD4A58
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD3E40	3_2_00FD3E40
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_00FD4188	3_2_00FD4188
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7A8B4	3_2_06A7A8B4
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7A598	3_2_06A7A598
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7BDF0	3_2_06A7BDF0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7DBF0	3_2_06A7DBF0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A956A0	3_2_06A956A0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A966C0	3_2_06A966C0
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9C240	3_2_06A9C240
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A92380	3_2_06A92380
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9B300	3_2_06A9B300
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A97E40	3_2_06A97E40
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A97760	3_2_06A97760
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A9E468	3_2_06A9E468
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A90040	3_2_06A90040
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A95DC8	3_2_06A95DC8
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A90006	3_2_06A90006

Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareGame.dll: vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2049391209.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050654227.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000000.00000000.2044424346.0000000000BB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepoiliu.exe. vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513950685.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs DHL Shipping documents 0020398484995500.exe
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: OriginalFilenamepoiliu.exe. vs DHL Shipping documents 0020398484995500.exe

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/0@2/2

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Mutant created: NULL

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL Shipping documents 0020398484995500.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe	ReversingLabs: Detection: 34%
Source: DHL Shipping documents 0020398484995500.exe	Virustotal: Detection: 40%

Source: unknown	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: DHL Shipping documents 0020398484995500.exe, RandomGenerator.cs	.Net Code: Polan System.AppDomain.Load(byte[])
Source: DHL Shipping documents 0020398484995500.exe, MonoTypeLoaderImpl.cs	.Net Code: Load
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateInstance
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateInstanceNoConstructor
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateSZArrayCore
Source: DHL Shipping documents 0020398484995500.exe, DbgMonoDebugInternalRuntimeImpl.cs	.Net Code: CreateArrayCore

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: 0xEB230CD7 [Tue Jan 4 01:26:47 2095 UTC]

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A7FEF0 push es; ret		3_2_06A7FEF4
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Code function: 3_2_06A73FB7 push 2406B7DAh; retf		3_2_06A73FD5

Source: DHL Shipping documents 0020398484995500.exe

Static PE information: section name: .text entropy: 7.455106876960115

Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.DHL Shipping documents 0020398484995500.exe.57d0000.2.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 1490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Memory allocated: 13B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597947	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Window / User API: threadDelayed 2108			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Window / User API: threadDelayed 7747			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 940	Thread sleep count: 2108 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 940	Thread sleep count: 7747 > 30	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -598058s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597947s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597835s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595526s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe TID: 1088	Thread sleep time: -594437s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 598058	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597947	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595526	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: ResumeVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: InitializeVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: get_VirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: get_MonoVirtualMachine
Source: DHL Shipping documents 0020398484995500.exe	Binary or memory string: VirtualMachineManager
Source: DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4515719034.00000000010AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Process created: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe "C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.DHL Shipping documents 0020398484995500.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.405c9b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipping documents 0020398484995500.exe.401af80.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 5016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL Shipping documents 0020398484995500.exe PID: 6396, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	111 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL Shipping documents 0020398484995500.exe	34%	ReversingLabs	Win32.Trojan.GenSteal
DHL Shipping documents 0020398484995500.exe	41%	Virustotal		Browse
DHL Shipping documents 0020398484995500.exe	100%	Avira	HEUR/AGEN.1307569
DHL Shipping documents 0020398484995500.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.ipify.org	0%	Virustotal	Browse
concaribe.com	3%	Virustotal	Browse
ftp.concaribe.com	6%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.ipify.org/t	0%	Virustotal		Browse
http://ftp.concaribe.com	6%	Virustotal		Browse
https://github.com/dnSpy/dnSpy/wiki/Debugging-Unity-Games	0%	Virustotal		Browse
http://concaribe.com	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false	0%, Virustotal, Browse	unknown
concaribe.com	192.185.13.234	true	true	3%, Virustotal, Browse	unknown
ftp.concaribe.com	unknown	unknown	true	6%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.concaribe.com	DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse	unknown
https://account.dyn.com/	DHL Shipping documents 0020398484995500.exe, 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://concaribe.com	DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://api.ipify.org/t	DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL Shipping documents 0020398484995500.exe, 00000003.00000002.4517263503.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/dnSpy/dnSpy/wiki/Debugging-Unity-Games	DHL Shipping documents 0020398484995500.exe	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
192.185.13.234	concaribe.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523785
Start date and time:	2024-10-02 02:42:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL Shipping documents 0020398484995500.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:43:05	API Interceptor	12327486x Sleep call for process: DHL Shipping documents 0020398484995500.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
192.185.13.234	draft bl_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	concaribe.com/wp-includes/assets/GkRyQpLAQhPD144.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	104.26.13.205
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	104.26.12.205
	ELECTRONIC RECEIPT_Opcsa.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	172.67.74.152
	grace.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://www.canva.com/design/DAGSL2lLp_4/lQGTdiRa89y3fkgkaFc-uQ/edit?utm_content=DAGSL2lLp_4&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Bank Payment $38,735.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Shipping documents 000029393994400000000000.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://docs.google.com/presentation/d/e/2PACX-1vRuKBrQqA6BNfxZo0BAmhaaVHWHS5xGpGnvHJ3KKWtc6LdsEuOoWSlBNaOKZjp5GXLjhWJKRMb-grou/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.21.46.216
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	104.21.55.67
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://t1.global.clubavolta.com/r/?id=h53ebcb4b,29506a5f,2988ba3e&e=cDE9UkVEX0dMX0xveWFsdHlMYXVuY2hTb2x1cy1OT0NPTS1BTEwtMDExMDIwMjQtMV9YWCZwMj1kNzEwNWE1Zi00NjE3LWVmMTEtOWY4OS0wMDBkM2EyMmNlYTE&s=MLotNdk8aEH7W1636YhgxIdQC5od3UWYqTZw3tm9630	Get hash	malicious	Unknown	Browse	172.67.180.104
	http://www.johnhdaniel.com	Get hash	malicious	Unknown	Browse	104.18.36.155
	https://convertwithwave.com	Get hash	malicious	Unknown	Browse	104.18.30.234
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.152.190
	http://detection.fyi	Get hash	malicious	NetSupport RAT, Lsass Dumper, Mimikatz, Nukesped, Quasar, Trickbot, Xmrig	Browse	104.26.4.62
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	104.22.51.98
	https://dvs.ntoinetted.com/kJthYXSER3TmsdtC7bAT5eXqQ/#geir@byggernfauske.no	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
UNIFIEDLAYER-AS-1US	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://email.mg.pmctraining.com/c/eJwUzDGOhSAQANDTSCfBAQQL2n-PgRmUDaAh_E329hvbVzwKpJF3Ehw2B84ro50WV0j68CYB2SNnQrVvLloHPjtLjAq9KAFAJ7thXDVQWlEdcfVg82oOBTo6s9ucFqPaKZ-W5sDSSz9lupuogbhPrBkT10n4ooxjgU8jXuDzfeqNJJ_rESP8fLGXiXJw6ddd6S3_GnaczPIep_gN8B8AAP__bcA-Lw	Get hash	malicious	HTMLPhisher	Browse	216.172.173.3
	https://sharing.clickup.com/9011385758/t/h/868a15nvk/VTTN7SYFPHZE3IT	Get hash	malicious	HTMLPhisher	Browse	67.20.70.239
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	108.179.194.43
	https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=	Get hash	malicious	HTMLPhisher	Browse	108.179.252.163
	Sales_Contract_Main_417053608_09.2024.pdf	Get hash	malicious	Unknown	Browse	192.185.12.194
	https://abby-gatenby.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVNucEJVREU9JnVpZD1VU0VSMDMwOTIwMjRVNDYwOTAzMDE=N0123N	Get hash	malicious	Unknown	Browse	192.185.129.84
	https://thebrasilians.hosted.phplist.com/lists/lt.php?tid=KkkFBgMBXQUHUEsCB1QHTwZWAFYbCQpVBx0EBQABCgADAgJXVl1FVAIAUVFdUVhPBgUCVBsEA1JVHQ8BW1cUUAQGV1cBAF1aUgNQHVAHBFEFBgVRGwEAVQEdAlcLUBQKBAEDHlMAAVILAVBQBwUDBA	Get hash	malicious	Unknown	Browse	50.6.153.166
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	69.49.245.172

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://tvsurf.jp/	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://sanbernardinoscounty.telcom-info.com/	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	104.26.12.205
	Pedido09669281099195.com.exe	Get hash	malicious	DarkTortilla, Quasar	Browse	104.26.12.205
	https://finalstepgetshere.com/uploads/beta9.zip	Get hash	malicious	LummaC	Browse	104.26.12.205
	https://k7qo.sarnerholz.cam/APRjVfmk	Get hash	malicious	Unknown	Browse	104.26.12.205
	origin.bin.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	origin.bin.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Play_VM-Now(Tina.lawvey)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.442780006094083
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	DHL Shipping documents 0020398484995500.exe
File size:	525'824 bytes
MD5:	1506261e1a6e12c9eadfcbe91a859f76
SHA1:	061aa09172c0daef3fc975919a02413ab3a6f01e
SHA256:	0dc8ced22931e20ec965bc36c06a974016fe223434d9553007b4a6c04973b2cb
SHA512:	d8491578697b3308925637c9981d1544095741586e9369cec9330f8948c8dd7a09ffe9bf450f25e4c4a21e91eff00283d10e615acb866748dece290897ee88b5
SSDEEP:	12288:d4S3sE6hTGrF3CKf04A1+0MX2dsFvs1HGqR:yh6rF3CKf1A1zKxJsZP
TLSH:	11B4D01963F8472BE9EF4779F0240801C7B6FA87A0A7DF4D9984A8FD1853350EA5136B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#...............0.............N.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x481b4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEB230CD7 [Tue Jan 4 01:26:47 2095 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x81b00	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7fb54	0x7fc00	941f472dd27c93adbd306139e5342a67	False	0.7201947773972602	data	7.455106876960115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0x596	0x600	4d94965f2f43483401a63532580aca61	False	0.4134114583333333	data	4.027908067359779	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x84000	0xc	0x200	ebb0228a152846e4924fc2be7bac6fee	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x820a0	0x30c	data			0.42948717948717946
RT_MANIFEST	0x823ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 02:43:04.199244022 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.199284077 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.199392080 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.205997944 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.206012011 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.688038111 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.688110113 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.692524910 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.692543030 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.692883968 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.743757963 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.747919083 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.795397997 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.875178099 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.875344038 CEST	443	49706	104.26.12.205	192.168.2.5
Oct 2, 2024 02:43:04.875449896 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:04.911546946 CEST	49706	443	192.168.2.5	104.26.12.205
Oct 2, 2024 02:43:06.272665977 CEST	49709	21	192.168.2.5	192.185.13.234
Oct 2, 2024 02:43:06.277501106 CEST	21	49709	192.185.13.234	192.168.2.5
Oct 2, 2024 02:43:06.277648926 CEST	49709	21	192.168.2.5	192.185.13.234
Oct 2, 2024 02:43:06.281378031 CEST	49709	21	192.168.2.5	192.185.13.234
Oct 2, 2024 02:43:06.286196947 CEST	21	49709	192.185.13.234	192.168.2.5
Oct 2, 2024 02:43:06.286279917 CEST	49709	21	192.168.2.5	192.185.13.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 02:43:04.182080030 CEST	50619	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:43:04.188905954 CEST	53	50619	1.1.1.1	192.168.2.5
Oct 2, 2024 02:43:05.958652020 CEST	61161	53	192.168.2.5	1.1.1.1
Oct 2, 2024 02:43:06.271703005 CEST	53	61161	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 02:43:04.182080030 CEST	192.168.2.5	1.1.1.1	0x1342	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:43:05.958652020 CEST	192.168.2.5	1.1.1.1	0xe8bc	Standard query (0)	ftp.concaribe.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 02:43:04.188905954 CEST	1.1.1.1	192.168.2.5	0x1342	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:43:04.188905954 CEST	1.1.1.1	192.168.2.5	0x1342	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:43:04.188905954 CEST	1.1.1.1	192.168.2.5	0x1342	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 2, 2024 02:43:06.271703005 CEST	1.1.1.1	192.168.2.5	0xe8bc	No error (0)	ftp.concaribe.com	concaribe.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 02:43:06.271703005 CEST	1.1.1.1	192.168.2.5	0xe8bc	No error (0)	concaribe.com		192.185.13.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.26.12.205	443	6396	C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 00:43:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-02 00:43:04 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 02 Oct 2024 00:43:04 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cc0a7fb0ae68c4d-EWR
2024-10-02 00:43:04 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	20:43:02
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Imagebase:	0xbb0000
File size:	525'824 bytes
MD5 hash:	1506261E1A6E12C9EADFCBE91A859F76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2050716658.0000000003FD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:43:02
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Imagebase:	0x330000
File size:	525'824 bytes
MD5 hash:	1506261E1A6E12C9EADFCBE91A859F76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:43:02
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL Shipping documents 0020398484995500.exe"
Imagebase:	0xa20000
File size:	525'824 bytes
MD5 hash:	1506261E1A6E12C9EADFCBE91A859F76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4517263503.0000000002EBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4517263503.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4513145018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	78
Total number of Limit Nodes:	8

Executed Functions

Function 0149D470 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0149D4FE
GetCurrentThread.KERNEL32 ref: 0149D53B
GetCurrentProcess.KERNEL32 ref: 0149D578
GetCurrentThreadId.KERNEL32 ref: 0149D5D1

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9f5bbf60892b75610a52dd05896464bf5341e85609bb496c023e8c6ddf5c912b
Instruction ID: 7bc3978d2f3dc6ace7ba9f86db405a51a3a8a4dfd429a605636375ebe1a5fa50
Opcode Fuzzy Hash: 9f5bbf60892b75610a52dd05896464bf5341e85609bb496c023e8c6ddf5c912b
Instruction Fuzzy Hash: 0B5127B09003498FDB18DFA9D548B9EBFF1FF88314F248459D419AB360D7389944CB65

Function 0149D480 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0149D4FE
GetCurrentThread.KERNEL32 ref: 0149D53B
GetCurrentProcess.KERNEL32 ref: 0149D578
GetCurrentThreadId.KERNEL32 ref: 0149D5D1

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: eeaa1b639e6106b928e0b312b8bd97638edbcbb693452fab5bae5dbba410066d
Instruction ID: bad571de97b35d95b584fba149f611409fd2cdd3263e95b98e6f4cb409088e00
Opcode Fuzzy Hash: eeaa1b639e6106b928e0b312b8bd97638edbcbb693452fab5bae5dbba410066d
Instruction Fuzzy Hash: 945135B09003498FDB18DFA9D548B9EBFF5FF88314F208459D519AB360D7389944CB65

Function 0149B1E8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B43E

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3b93770738f6c2dbd7b42b80a15f9b138e66f09ee0e8cf5526b6930bec07dc1e
Instruction ID: 543a8827a9ec7bd4a9620bf2c554097214d15442b98346ef4dc22e6d23220982
Opcode Fuzzy Hash: 3b93770738f6c2dbd7b42b80a15f9b138e66f09ee0e8cf5526b6930bec07dc1e
Instruction Fuzzy Hash: ED713670A00B058FDB24DF6AE044B5ABBF1FF88204F108A6ED49ADBB64D774E445CB90

Function 01495915 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959D1

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4c8fdf02174a95b80e9092030bd2dd9a9e0a8bf17f351e00a3a6253d429d24e9
Instruction ID: 4025c90d7f85fb9fc900499c1b55f6d807d700e95a1328a5cb26747b6375f718
Opcode Fuzzy Hash: 4c8fdf02174a95b80e9092030bd2dd9a9e0a8bf17f351e00a3a6253d429d24e9
Instruction Fuzzy Hash: 7341F1B0C00619CFEB25DFA9C884BDEBBF5BF49304F20805AD408AB264DB755946CF91

Function 014944E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014959D1

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 72006015bcc5f96ce7882fcac318ed84a61f2ef088eae9b980710de48e1cb9b2
Instruction ID: e9fe79a6cf038806a1ecfdef8e1a63e72a96ea6cc3bf9c8f036402fd1e409c2d
Opcode Fuzzy Hash: 72006015bcc5f96ce7882fcac318ed84a61f2ef088eae9b980710de48e1cb9b2
Instruction Fuzzy Hash: 0D41D1B0C00719CFDB25DFA9C844B9EBBF5BF49304F20806AD408AB265DB756946CF91

Function 0149D6C8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0149D74F

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 54f0971c1760a3d8bebbd1583102e0fadb61e8218f0c90c8b126634d02172c74
Instruction ID: ebfe7b68ef8847be5831e326ec7bec6f8577f6f7290ee81beac7e24a98039ed6
Opcode Fuzzy Hash: 54f0971c1760a3d8bebbd1583102e0fadb61e8218f0c90c8b126634d02172c74
Instruction Fuzzy Hash: 8A21E2B5D002489FDB10CFAAD984ADEBFF9FB48310F14801AE918A3310D378A940CFA1

Function 0149D6C1 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0149D74F

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fbf76cac82b77f4ae67383676f7d2199e600b40fb3b492f871be8ab60ce2cae0
Instruction ID: f04a3452e3a989409229886a581534afd6fa0a26aa1752e8e58ed6fbb2b553ba
Opcode Fuzzy Hash: fbf76cac82b77f4ae67383676f7d2199e600b40fb3b492f871be8ab60ce2cae0
Instruction Fuzzy Hash: B92103B5C002489FDB10CFAAD984ADEBFF4EB48320F14811AE918A3350D338A944CFA1

Function 01499CE0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 01499D55

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: d3c4f63c4ad945e69512592383eff93a6a44a371fc953684a5ae25c18e094e89
Instruction ID: 3ff94d0614d93790e49fc5bf7c0089b5e3f899e4cbd614b79df40776f86d9ec8
Opcode Fuzzy Hash: d3c4f63c4ad945e69512592383eff93a6a44a371fc953684a5ae25c18e094e89
Instruction Fuzzy Hash: 2521AEB0804398CFDB21CFA9D4447EEBFF4EB05314F14449AC5A9AB256D3395909CFA1

Function 0149B3D2 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B43E

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aabf0b8ec98adda73105aaf2c3384e1a71940300b7d121dbebc4a21f6f1ddb17
Instruction ID: 26c11f7730261c147778ed793ee200201fff5c2f1b983b0f54a87a0937749285
Opcode Fuzzy Hash: aabf0b8ec98adda73105aaf2c3384e1a71940300b7d121dbebc4a21f6f1ddb17
Instruction Fuzzy Hash: 781120B5C007488FDB20DF9AD444ADEBBF4EF88324F10852AC529A7650C378A544CFA0

Function 0149B3D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0149B43E

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 30c847d8528761c733827589c8cd74b71e3a154d97604d8ff231e70fd0ee25e6
Instruction ID: 3e9a1aefc99ad92fd9c7ca13b5a0ad1be42eeb2f1aeb82a0a5b46e2e64274306
Opcode Fuzzy Hash: 30c847d8528761c733827589c8cd74b71e3a154d97604d8ff231e70fd0ee25e6
Instruction Fuzzy Hash: 69111DB6C002498FDB10CF9AD444ADEFBF9EF88324F10842AD929A7710C379A545CFA1

Function 0113D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049130640.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f196911d6aefb393f784555fa402cdfd4837248b0c169bf2f972271054869c95
Instruction ID: 3c59d1c46d7b31c557343b6598e98a018db98aa733ef74847803c38939afd89e
Opcode Fuzzy Hash: f196911d6aefb393f784555fa402cdfd4837248b0c169bf2f972271054869c95
Instruction Fuzzy Hash: 21210071604200DFDF19DFA8E980B26FF65FB88714F60C569E94A0B25AC33AD406CA62

Function 0113D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049130640.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2abb2bccde7827d42c7a59aaa43e8ed39c4d52164bd8b83b7af2a007c4d36e
Instruction ID: e594d8c0af72ccea2959db82aed2301ebf81e5510725d091c75516d2b0c390fd
Opcode Fuzzy Hash: ed2abb2bccde7827d42c7a59aaa43e8ed39c4d52164bd8b83b7af2a007c4d36e
Instruction Fuzzy Hash: 8B2180755083809FCB07CF64D994B11BF71FB86214F28C5DAD8498F2A7C33A981ACB62

Non-executed Functions

Function 0149E00C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049913355.0000000001490000.00000040.00000800.00020000.00000000.sdmp, Offset: 01490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1490000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932dc78e044309a2676d3e96f40f961dfc10ce733786b519760623f5e2d33ba3
Instruction ID: 51559ec80c14fdf1cb41b23099acc5fae0f10f97a174ce082bafd5e0e735f0e6
Opcode Fuzzy Hash: 932dc78e044309a2676d3e96f40f961dfc10ce733786b519760623f5e2d33ba3
Instruction Fuzzy Hash: 7DA14B32E002168FCF19DFB5C88459EBFB2FF95300B15456AE906BB265DB31D95ACB80

Analysis Process: DHL Shipping documents 0020398484995500.exePID: 6396, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	83
Total number of Limit Nodes:	11

Executed Functions

Function 06A92380 Relevance: 9.0, Strings: 6, Instructions: 1518COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A93857
$]q, xrefs: 06A93863
$]q, xrefs: 06A9383A
$]q, xrefs: 06A9387B
$]q, xrefs: 06A93887
$]q, xrefs: 06A9382E

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 6a7a35f58589325222d029d4ea1e21021a9d5efef82ce99d223270e511770635
Instruction ID: 7edeb5c250fcf0196a9d6b52e7eabcfa227a991175c849b592ebe9803f223f16
Opcode Fuzzy Hash: 6a7a35f58589325222d029d4ea1e21021a9d5efef82ce99d223270e511770635
Instruction Fuzzy Hash: 99E23734A102198FDF64EF68C584B9DB7F2FF89300F6485A9E409AB265DB34ED85CB50

Function 06A9B300 Relevance: 8.3, Strings: 6, Instructions: 760COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A9BC8D
$]q, xrefs: 06A9BCC1
$]q, xrefs: 06A9BC99
$]q, xrefs: 06A9BC65
$]q, xrefs: 06A9BC59
$]q, xrefs: 06A9BCCD

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 0cccaf3de4c0ce20049a0346d342d23173d0cb6891292071f84f5e5ee2435b24
Instruction ID: 128fffd3fac4a0302f23c54eda17ca87fc67d6e7d099bd28059cc415af66fb5f
Opcode Fuzzy Hash: 0cccaf3de4c0ce20049a0346d342d23173d0cb6891292071f84f5e5ee2435b24
Instruction Fuzzy Hash: C1524E30E102098FDF64EB69E5907AEB7F6EB89310F208925E405DB695DB34EC45CBB1

Function 06A97E40 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A983DB
$]q, xrefs: 06A983E7

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: e389e0f5488e379eb85de0510f290a2a303f6d616c47a27bcf4d018afd02b657
Instruction ID: cf9ddfa533d0e94e4a61844705b129c0d8311eaf5ea037bd33a4270ff3ce2228
Opcode Fuzzy Hash: e389e0f5488e379eb85de0510f290a2a303f6d616c47a27bcf4d018afd02b657
Instruction Fuzzy Hash: 6B029D30B002158FCF54EB69D590A6EB7E6FF85304F248929E409DB395DB39EC46CBA1

Function 06A966C0 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89b45a070110c3b45e9c722fe51f7e4d01d97b50b5ed941a230ec405ca7a883
Instruction ID: 1be167ba5c458890525e63a242a86cc2b02915b8662e1789e6731f41151292ea
Opcode Fuzzy Hash: e89b45a070110c3b45e9c722fe51f7e4d01d97b50b5ed941a230ec405ca7a883
Instruction Fuzzy Hash: 1562AF34A102148FEF54EB68D994BADB7F2EF84314F248429E406DB395DB35EC46CBA0

Function 06A9C240 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81f55da7c9d6ba42491645b01bff1865eed88f37b789dd355e9c48faa879452
Instruction ID: d941b5eb4d318983b95dcda891045ebf2656fee8a86539ed7e57552b8fd64e09
Opcode Fuzzy Hash: c81f55da7c9d6ba42491645b01bff1865eed88f37b789dd355e9c48faa879452
Instruction Fuzzy Hash: EE327034B006198FDF54EB69D980AADB7F6FB88320F208525E406DB355DB35EC46CBA1

Function 06A956A0 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e98bca506a662eef34134834de65150b4664cf174283ece5e0945fb772f090
Instruction ID: 5eaad3fe5fb57670e7f059de1166d9390e93a45566f934127a5521fa1bacbb5a
Opcode Fuzzy Hash: c3e98bca506a662eef34134834de65150b4664cf174283ece5e0945fb772f090
Instruction Fuzzy Hash: 4512E231F102159BDF65EF64D88166EB7F2EB84310F248829E81A9F345DB34ED46CBA1

Function 06A9AD98 Relevance: 10.4, Strings: 8, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A9AF3B
$]q, xrefs: 06A9AF70
$]q, xrefs: 06A9AF47
$]q, xrefs: 06A9AF64
$]q, xrefs: 06A9AEB9
$]q, xrefs: 06A9AF18
$]q, xrefs: 06A9AF0C
$]q, xrefs: 06A9AEC5

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: ef844418779a4ee512e7c903d4f2ae4dcab8c3d800adf1d812238c06f01ff7d4
Instruction ID: a6cdae7ca6fd6fd7164bd627b3687fa760c830f9c66df174c14390d9ee0601fc
Opcode Fuzzy Hash: ef844418779a4ee512e7c903d4f2ae4dcab8c3d800adf1d812238c06f01ff7d4
Instruction Fuzzy Hash: AFE18130E102198FCF68EF69D5806AEB7F6FF85304F20852AE5099B355DB35D846CBA1

Function 06A7320A Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A7328E
GetCurrentThread.KERNEL32 ref: 06A732CB
GetCurrentProcess.KERNEL32 ref: 06A73308
GetCurrentThreadId.KERNEL32 ref: 06A73361

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aaf25d5541c395a904613751416cc86df995c669ffd53f356a5c62405a9eefe6
Instruction ID: 2f01d15411492c3a1cfecca0b8037880b6272f57c5288f1ccba8308efa196678
Opcode Fuzzy Hash: aaf25d5541c395a904613751416cc86df995c669ffd53f356a5c62405a9eefe6
Instruction Fuzzy Hash: 445146B09002498FDB55EFA9D948BEEBBF1FF48304F248459E419A7360D738A944CB65

Function 06A73210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06A7328E
GetCurrentThread.KERNEL32 ref: 06A732CB
GetCurrentProcess.KERNEL32 ref: 06A73308
GetCurrentThreadId.KERNEL32 ref: 06A73361

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2ccdf4fdcc3ca84834a755b94b4148e2c4a8d4b1a780d1414996ec877bf19f4c
Instruction ID: 224d1350685adce92d4c3a38041642918233f2529f719c3fce80dc17d7fe5624
Opcode Fuzzy Hash: 2ccdf4fdcc3ca84834a755b94b4148e2c4a8d4b1a780d1414996ec877bf19f4c
Instruction Fuzzy Hash: 275147B09003498FDB54EFAAD948BEEBBF5FF48304F208459E419A7350D739A944CBA5

Function 06A99210 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A9928C
$]q, xrefs: 06A992BB
$]q, xrefs: 06A992C7
$]q, xrefs: 06A99280

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 06de9620a8a445986808e0db2e148f45bcd95ce0f360f2afe2dee5b3599b5765
Instruction ID: 8c72959ddada261b0cadb8b6efffe753ba290c2827e49cc86d97d2b5456ebe1b
Opcode Fuzzy Hash: 06de9620a8a445986808e0db2e148f45bcd95ce0f360f2afe2dee5b3599b5765
Instruction Fuzzy Hash: 0F913C30B0061A9BDF54EB69D850BAFB3F6BF85304F248569D409AB345EF30AD468B91

Function 06A9D008 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A9D413
$]q, xrefs: 06A9D3FF
$]q, xrefs: 06A9D407

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 1d680c87bd473fc168d44c9f47ea75f97971b033ab7c5992a3e573be46696f14
Instruction ID: d7bd8464187ea5add2ff5d15541cbef2f84fd587ed0e542b483315f1cad5c228
Opcode Fuzzy Hash: 1d680c87bd473fc168d44c9f47ea75f97971b033ab7c5992a3e573be46696f14
Instruction Fuzzy Hash: F9624E34A006198FCF55EF69E580A5EB7F6FF84304B208A29D0099F369DB75ED46CB90

Function 06A94C68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Obq, xrefs: 06A94E43
XPbq, xrefs: 06A94DB9
fbq, xrefs: 06A94C93

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: ee44fe69b324dc49da40f6222e57d89a2fde04add4eaa0499cc22e553de6be04
Instruction ID: 746030a6f30ce28dae746f9656ed948356fba582c80b9dc85906ddae8749b657
Opcode Fuzzy Hash: ee44fe69b324dc49da40f6222e57d89a2fde04add4eaa0499cc22e553de6be04
Instruction Fuzzy Hash: EB616430E002199FDF54AFA5C8557AEBBF6FF88300F208429E106AB395DF754D468BA1

Function 06A99200 Relevance: 2.7, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06A992BB
$]q, xrefs: 06A99280

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 077ff96da05eeccc9c6f88f2c175e79bdd7a6761a2c6830042fe778c98919f5b
Instruction ID: 5c4ce502b7a9a318e81c10acd33f99becae660222c24d9263130213fa48dae82
Opcode Fuzzy Hash: 077ff96da05eeccc9c6f88f2c175e79bdd7a6761a2c6830042fe778c98919f5b
Instruction Fuzzy Hash: A2514F30B005199FDF54EB79D850B6E73F6BB89304F148569D409DB389EF30AD468B91

Function 06A94C59 Relevance: 2.6, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06A94DB9
fbq, xrefs: 06A94C93

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: 4a2a444c56ff263db5fd0562a776a02821e9440a8c5c4fe389a9c962fa153aca
Instruction ID: de2fa402de19986991b4598c9cdaa0970e06e5910451fc4414f390e548924bd0
Opcode Fuzzy Hash: 4a2a444c56ff263db5fd0562a776a02821e9440a8c5c4fe389a9c962fa153aca
Instruction Fuzzy Hash: 3A516130F002199FDF549FA5C855BAEBAF6FF88700F208529E106AB395DF749C069B91

Function 06A7B708 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06A7B96E

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 01b9e92abe7f24c9e666c7e232473989828a8eb25fa452e2b3a1c58ca77cd105
Instruction ID: 06f4935cc56f7496318c1fc0df53a1ee416cd3aa38ec5ed90c73f2b2d753c85b
Opcode Fuzzy Hash: 01b9e92abe7f24c9e666c7e232473989828a8eb25fa452e2b3a1c58ca77cd105
Instruction Fuzzy Hash: AC8138B0A00B058FD7A4EF29D94479ABBF1FF48300F00892ED49ADBA51D735E945CBA1

Function 06A7D8E4 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A7DA02

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b661787dab19d15c92c8e64212523958ed15ac9f3ffa1ad5c5c7423269648cff
Instruction ID: 6f5c985d641829b9d52858e42d633f17093d5c322e38ce145e0203965ee5beed
Opcode Fuzzy Hash: b661787dab19d15c92c8e64212523958ed15ac9f3ffa1ad5c5c7423269648cff
Instruction Fuzzy Hash: E351C0B1D00349EFDB14DF99C884ADEBFB5BF48310F24812AE819AB210D775A885CF90

Function 06A7D8F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A7DA02

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 866a3886c1fe606271553dac948001f4124d4a5d9480c946e14565829ea2e47d
Instruction ID: 9e8007dbc8ca225083c58e4811bb037dadc688571a859bde601b486a02f5c8a6
Opcode Fuzzy Hash: 866a3886c1fe606271553dac948001f4124d4a5d9480c946e14565829ea2e47d
Instruction Fuzzy Hash: 7941BFB1D10349DFDB14DF9AC884ADEBFB5BF49310F24812AE819AB210D775A985CF90

Function 06A73450 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A734DF

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 50f06663052d0300982c865c145cae802eaad26bc69d82109f2dce09bb38cf41
Instruction ID: f79222448c4ca724467dc408557616fe48bbf07c734dcf8d80316a414c73b94c
Opcode Fuzzy Hash: 50f06663052d0300982c865c145cae802eaad26bc69d82109f2dce09bb38cf41
Instruction Fuzzy Hash: 3B2103B5C002089FDB10CFAAD984ADEBBF8EF48310F14801AE918A3210D379A940DFA1

Function 06A73458 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06A734DF

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 526443da161c53004732c469ccfaf90d1a7d716c74afb9c98f053e0e61fabdf6
Instruction ID: ff64b9ce2d07667898be3f0b3c53d4a01f6af979b675c40e0743e5c8d301972f
Opcode Fuzzy Hash: 526443da161c53004732c469ccfaf90d1a7d716c74afb9c98f053e0e61fabdf6
Instruction Fuzzy Hash: 1B21E4B59002099FDB10DF9AD984ADEBBF8FB48310F14801AE918A3310D379A940DFA5

Function 00FDECC7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00FDED47

Memory Dump Source

Source File: 00000003.00000002.4515648443.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fd0000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: ba62112d9a24ae4957eaf83a6ae9093e61e6ee39bf383c30a5944a256a50eb32
Instruction ID: 58d31e12acac70f0a0bbb4009b5be7d2982e0883247e3f7d28594cddb170c898
Opcode Fuzzy Hash: ba62112d9a24ae4957eaf83a6ae9093e61e6ee39bf383c30a5944a256a50eb32
Instruction Fuzzy Hash: FA2133B1C0065A9FCB10DFAAC5457EEFBB5AF09310F14816AD918B7241D778A944CFA1

Function 00FDECE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00FDED47

Memory Dump Source

Source File: 00000003.00000002.4515648443.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fd0000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c20bcf1fbc6d70caef6c1a384a6c0a2a44cd98b7f65ae922640779d18c4ae50b
Instruction ID: 8baaadbb144c30bcd79a50afeec99e707b993269a0468d1fc3f13b862a99bd5a
Opcode Fuzzy Hash: c20bcf1fbc6d70caef6c1a384a6c0a2a44cd98b7f65ae922640779d18c4ae50b
Instruction Fuzzy Hash: 4711EFB1C0065A9BCB10DF9AC544AEEFBF5AF49320F14816AD918A7240D778A944CFA5

Function 06A7B908 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06A7B96E

Memory Dump Source

Source File: 00000003.00000002.4520498307.0000000006A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a70000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d1f09244b9def640b7c2b9b140b6390266333fb45aaff08d9e16172031021d89
Instruction ID: bdfa9c38a75d104893b8e464e0f62fcf5343f0e3b4551698a27951d7bc49de7d
Opcode Fuzzy Hash: d1f09244b9def640b7c2b9b140b6390266333fb45aaff08d9e16172031021d89
Instruction Fuzzy Hash: E911E0B5C003498FCB10DF9AC844ADEFBF4EF99314F10842AD869A7210D379A545CFA1

Function 06A9DB7D Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A9DCD9

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: f47fe7faeaed158019117839093a9c5cdd0df6dd66809d729727b0aa6989bab8
Instruction ID: 5168fd33741763a86d981ec3c14268a7bf187fd889508b5f82921392f1337ad9
Opcode Fuzzy Hash: f47fe7faeaed158019117839093a9c5cdd0df6dd66809d729727b0aa6989bab8
Instruction Fuzzy Hash: 81418130E0060A9FDF54BF75D8546AEBBF2BF85300F204529D405EB244EBB4A986DBA1

Function 06A921E5 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A92333

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d74aa9c7def1bbee82555c57356a1ae7f9edd5f56274b0af77a5fedb648b0864
Instruction ID: 1e6a03476ed140ead18e167a68e69bb4054a5d932616b18740ef99d60c13ffce
Opcode Fuzzy Hash: d74aa9c7def1bbee82555c57356a1ae7f9edd5f56274b0af77a5fedb648b0864
Instruction Fuzzy Hash: CF31C230B20205AFCF89AB74D9547AE77E2EF89204B208579D406DB395DF34DE06CBA5

Function 06A921F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06A92333

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: aeef44e8576670d8348130dae6137cbff0ac905c248838f81eedde98d6f68d26
Instruction ID: 9441a217750b3789362b974fa68e8471a4cdaa6ac20f0aa6bca9f85ea69345cb
Opcode Fuzzy Hash: aeef44e8576670d8348130dae6137cbff0ac905c248838f81eedde98d6f68d26
Instruction Fuzzy Hash: 3931CF30B20205AFDF88AB74D95476E7BE6AF89204F208578D406DB395DF34DE06C7A5

Function 06A98390 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A983DB

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: cf17d88ceadf7739fb7af2a47eb653a3163ddc0bc2ad5a1f149934bdfc12ab4e
Instruction ID: 12862e374e83f1ceafa9b5fbe9a2fda711ac55214d8d7732ec8fe4d7b52d15fa
Opcode Fuzzy Hash: cf17d88ceadf7739fb7af2a47eb653a3163ddc0bc2ad5a1f149934bdfc12ab4e
Instruction Fuzzy Hash: 4CF0A431B001158FDF64AF59E980579B7F8EF82314F244966E905CB245D739D906CBA1

Function 06A9B2F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09ea07840a7bc1dfd16034e5be044f1fd1f088b96279c014003aecd04febce1
Instruction ID: ed0ba5cde6250d80913b311e244bf59a2f394c610c9291a83d2555024c8fe096
Opcode Fuzzy Hash: c09ea07840a7bc1dfd16034e5be044f1fd1f088b96279c014003aecd04febce1
Instruction Fuzzy Hash: 9FA14370E101199FEF64EB6DE9907AF76E6EB89310F304825E405DB395CA38DC819B72

Function 06A9B708 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc37114074c19baa179dbc85f7b08656ff08a0e80cdcdffedfeb2ff697ad395
Instruction ID: bce65256ab5605d74c991d51dc9122cef3ce57c4a0c7a87f4c34d4d5c7892d72
Opcode Fuzzy Hash: 9bc37114074c19baa179dbc85f7b08656ff08a0e80cdcdffedfeb2ff697ad395
Instruction Fuzzy Hash: 88A11930E1010A8BDFA4EB69E580BAEB7F2EB45314F208926E419DF651D734E885CB71

Function 06A962C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4203168483321987823a2858b23a92f85597b419e47eb29ba01e757a4cc37585
Instruction ID: 70af02db6dd65deecae5b196d76b6a2cdf466fc845610a2063ab34cc6201fe53
Opcode Fuzzy Hash: 4203168483321987823a2858b23a92f85597b419e47eb29ba01e757a4cc37585
Instruction Fuzzy Hash: 2A619F71F000214FDF54AB7ED89055FBADAAF94220B254479E80EDB364EE79ED0287E1

Function 06A94399 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2284269633669d7d80c5b81b3cd0339c764b1406b09138617b2b816b15f02e8b
Instruction ID: 9032d803d6fd2b2e9330c6f734ed16be5bc9b36744f610807630206c7ddf78fa
Opcode Fuzzy Hash: 2284269633669d7d80c5b81b3cd0339c764b1406b09138617b2b816b15f02e8b
Instruction Fuzzy Hash: 27813C30B002098BDF54EFA9C45469EB7F2EF89314F208529E50ADB395DB35EC478B92

Function 06A946B8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987380c4332360b4821449e981e80fa0bcc1d265065d8942f755850aefdaf9ec
Instruction ID: 555b566acecdab9ca11c81d9c533af66c1af770a1f2ea2b3a442a58ea92a0fa7
Opcode Fuzzy Hash: 987380c4332360b4821449e981e80fa0bcc1d265065d8942f755850aefdaf9ec
Instruction Fuzzy Hash: 47913E30E002198FDF60DF68C890B9DB7B1FF89314F208695D549BB355EB74AA86CB91

Function 06A946D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76428d4b44bb333e88a361562d6556aa5222a5c59ee81114af05464309d95db
Instruction ID: ab2c85d61ea81e6daff67db7960c6e6ddcbf9fa9792baf5141fac251ff38e404
Opcode Fuzzy Hash: f76428d4b44bb333e88a361562d6556aa5222a5c59ee81114af05464309d95db
Instruction Fuzzy Hash: 15912D34E002198BDF64DF68C890B9DB7B1FF89304F208595D549BB355EB70AA86CB91

Function 06A9EFE8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc6bda229c50b25e11566fa0fca22428661097974c248268b6d2b5ad7931069
Instruction ID: 780fc84c0df119b70c6d86d9beabb7d1c20416cd3ad14732ed13fd9fc4458995
Opcode Fuzzy Hash: 5bc6bda229c50b25e11566fa0fca22428661097974c248268b6d2b5ad7931069
Instruction Fuzzy Hash: EC714C70A002099FDB44EFA9D990A9DBBF6FF88304F248429E005EB355DB34ED46CB60

Function 06A9EFD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9793721bb778465572687b6e474bae991ada2f0283d6c2503f0336f32c8abded
Instruction ID: d0a1f1a5a44ad647ca5e75c4d7ee1cf88b490a3a1f9baacc501d1c96b935a9b4
Opcode Fuzzy Hash: 9793721bb778465572687b6e474bae991ada2f0283d6c2503f0336f32c8abded
Instruction Fuzzy Hash: 5B716D74A002099FCB44EFA9C980A9DB7F6FF88300F248529E005EB355DB34EC46CB60

Function 06A9FC78 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1639bb0053a6615700da6477e5b4bba09d5dd1afedb5aec1ac73770d0a6243fe
Instruction ID: 53feb007ee9d93b577c72d0f03b397f5c23bcc1d05642f52d31df34e4dea024c
Opcode Fuzzy Hash: 1639bb0053a6615700da6477e5b4bba09d5dd1afedb5aec1ac73770d0a6243fe
Instruction Fuzzy Hash: 4051DF31E001099FCF54FBB9E8446ADB7F2FF85215F20886AE00ADB351DB359946CBA1

Function 06A9FA18 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fd1474a7c80a7ccfb5e39b31b0f99a182ca0cb068ce3ed1a07fdfe60111c70
Instruction ID: 5b2921d6e5947433fb7de2301b2b4aeb6e18f3050c3de8cee382e1f5e0f815dd
Opcode Fuzzy Hash: 64fd1474a7c80a7ccfb5e39b31b0f99a182ca0cb068ce3ed1a07fdfe60111c70
Instruction Fuzzy Hash: 2B51C974B102149FEF647B6DD95472F26AEDB8D310F30452AE80AD7396CA6CCC4683B2

Function 06A9FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546ee1eefc9afee1717757cbd433f9b7fc2699d38c6f0f6efbba9426d6246c63
Instruction ID: 2f8fb2b467555148aee54a88a12bbe1ac1cc05981534815333d30d9749f5d1f2
Opcode Fuzzy Hash: 546ee1eefc9afee1717757cbd433f9b7fc2699d38c6f0f6efbba9426d6246c63
Instruction Fuzzy Hash: B251A774B102149FEF647B6DD95472F259ED78D310F30452AE80ADB79ACA6CCC4683B2

Function 06A95520 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b092067298cc1e3ab3284e670d79140bf9d70096955b10e151790c3c33fde650
Instruction ID: a8a7f51263fe830b5e3b3e9e7fc83b3a2fc4ea0c29c87a3ea438538bf362ca3f
Opcode Fuzzy Hash: b092067298cc1e3ab3284e670d79140bf9d70096955b10e151790c3c33fde650
Instruction Fuzzy Hash: 14416D71E006098BDF61DFA9D8C1AAFF7F2EB85310F20492AE256D7610D731E945CBA1

Function 06A920A8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c71081b25176385e4ead7ae6e3bff00380b02e2363f9a317c3a6da08725582
Instruction ID: d14047fbdd4d8d5e4992e27464baaa4d920dadd2125ada3c95f791056fa116c1
Opcode Fuzzy Hash: 79c71081b25176385e4ead7ae6e3bff00380b02e2363f9a317c3a6da08725582
Instruction Fuzzy Hash: 5D316D35E202159BCF59EF64C85479EB7F2EF89300F20C529E916EB750DB31A946CB60

Function 06A920B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5e653e47031dfe010d6a5d2788e8ecd998278a89b5121f1c8d7205409e1a4b
Instruction ID: 5d9037ecedfe88d506a18a01d238900995f27c5439df8ce74407036c12af8b57
Opcode Fuzzy Hash: 7c5e653e47031dfe010d6a5d2788e8ecd998278a89b5121f1c8d7205409e1a4b
Instruction Fuzzy Hash: BC315C34E202059BCF59EF65C85479EB7F2AF89300F208529E91AEB350DB71A946CB60

Function 06A93B98 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7073c80b74ed4077bfa3e0ff089303154cbe74c29b6e23e50f0baec20d29732
Instruction ID: c73ddbc51174718e68d712531178e0d169156c8c2a1404c406fe917a1a6a2974
Opcode Fuzzy Hash: d7073c80b74ed4077bfa3e0ff089303154cbe74c29b6e23e50f0baec20d29732
Instruction Fuzzy Hash: D9219F75E00A199FDF50EF6AD880AAEB7F5AB48710F108125E905E7351E734E9018BA5

Function 06A93BA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908e3afaf7219a661d5956f5d3cf6ffe56a7a6a192a040b0dabb0ce00908faff
Instruction ID: 3f6334702f789bff7be33a536ce51232d30ac098f85c4ff082d16ab90e5d7ded
Opcode Fuzzy Hash: 908e3afaf7219a661d5956f5d3cf6ffe56a7a6a192a040b0dabb0ce00908faff
Instruction Fuzzy Hash: 6221B275F00A299FDF50DF6AD880AAEB7F5EB48310F104125E905E7341E730E901CBA5

Function 00F7D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514789334.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f7d000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8081055b9362d6358a84170df63fd64ccbad4ebcd04f1a386069c711470ce70
Instruction ID: 0d8d5e3779ccd6c34b89f9e6fa648bc4ca86f89456e497bcc323aa09e2befcf1
Opcode Fuzzy Hash: c8081055b9362d6358a84170df63fd64ccbad4ebcd04f1a386069c711470ce70
Instruction Fuzzy Hash: 68214D7150D3C09FCB03CB24D994711BF71AF46214F29C5EBD8898F2A7C23A980ADB62

Function 00F7D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4514789334.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f7d000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681abf1860a93c66faeab571cd18f49d8c20c0c3e2a1fed6f134d78c6919f3c8
Instruction ID: 912abebdb85e9826e3de816fcfc86b900cc42f06b33ea9bf0bc2685f26f252a5
Opcode Fuzzy Hash: 681abf1860a93c66faeab571cd18f49d8c20c0c3e2a1fed6f134d78c6919f3c8
Instruction Fuzzy Hash: 0C212271504204DFCB14DF24D980F26BBB5FF84324F64C56AD80E0B29AC33AD806EA63

Function 06A93CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc30dfe109a61be2f1553240514ac6992ed51952abd52da876811b5d48a67fcb
Instruction ID: 533b7f8154369a24697da4b941b926df6c1b90165eeed4c9891707d035d7b5d6
Opcode Fuzzy Hash: fc30dfe109a61be2f1553240514ac6992ed51952abd52da876811b5d48a67fcb
Instruction Fuzzy Hash: AE11A136B105284BDF54E679D8246AE73F6EBC8610F10463AE40AEB344EE35DC068BE1

Function 06A95511 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430fbad4661647c079483c874ea60c593c96a309387fc0f41714a8b660a79efd
Instruction ID: 422cb681b849b1bc7d2ba6745b658da71b84061cbd7daca84639955f55095242
Opcode Fuzzy Hash: 430fbad4661647c079483c874ea60c593c96a309387fc0f41714a8b660a79efd
Instruction Fuzzy Hash: E7117C71A007059BCF21DFA9CCC19AFFBF6FF84200F248929D25596650D731A805CBA0

Function 06A942F8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05aa072664374e6bb84dc07ead563c63bcc58494d8c66384cc48a65cf1b48c6e
Instruction ID: 7d7f5d95c63e3a145c423da949ba6e7a3fa38d32b638e16a200bdb2f781dad36
Opcode Fuzzy Hash: 05aa072664374e6bb84dc07ead563c63bcc58494d8c66384cc48a65cf1b48c6e
Instruction Fuzzy Hash: DF018C35B001100BDBA5967DA40876FBBEADBCA714F25883EE14ECB346E965DC028791

Function 06A93CA8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e49873b513b2c377c51382ebab0373a52572793216b3a73211ebc67dc5b49aa
Instruction ID: 25691794f23e873fd8287c6460b14a79c2f58ef40f1a85b4278fcbecd195b8c8
Opcode Fuzzy Hash: 1e49873b513b2c377c51382ebab0373a52572793216b3a73211ebc67dc5b49aa
Instruction Fuzzy Hash: C601F536B1002847DF85A679CC587AF72FAEBC4610F114136D40AD7340EE20E80A87E1

Function 06A93158 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54226acb90b2d87d10a1972865591261d249647405b6cc86aabc3ec6b2d6ac92
Instruction ID: 4fdc3cd97f7029e69766627d9798f60070a2b36bf34ec9f62f2214be51bea4e0
Opcode Fuzzy Hash: 54226acb90b2d87d10a1972865591261d249647405b6cc86aabc3ec6b2d6ac92
Instruction Fuzzy Hash: D701A175E002298ACF68EB79C8505DEF7F5EB8A310F20856AD51AE7214DA30DA41CBB1

Function 06A93978 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302ef641b1f4b7360474b33dd78931a464dd0c0a42abba93f9aa51df6c158a71
Instruction ID: 23505eb82acef26b702f2d6e3620c180e0e38e0024ae267d1fc16d15f4c6e29f
Opcode Fuzzy Hash: 302ef641b1f4b7360474b33dd78931a464dd0c0a42abba93f9aa51df6c158a71
Instruction Fuzzy Hash: 8F11B3B5D012599FCB00DF9AD885ADEFFF8FB49310F10812AE918A7240C379A954CFA5

Function 06A93970 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c6fb08da72ce2a9c17832436fc6524d3f8bb6bf4bcea55d2795bdafd7dc5be
Instruction ID: beee5bf6ad0bca25f30eafbf27edfd59243f877022cd80ad8edbc39a44c00940
Opcode Fuzzy Hash: e6c6fb08da72ce2a9c17832436fc6524d3f8bb6bf4bcea55d2795bdafd7dc5be
Instruction Fuzzy Hash: 7521CEB5D01259AFCB10DF9AD885ADEFBB4FB49310F10816AE918B7200C378A954CFA5

Function 06A94308 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c315510bf941b9af9d1d445fecd414e3104e8800a764670a9a961368bcfe3847
Instruction ID: 169a8c3e7b3467bcf4198a63cbd91edc7d3361802778227d102dd15064d089d0
Opcode Fuzzy Hash: c315510bf941b9af9d1d445fecd414e3104e8800a764670a9a961368bcfe3847
Instruction Fuzzy Hash: EF016D35B100100BDFA4A67DE55472FF6DADBC9714F20843AE10ECB345EA65DC0343A1

Function 06A9F259 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778cf96ce4590adc17b369b353d999a0a1a24f6eef12959aa43b0ac676bdc311
Instruction ID: f33f572ed2e8a12f2ffff598e67fceeb51bc15cb8d1c4c093e1ea3cd813c6055
Opcode Fuzzy Hash: 778cf96ce4590adc17b369b353d999a0a1a24f6eef12959aa43b0ac676bdc311
Instruction Fuzzy Hash: 1001D435B000504FCF55E7AC945172E77E6DB89614F24897AE10ACB341EA24DC0683A1

Function 06A9A3C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241788beb2a415a0c8422c103cf5c116e8be4ccfa3a3b69a1eb909c4b49f5c13
Instruction ID: e98198127f6f2fbaca3ee2283f924c509e8a032916e6b0c82629fe6723d39f20
Opcode Fuzzy Hash: 241788beb2a415a0c8422c103cf5c116e8be4ccfa3a3b69a1eb909c4b49f5c13
Instruction Fuzzy Hash: 68018F35B104204FDB60AE7CE95472A6BE6EBC9714F20843AE60BCB391DE25DC0387A1

Function 06A9F268 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9ae65bc83824924bf52dd4dd5a18e030a800aa5ea6a732fa5beb93e3b69e29
Instruction ID: df543a2912fac29df62231c1a06876f45eb1123545c3d22b9643eeba5f7318b2
Opcode Fuzzy Hash: 8a9ae65bc83824924bf52dd4dd5a18e030a800aa5ea6a732fa5beb93e3b69e29
Instruction Fuzzy Hash: 21018135B100100FDF65A6ADD454B2E77DADBCA725F208439E50ECB340DE25DC0243A5

Function 06A9A3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641242523a05686e651c69d9bc6e4e6fe5a1fafc9545ba4a7c3ce199f22831d8
Instruction ID: bc4c4f5ab5ddcc282bb85adc4499e98f2bbd58bf516993751535829da674cd5a
Opcode Fuzzy Hash: 641242523a05686e651c69d9bc6e4e6fe5a1fafc9545ba4a7c3ce199f22831d8
Instruction Fuzzy Hash: 29016235B104244FCB50AA6DD454B1A77E6DBC9714F208439E60BCB395EE25DC028791

Function 06A9C898 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e499e0db22e7914b3dda5b0d24f9f88af1b4f6873e1891846475a28c3b35c160
Instruction ID: 761b459c331591c8c268e2b49d17df77c91749f46e6f64c2728c7d40722221f8
Opcode Fuzzy Hash: e499e0db22e7914b3dda5b0d24f9f88af1b4f6873e1891846475a28c3b35c160
Instruction Fuzzy Hash: 3CF0A736E2023897DF14B666DC006AAB37BF785760F104525E901E7744DB316C0187D0

Function 06A96540 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91d53a531e1c47f0840092ac75b6e6935a83b02dc73fdb7780fc3585e6b4dd8
Instruction ID: a2769029ccdc8f8961a65779bf78149daacf45309ce419e3960557ded12875fb
Opcode Fuzzy Hash: f91d53a531e1c47f0840092ac75b6e6935a83b02dc73fdb7780fc3585e6b4dd8
Instruction Fuzzy Hash: F2E04FB5E141089BEF90DAB0DB4A39A77F4DF42209F3099A9D409DB242E537CA429750

Function 06A96550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616f49ecab21f6605a30a3e930597ddc1706b10694b91ff6f9ff3ed03d43608b
Instruction ID: f72e3b1c32c42f8c49ee93c35d42cf2d704916d3fb91425d35b81ac77c7dd763
Opcode Fuzzy Hash: 616f49ecab21f6605a30a3e930597ddc1706b10694b91ff6f9ff3ed03d43608b
Instruction Fuzzy Hash: ACE0EC71E10108ABEF50EAA48A4975A76FDDB01218F3098A5D409DB246E577DA018760

Non-executed Functions

Function 06A97760 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A97C19
$]q, xrefs: 06A9785C
$]q, xrefs: 06A9788D
$]q, xrefs: 06A97CB8
$]q, xrefs: 06A97850
$]q, xrefs: 06A97CAC
$]q, xrefs: 06A97CCE
$]q, xrefs: 06A97881
$]q, xrefs: 06A97C0D
$]q, xrefs: 06A97CC2

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 4abb8d37e2bc8473294a3352e1ab8a2297ed73792118e976e0997981b385bc48
Instruction ID: 56c2081eca1870cfaf3b9a921ae22c0b8d32e15eef709aedf357defc32a17c71
Opcode Fuzzy Hash: 4abb8d37e2bc8473294a3352e1ab8a2297ed73792118e976e0997981b385bc48
Instruction Fuzzy Hash: 2B123B30A106198FDF68EF69C994A9DB7F2BF84304F208969D409AB355DB34DD85CFA0

Function 06A9AA00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A9AAF6
$]q, xrefs: 06A9AB7C
$]q, xrefs: 06A9ABB2
$]q, xrefs: 06A9AB02
$]q, xrefs: 06A9AB88
$]q, xrefs: 06A9ABBE
$]q, xrefs: 06A9AB51
$]q, xrefs: 06A9AB5D

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: ce236a367b30a6526681250504c33112aeffba944585d4a8071c83c8107fbe14
Instruction ID: 201f63878e8ebc38bac2a864ef002a0adbd33621738c6380dbb31a1933d647c6
Opcode Fuzzy Hash: ce236a367b30a6526681250504c33112aeffba944585d4a8071c83c8107fbe14
Instruction Fuzzy Hash: C3914F30A00209DFDF58EF69D995B6E77F6BF84304F20852AE9019B355DB34AD45CBA0

Function 06A97160 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A97674
.5uq, xrefs: 06A971BB
$]q, xrefs: 06A975FC
$]q, xrefs: 06A974A8
$]q, xrefs: 06A9749C
$]q, xrefs: 06A97442
$]q, xrefs: 06A97668

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 78dc7da6e3bfbf6627c8b67e3037f1c28c2265f3932a102e9621b58f41aca094
Instruction ID: 1520302c4cf830bfdacce117e49b7f4dedc6bc67f3ceef85e001da8261b7e80b
Opcode Fuzzy Hash: 78dc7da6e3bfbf6627c8b67e3037f1c28c2265f3932a102e9621b58f41aca094
Instruction Fuzzy Hash: ECF12B30A106098FDB58EF69D994A5EB7F6FF84300F248569E4059B369DF34EC42CBA4

Function 06A98498 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A98763
$]q, xrefs: 06A986FE
$]q, xrefs: 06A986F2
$]q, xrefs: 06A98757

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 795ac70b92118f1417431b8f97be440fac84662c10f5055c4b6d319e588c642c
Instruction ID: a32df7f7bd5e1712d37899ceaea064c704fdb29b9399a53a11e8a2e5b761c06c
Opcode Fuzzy Hash: 795ac70b92118f1417431b8f97be440fac84662c10f5055c4b6d319e588c642c
Instruction Fuzzy Hash: 32B13A30E102098FDF58EF69C99469EB7F6FF85300F248929D4069B355DB39D886CBA1

Function 06A9AD88 Relevance: 5.2, Strings: 4, Instructions: 171COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A9AF3B
$]q, xrefs: 06A9AF64
$]q, xrefs: 06A9AEB9
$]q, xrefs: 06A9AF0C

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 1e7010610267817c4a8a63692683b4eab7c350129f4c7831b3dd7eed99f49b6b
Instruction ID: 3671ed18742cad49ed1405c33c3c69c1b38f93303faa76d6f8b8a1b0d48c8428
Opcode Fuzzy Hash: 1e7010610267817c4a8a63692683b4eab7c350129f4c7831b3dd7eed99f49b6b
Instruction Fuzzy Hash: 9451A130A102149FCFA4FB68D880AADB7F2EF85314F24452AE906DB355DB34DC41CBA0

Function 06A988B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 06A9892F
LR]q, xrefs: 06A989F2
LR]q, xrefs: 06A989A3
$]q, xrefs: 06A9893B

Memory Dump Source

Source File: 00000003.00000002.4520569335.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6a90000_DHL Shipping documents 0020398484995500.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 8a99abdca015308e3e5180ec991a9940f1086c346e0e3ff5f7fe27c62fc682a7
Instruction ID: 6ffb164aa893c6d122244b3638f001da2843f02fbe8b3bf77191e895f6600611
Opcode Fuzzy Hash: 8a99abdca015308e3e5180ec991a9940f1086c346e0e3ff5f7fe27c62fc682a7
Instruction Fuzzy Hash: F351A030B002059FDF58EF69D940A6A77F6FF8A304B248969E4069B395DB38EC45C7A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL Shipping documents 0020398484995500.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
DHL Shipping documents 0020398484995500.exe

Function 0149D470 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 0149D480 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0149B1E8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 01495915 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 014944E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0149D6C8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0149D6C1 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 01499CE0 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Function 0149B3D2 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 0149B3D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06A97E40 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Function 06A9AD98 Relevance: 10.4, Strings: 8, Instructions: 398
COMMON

Function 06A7320A Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 06A73210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06A99210 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 06A9D008 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Function 06A94C68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 06A99200 Relevance: 2.7, Strings: 2, Instructions: 170
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre