Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe |
| Analysis ID: | 1530463 |
| MD5: | 0cf6e58863853ae6163cf20cfe99379c |
| SHA1: | 4284de670984d557dd6d4e1091c9eeaa089aad05 |
| SHA256: | 78a93828c62d7c6883a4121374937fbbeaec7a7f383f7fe756673859b9254821 |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 27 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 20% |
Signatures
Potentially malicious time measurement code found
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Installs a global mouse hook
Installs a raw input device (often for capturing keystrokes)
PE file contains more sections than normal
PE file contains sections with non-standard names
Potential time zone aware malware
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Classification
- System is w10x64
SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe (PID: 7316 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Trojan-Dro pper.WinGo .Agent.100 58.14118.e xe" MD5: 0CF6E58863853AE6163CF20CFE99379C)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
- • Compliance
- • Software Vulnerabilities
- • Networking
- • Key, Mouse, Clipboard, Microphone and Screen Capturing
- • System Summary
- • Data Obfuscation
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_00007FF61017B800 | |
| Source: | Code function: | 0_2_00007FF610170960 | |
| Source: | Code function: | 0_2_00007FF61017CC80 | |
| Source: | Code function: | 0_2_00007FF61015BDA0 | |
| Source: | Code function: | 0_2_00007FF6101710A0 | |
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Binary or memory string: | ||
| Source: | Windows user hook set: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00007FF610182D80 | |
| Source: | Code function: | 0_2_00007FF610195E00 | |
| Source: | Code function: | 0_2_00007FF61018C3C0 | |
| Source: | Code function: | 0_2_00007FF61018C4A0 | |
| Source: | Code function: | 0_2_00007FF61018C580 | |
| Source: | Code function: | 0_2_00007FF61018C660 | |
| Source: | Code function: | 0_2_00007FF6101B9F60 | |
| Source: | Code function: | 0_2_00007FF61018F2A0 | |
| Source: | Code function: | 0_2_00007FF61015D7C0 | |
| Source: | Code function: | 0_2_00007FF610185920 | |
| Source: | Code function: | 0_2_00007FF610195960 | |
| Source: | Code function: | 0_2_00007FF610175B20 | |
| Source: | Code function: | 0_2_00007FF61015CC20 | |
| Source: | Code function: | 0_2_00007FF61018FCA0 | |
| Source: | Code function: | 0_2_00007FF610178D00 | |
| Source: | Code function: | 0_2_00007FF610188FC0 | |
| Source: | Code function: | 0_2_00007FF610178060 | |
| Source: | Code function: | 0_2_00007FF61016B140 | |
| Source: | Code function: | 0_2_00007FF61015E2C0 | |
| Source: | Code function: | 0_2_00007FF6101B2320 | |
| Source: | Code function: | 0_2_00007FF610171300 | |
| Source: | Code function: | 0_2_00007FF610199420 | |
| Source: | Code function: | 0_2_00007FF6101CC420 | |
| Source: | Code function: | 0_2_00007FF6101A7440 | |
| Source: | Code function: | 0_2_00007FF61016B4E0 | |
| Source: | Code function: | 0_2_00007FF6101B54C9 | |
| Source: | Code function: | 0_2_00007FF6101A15C0 | |
| Source: | Code function: | 0_2_00007FF6101C5660 | |
| Source: | Code function: | 0_2_00007FF61015A640 | |
| Source: | Code function: | 0_2_00007FF6101C8700 | |
| Source: | Code function: | 0_2_00007FF610189800 | |
| Source: | Code function: | 0_2_00007FF61017B800 | |
| Source: | Code function: | 0_2_00007FF6101C1840 | |
| Source: | Code function: | 0_2_00007FF61016E960 | |
| Source: | Code function: | 0_2_00007FF61019C980 | |
| Source: | Code function: | 0_2_00007FF6101C6A00 | |
| Source: | Code function: | 0_2_00007FF610190A60 | |
| Source: | Code function: | 0_2_00007FF610172A80 | |
| Source: | Code function: | 0_2_00007FF61016AB20 | |
| Source: | Code function: | 0_2_00007FF61018CBE0 | |
| Source: | Code function: | 0_2_00007FF610165BE0 | |
| Source: | Code function: | 0_2_00007FF6101CBC00 | |
| Source: | Code function: | 0_2_00007FF61017CC80 | |
| Source: | Code function: | 0_2_00007FF6101AACC0 | |
| Source: | Code function: | 0_2_00007FF61017BCC0 | |
| Source: | Code function: | 0_2_00007FF61019FD20 | |
| Source: | Code function: | 0_2_00007FF6101C8DC0 | |
| Source: | Code function: | 0_2_00007FF6101C3E00 | |
| Source: | Code function: | 0_2_00007FF6101C1F80 | |
| Source: | Code function: | 0_2_00007FF6101C8FC0 | |
| Source: | Code function: | 0_2_00007FF61017E0A0 | |
| Source: | Code function: | 0_2_00007FF6101820C0 | |
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Code function: | 0_2_00007FF6101B8200 | |
| Source: | API coverage: | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
Anti Debugging |   |
|---|
| Source: | Code function: | 0_2_00007FF6101B8200 | |
| Source: | Code function: | 0_2_00007FF6101B8200 | |
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Code function: | 0_2_00007FF6106AA070 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Masquerading | 31 Input Capture | 1 System Time Discovery | Remote Services | 31 Input Capture | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Deobfuscate/Decode Files or Information | LSASS Memory | 11 Security Software Discovery | Remote Desktop Protocol | 1 Archive Collected Data | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | 12 System Information Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 2 Obfuscated Files or Information | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 4% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse | ||
| 0% | Virustotal | Browse |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| fp2e7a.wpc.phicdn.net | 192.229.221.95 | true | false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false |
| unknown |
⊘No contacted IP infos
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1530463 |
| Start date and time: | 2024-10-10 06:29:15 +02:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 9s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 2 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe |
| Detection: | SUS |
| Classification: | sus27.evad.winEXE@1/0@0/0 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): dllhost.exe - Excluded IPs from analysis (wh
itelisted): 20.190.160.22, 40. 126.32.74, 20.190.160.20, 40.1 26.32.134, 40.126.32.138, 40.1 26.32.76, 40.126.32.72, 20.190 .160.17, 93.184.221.240, 20.12 .23.50 - Excluded domains from analysis
(whitelisted): client.wns.win dows.com, prdv4a.aadg.msidenti ty.com, otelrules.azureedge.ne t, ctldl.windowsupdate.com.del ivery.microsoft.com, slscr.upd ate.microsoft.com, wu.ec.azure edge.net, www.tm.v4.a.prd.aadg .trafficmanager.net, ctldl.win dowsupdate.com, wu.azureedge.n et, login.msa.msidentity.com, ocsp.digicert.com, login.live. com, ocsp.edge.digicert.com, b g.apr-52dd2-0503.edgecastdns.n et, cs11.wpc.v0cdn.net, hlb.ap r-52dd2-0.edgecastdns.net, sls .update.microsoft.com, wu-b-ne t.trafficmanager.net, www.tm.l g.prod.aadmsa.trafficmanager.n et, glb.sls.prod.dcat.dsp.traf ficmanager.net
⊘No simulations
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| fp2e7a.wpc.phicdn.net | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Stealc, Vidar | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.854442945845822 |
| TrID: |
|
| File name: | SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe |
| File size: | 24'577'536 bytes |
| MD5: | 0cf6e58863853ae6163cf20cfe99379c |
| SHA1: | 4284de670984d557dd6d4e1091c9eeaa089aad05 |
| SHA256: | 78a93828c62d7c6883a4121374937fbbeaec7a7f383f7fe756673859b9254821 |
| SHA512: | cfdf37ea43df46b821cd382372bf253d471e2fb61001e8db49e2ae9e1b823f4c91464ffc47d7e7a0244f00ac91942b537210788c5e479b8d3fcea39794bcaef7 |
| SSDEEP: | 393216:NWJ1gXPwcLoYJFKP1JnB3Zdp1uPGiSPWw1J:A1gXJFKPVfp1uVS+w1 |
| TLSH: | E637BE07FA525BE8C46A9834C67153967732BC48AB2A13C77F84B7686E777D08E34390 |
| File Content Preview: | MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...E..f..w......."......BX.........P.U........@............................. ~...........`........................................ |
 | |
| Icon Hash: | 860404d5d591d555 |
| Entrypoint: | 0x14055a050 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x66909B45 [Fri Jul 12 02:56:05 2024 UTC] |
| TLS Callbacks: | 0x4055a4e0, 0x1, 0x4055a560, 0x1 |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 1 |
| File Version Major: | 6 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 1 |
| Import Hash: | c882abb81c8df1cca45c830fbfb17df0 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| dec eax |
| mov eax, dword ptr [0058BF3Dh] |
| mov dword ptr [eax], 00000001h |
| call 00007F11B50A89BFh |
| nop |
| nop |
| nop |
| dec eax |
| add esp, 28h |
| ret |
| nop |
| inc ecx |
| push edi |
| inc ecx |
| push esi |
| push esi |
| push edi |
| push ebx |
| dec eax |
| sub esp, 00000090h |
| xorps xmm0, xmm0 |
| movaps esp+70h, dqword ptr [xmm0] |
| movaps esp+60h, dqword ptr [xmm0] |
| movaps esp+50h, dqword ptr [xmm0] |
| movaps esp+40h, dqword ptr [xmm0] |
| movaps esp+30h, dqword ptr [xmm0] |
| movaps esp+20h, dqword ptr [xmm0] |
| dec eax |
| mov dword ptr [esp+00000080h], 00000000h |
| dec eax |
| mov esi, dword ptr [0058BEE6h] |
| cmp dword ptr [esi], 00000000h |
| je 00007F11B50A89BDh |
| dec eax |
| lea ecx, dword ptr [esp+20h] |
| call dword ptr [0059007Eh] |
| dec eax |
| mov eax, dword ptr [00000030h] |
| dec esp |
| mov esi, dword ptr [eax+08h] |
| dec eax |
| mov edi, dword ptr [0058BEEAh] |
| xor eax, eax |
| dec esp |
| cmpxchg dword ptr [edi], esi |
| sete bl |
| je 00007F11B50A89D9h |
| dec ecx |
| cmp esi, eax |
| je 00007F11B50A89D4h |
| dec esp |
| mov edi, dword ptr [0059013Ah] |
| nop |
| mov ecx, 000003E8h |
| inc ecx |
| call edi |
| xor eax, eax |
| dec esp |
| cmpxchg dword ptr [edi], esi |
| sete bl |
| je 00007F11B50A89B7h |
| dec ecx |
| cmp esi, eax |
| jne 00007F11B50A8999h |
| dec esp |
| mov esi, dword ptr [0058BEB8h] |
| inc ecx |
| mov eax, dword ptr [esi] |
| cmp eax, 01h |
| jne 00007F11B50A89BEh |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0xae95e8 | 0x259 | .rdata |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0xae9841 | 0x8c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x17c0000 | 0x1410 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x179d000 | 0x21a5c | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x17c2000 | 0x1b65c | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0xaf0000 | 0x1c | .buildid |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xae6018 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0xaea000 | 0x730 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5840f6 | 0x584200 | 6eb05eed2eeae6eafddf44bcc1d2fdf7 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x586000 | 0x5695e0 | 0x569600 | 4dee9f1f96b473829b43d0021ea57a7d | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .buildid | 0xaf0000 | 0x5f | 0x200 | ae5b372deb6a118c0ebd120ea40c9445 | False | 0.19921875 | data | 1.3813656052918593 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xaf1000 | 0xcab240 | 0xc43200 | 53747ba7b5b14b25e3c44763f3b2e50d | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x179d000 | 0x21a5c | 0x21c00 | 7685a1f0b23f0abbd77242a09edacad8 | False | 0.4155743634259259 | data | 5.745936750518542 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .tls | 0x17bf000 | 0x10 | 0x200 | bf619eac0cdf3f68d496ea9344137e8b | False | 0.02734375 | data | 0.0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x17c0000 | 0x1410 | 0x1600 | dc872626d18820e1fa5d06a5c40bb1a3 | False | 0.7595880681818182 | data | 7.04684586071524 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x17c2000 | 0x1b65c | 0x1b800 | 0212db2ac8a7646e7b1244659c1cb534 | False | 0.19723899147727272 | data | 5.438393937858197 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| /4 | 0x17de000 | 0x21 | 0x200 | 85d33ba7e7f24db7ea62dab6fa35c2d0 | False | 0.083984375 | data | 0.4932472998872501 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| /18 | 0x17df000 | 0x30 | 0x200 | 2e4bd0cd591d66e4563d7290d074399c | False | 0.05859375 | data | 0.1833387916558982 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| /33 | 0x17e0000 | 0xd6 | 0x200 | 0e9e6ac4c56f2660eb16b4c97f4f9330 | False | 0.369140625 | data | 2.8560749639908205 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| /45 | 0x17e1000 | 0x4f | 0x200 | eee64425652dac312de3c9cb5d45fc9e | False | 0.146484375 | data | 0.9348086305266713 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x17c0130 | 0x101c | PNG image data, 200 x 150, 8-bit/color RGB, non-interlaced | English | United States | 0.9080989330746848 |
| RT_GROUP_ICON | 0x17c1150 | 0x14 | data | English | United States | 1.25 |
| RT_VERSION | 0x17c1168 | 0x188 | Alpha compressed COFF | English | United States | 0.47959183673469385 |
| RT_MANIFEST | 0x17c12f0 | 0x11b | XML 1.0 document, ASCII text | English | United States | 0.657243816254417 |
| DLL | Import |
|---|---|
| GDI32.dll | ChoosePixelFormat, CreateBitmap, CreateDCW, CreateDIBSection, CreateRectRgn, DeleteDC, DeleteObject, DescribePixelFormat, GetDeviceCaps, GetDeviceGammaRamp, SetDeviceGammaRamp, SetPixelFormat, SwapBuffers |
| OPENGL32.dll | wglGetProcAddress |
| KERNEL32.dll | AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExitProcess, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, GetConsoleMode, GetCurrentThreadId, GetEnvironmentStringsW, GetErrorMode, GetLastError, GetModuleHandleExW, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetQueuedCompletionStatusEx, GetStartupInfoA, GetStdHandle, GetSystemDirectoryA, GetSystemInfo, GetThreadContext, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, MultiByteToWideChar, PostQueuedCompletionStatus, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseFailFastException, ResumeThread, SetConsoleCtrlHandler, SetErrorMode, SetEvent, SetProcessPriorityBoost, SetThreadContext, SetThreadExecutionState, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SuspendThread, SwitchToThread, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, VerSetConditionMask, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WerGetFlags, WerSetFlags, WideCharToMultiByte, WriteConsoleW, WriteFile, __C_specific_handler |
| msvcrt.dll | ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _beginthread, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, getc, islower, isspace, isupper, isxdigit, localeconv, malloc, qsort, realloc, signal, strcmp, strcpy, strcspn, strerror, strlen, strncmp, strncpy, strspn, strstr, strtok, strtol, strtoul, tolower, ungetc, vfprintf, wcscmp, wcscpy, wcslen |
| SHELL32.dll | DragAcceptFiles, DragFinish, DragQueryFileW, DragQueryPoint |
| USER32.dll | AdjustWindowRectEx, BringWindowToTop, ChangeDisplaySettingsExW, ClientToScreen, ClipCursor, CloseClipboard, CreateIconIndirect, CreateWindowExW, DefWindowProcW, DestroyIcon, DestroyWindow, DispatchMessageW, EmptyClipboard, EnumDisplayDevicesW, EnumDisplayMonitors, EnumDisplaySettingsExW, EnumDisplaySettingsW, FlashWindow, GetActiveWindow, GetClassLongPtrW, GetClientRect, GetClipboardData, GetCursorPos, GetDC, GetKeyState, GetLayeredWindowAttributes, GetMessageTime, GetMonitorInfoW, GetPropW, GetRawInputData, GetRawInputDeviceInfoA, GetRawInputDeviceList, GetSystemMetrics, GetWindowLongW, GetWindowPlacement, GetWindowRect, IsIconic, IsWindowVisible, IsZoomed, LoadCursorW, LoadImageW, MapVirtualKeyW, MonitorFromWindow, MoveWindow, MsgWaitForMultipleObjects, OffsetRect, OpenClipboard, PeekMessageW, PostMessageW, PtInRect, RegisterClassExW, RegisterDeviceNotificationW, RegisterRawInputDevices, ReleaseCapture, ReleaseDC, RemovePropW, ScreenToClient, SendMessageW, SetCapture, SetClipboardData, SetCursor, SetCursorPos, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetPropW, SetRect, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowTextW, ShowWindow, SystemParametersInfoW, ToUnicode, TrackMouseEvent, TranslateMessage, UnregisterClassW, UnregisterDeviceNotification, WaitMessage, WindowFromPoint |
| Name | Ordinal | Address |
|---|---|---|
| _cgo_dummy_export | 1 | 0x14179a660 |
| glowDebugCallback_gl21 | 2 | 0x140542830 |
| goCharCB | 3 | 0x14052d040 |
| goCharModsCB | 4 | 0x14052d090 |
| goCursorEnterCB | 5 | 0x14052cf10 |
| goCursorPosCB | 6 | 0x14052cea0 |
| goDropCB | 7 | 0x14052d0f0 |
| goErrorCB | 8 | 0x14052cda0 |
| goFramebufferSizeCB | 9 | 0x14052d260 |
| goJoystickCB | 10 | 0x14052cdf0 |
| goKeyCB | 11 | 0x14052cfd0 |
| goMonitorCB | 12 | 0x14052d150 |
| goMouseButtonCB | 13 | 0x14052ce40 |
| goScrollCB | 14 | 0x14052cf60 |
| goWindowCloseCB | 15 | 0x14052d2c0 |
| goWindowContentScaleCB | 16 | 0x14052d430 |
| goWindowFocusCB | 17 | 0x14052d390 |
| goWindowIconifyCB | 18 | 0x14052d3e0 |
| goWindowMaximizeCB | 19 | 0x14052d300 |
| goWindowPosCB | 20 | 0x14052d1a0 |
| goWindowRefreshCB | 21 | 0x14052d350 |
| goWindowSizeCB | 22 | 0x14052d200 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Oct 10, 2024 06:30:20.540833950 CEST | 1.1.1.1 | 192.168.2.5 | 0xae28 | No error (0) | fp2e7a.wpc.phicdn.net | CNAME (Canonical name) | IN (0x0001) | false | ||
| Oct 10, 2024 06:30:20.540833950 CEST | 1.1.1.1 | 192.168.2.5 | 0xae28 | No error (0) | 192.229.221.95 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 00:30:22 |
| Start date: | 10/10/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Trojan-Dropper.WinGo.Agent.10058.14118.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff610150000 |
| File size: | 24'577'536 bytes |
| MD5 hash: | 0CF6E58863853AE6163CF20CFE99379C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Go lang |
| Reputation: | low |
| Has exited: | true |
Execution Graph
Execution Coverage
Dynamic/Packed Code Coverage
Signature Coverage
| Execution Coverage: | 1.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 19.8% |
| Total number of Nodes: | 1390 |
| Total number of Limit Nodes: | 118 |
Graph
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
