Edit tour

Windows Analysis Report
uIeBVL8I3D.exe

Overview

General Information

Sample name:	uIeBVL8I3D.exe renamed because original name is a hash value
Original sample name:	de7d152b0dffe94074d139962725da642b9c63cd6913a6bccd1c152850241a32.exe
Analysis ID:	1540036
MD5:	c5543a7f67dc9c4bcb1d2b4ccf528775
SHA1:	4bc60ebb62311ba40c7d45d03138bc4e41b1c8e4
SHA256:	de7d152b0dffe94074d139962725da642b9c63cd6913a6bccd1c152850241a32
Tags:	exeuser-NDA0E
Infos:
Errors No process behavior to analyse as no analysis process or sample was found Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Go Injector

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Go Injector

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Classification

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
uIeBVL8I3D.exe	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: uIeBVL8I3D.exe

ReversingLabs: Detection: 33%

Source: uIeBVL8I3D.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: uIeBVL8I3D.exe	String found in binary or memory: http://github.com/garycourt/uri-js
Source: uIeBVL8I3D.exe	String found in binary or memory: http://json-schema.org/draft-07/schema
Source: uIeBVL8I3D.exe	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: uIeBVL8I3D.exe	String found in binary or memory: http://json-schema.org/schema
Source: uIeBVL8I3D.exe	String found in binary or memory: http://kubernetes.io/docs/user-guide/annotationsobservedGeneration
Source: uIeBVL8I3D.exe	String found in binary or memory: http://kubernetes.io/docs/user-guide/identifiers#namesStatusDetails
Source: uIeBVL8I3D.exe	String found in binary or memory: http://kubernetes.io/docs/user-guide/identifiers#uidsDeprecated:
Source: uIeBVL8I3D.exe	String found in binary or memory: http://kubernetes.io/docs/user-guide/labelsExtended
Source: uIeBVL8I3D.exe	String found in binary or memory: http://kubernetes.io/docs/user-guide/namespacesformat
Source: uIeBVL8I3D.exe	String found in binary or memory: https://aws.amazon.com
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-cont
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotencySibli
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataThe
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatalimit
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourcesKind
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsWhen
Source: uIeBVL8I3D.exe	String found in binary or memory: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsresou
Source: uIeBVL8I3D.exe	String found in binary or memory: https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types
Source: uIeBVL8I3D.exe	String found in binary or memory: https://github.com/aws/jsii
Source: uIeBVL8I3D.exe	String found in binary or memory: https://github.com/aws/jsii.git
Source: uIeBVL8I3D.exe	String found in binary or memory: https://github.com/aws/jsii/issues
Source: uIeBVL8I3D.exe	String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269
Source: uIeBVL8I3D.exe	String found in binary or memory: https://golang.org/pkg/unicode/#IsPrint.
Source: uIeBVL8I3D.exe	String found in binary or memory: https://golang.org/pkg/unicode/#IsPrint.values
Source: uIeBVL8I3D.exe	String found in binary or memory: https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions
Source: uIeBVL8I3D.exe	String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#

Source: uIeBVL8I3D.exe

Static PE information: Number of sections : 12 > 10

Source: uIeBVL8I3D.exe

Static PE information: No import functions for PE file found

Source: uIeBVL8I3D.exe

Static PE information: Data appended to the last section found

Source: classification engine

Classification label: mal56.troj.winEXE@0/0@0/0

Source: uIeBVL8I3D.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: uIeBVL8I3D.exe

ReversingLabs: Detection: 33%

Source: uIeBVL8I3D.exe	String found in binary or memory: net/addrselect.go
Source: uIeBVL8I3D.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: uIeBVL8I3D.exe	String found in binary or memory: github.com/aws/jsii-runtime-go@v1.101.0/internal/kernel/load.go
Source: uIeBVL8I3D.exe	String found in binary or memory: x125xexwxw/load.go

Source: uIeBVL8I3D.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: uIeBVL8I3D.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: uIeBVL8I3D.exe

Static file information: File size 15645215 > 1048576

Source: uIeBVL8I3D.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x5d7a00
Source: uIeBVL8I3D.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x9b9400

Source: uIeBVL8I3D.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: uIeBVL8I3D.exe

Static PE information: section name: .xdata

Stealing of Sensitive Information

Yara detected Go Injector

Source: Yara match

File source: uIeBVL8I3D.exe, type: SAMPLE

Remote Access Functionality

Yara detected Go Injector

Source: Yara match

File source: uIeBVL8I3D.exe, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uIeBVL8I3D.exe	33%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/aws/jsii	uIeBVL8I3D.exe	false	unknown
http://json-schema.org/draft-07/schema#	uIeBVL8I3D.exe	false	unknown
https://aws.amazon.com	uIeBVL8I3D.exe	false	unknown
https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types	uIeBVL8I3D.exe	false	unknown
http://json-schema.org/schema	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourcesKind	uIeBVL8I3D.exe	false	unknown
https://github.com/jprichardson/node-fs-extra/issues/269	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsWhen	uIeBVL8I3D.exe	false	unknown
http://kubernetes.io/docs/user-guide/labelsExtended	uIeBVL8I3D.exe	false	unknown
https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions	uIeBVL8I3D.exe	false	unknown
http://github.com/garycourt/uri-js	uIeBVL8I3D.exe	false	unknown
https://golang.org/pkg/unicode/#IsPrint.	uIeBVL8I3D.exe	false	unknown
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsresou	uIeBVL8I3D.exe	false	unknown
http://json-schema.org/draft-07/schema	uIeBVL8I3D.exe	false	unknown
https://golang.org/pkg/unicode/#IsPrint.values	uIeBVL8I3D.exe	false	unknown
https://github.com/aws/jsii.git	uIeBVL8I3D.exe	false	unknown
http://kubernetes.io/docs/user-guide/annotationsobservedGeneration	uIeBVL8I3D.exe	false	unknown
http://kubernetes.io/docs/user-guide/identifiers#namesStatusDetails	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataThe	uIeBVL8I3D.exe	false	unknown
http://kubernetes.io/docs/user-guide/namespacesformat	uIeBVL8I3D.exe	false	unknown
http://kubernetes.io/docs/user-guide/identifiers#uidsDeprecated:	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotencySibli	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-cont	uIeBVL8I3D.exe	false	unknown
https://github.com/aws/jsii/issues	uIeBVL8I3D.exe	false	unknown
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatalimit	uIeBVL8I3D.exe	false	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540036
Start date and time:	2024-10-23 11:20:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uIeBVL8I3D.exe renamed because original name is a hash value
Original Sample Name:	de7d152b0dffe94074d139962725da642b9c63cd6913a6bccd1c152850241a32.exe
Detection:	MAL
Classification:	mal56.troj.winEXE@0/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe Unable to launch sample, stop analysis

Errors

No process behavior to analyse as no analysis process or sample was found
Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: uIeBVL8I3D.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.391133917690786
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	uIeBVL8I3D.exe
File size:	15'645'215 bytes
MD5:	c5543a7f67dc9c4bcb1d2b4ccf528775
SHA1:	4bc60ebb62311ba40c7d45d03138bc4e41b1c8e4
SHA256:	de7d152b0dffe94074d139962725da642b9c63cd6913a6bccd1c152850241a32
SHA512:	5b8c598d65627a93e12350dc341d2571fa2a03df0c5212091fdc61e3569b37960af8d6e0ca45fe39e98d418b381de94a218324412c16786e689df0d220fa7edb
SSDEEP:	98304:Hy3ex5+JHQDw3/2xXz5pDUcg+b+EmCu8scTiPc8HLaAB:aHLuxXz5eWb7mCl/TifB
TLSH:	12F65B43AC9540F0C5AE9530896A8123BF71784E573427D73FACE6242F76BD0AEB9B50
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.z]....................@.............................p......a.....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00FE8655h]
mov dword ptr [eax], 00000001h
call 00007FAC84F4CF7Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00FE8635h]
mov dword ptr [eax], 00000000h
call 00007FAC84F4CF5Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FAC85523E7Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FAC84F4D299h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr [eax]
inc edi
outsd
and byte ptr [edx+75h], ah
imul ebp, dword ptr [esp+20h], 203A4449h
and dh, byte ptr [edi+31h]
jne 00007FAC84F4D31Bh
sub eax, 4A6F4572h
jc 00007FAC84F4D306h
popad
inc edi
inc ecx
xor al, 4Ah
inc esi
insd
inc esp
je 00007FAC84F4D2F1h
push ebx
dec ebx
xor dl, byte ptr [esp+eax*2+74h]
push 0000006Bh
insb
push esi
sub eax, 4E4B664Dh
pop eax
dec edx
inc esi
jo 00007FAC84F4D2F1h
popad
dec edx
imul ecx, dword ptr [esi+33h], 52h
jbe 00007FAC84F4D31Bh
insd
cmp dword ptr [esi+6Ch], ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x107a000	0x4e	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x107b000	0x13d0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x107f000	0xbb24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xfeb000	0x2d924	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108b000	0x1b654	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xfe9480	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x107b47c	0x440	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5d7880	0x5d7a00	a465127390891a152664e97cb6c97ce4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x5d9000	0x57a70	0x57c00	eb7de5c9345e2e39e3f2e387690d6fee	False	0.344623620014245	dBase III DBT, version number 0, next free block index 10, 1st item "WY="	4.899316610996416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x631000	0x9b92b0	0x9b9400	03f7c58ba9b4d38a25982429f53d628c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0xfeb000	0x2d924	0x2da00	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x1019000	0xc44	0xe00	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x101a000	0x5ff60	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x107a000	0x4e	0x200	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.idata	0x107b000	0x13d0	0x1400	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x107d000	0x70	0x200	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x107e000	0x10	0x200	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x107f000	0xbb24	0xbc00	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x108b000	0x1b654	0x1b800	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Network Behavior

⊘No network behavior found

Statistics

⊘No statistics

System Behavior

⊘No system behavior

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uIeBVL8I3D.exe

Overview

General Information

Detection

Signatures

Classification

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Statistics

System Behavior

Disassembly

Windows Analysis Report
uIeBVL8I3D.exe