Edit tour

Windows Analysis Report
thunderbird-to-outlook-converter.exe

Overview

General Information

Sample name:	thunderbird-to-outlook-converter.exe
Analysis ID:	1545749
MD5:	ed6c1f0e4bc19623cbbad48cf84ab099
SHA1:	ea54f4b7f52c6948c102d452a615671738427bce
SHA256:	28923cdeb17db6f79d0f7c134daa9343cb99253921c1f4054d201b1e242305ca
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Compliance

Score:	32
Range:	0 - 100

Signatures

.NET source code contains potential unpacker

Yara detected Generic Downloader

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

EXE planting / hijacking vulnerabilities found

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

thunderbird-to-outlook-converter.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe" MD5: ED6C1F0E4BC19623CBBAD48CF84AB099)

msiexec.exe (PID: 6700 cmdline: msiexec.exe /i C:\Users\user\AppData\Local\Temp\MSIF618.tmp MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 736 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5812 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7290A6845925C195E7014D9F7E4EB858 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1368 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C3F8760112445D68E9871B76E5B0FA05 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_853F67D554F05449430E7E.exe	Jump to behavior
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	EXE: msiexec.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_853F67D554F05449430E7E.exe	Jump to behavior
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	EXE: msiexec.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe	Jump to behavior

Uses 32bit PE files

Source: thunderbird-to-outlook-converter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates license or readme file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf			Jump to behavior

PE / OLE file has a valid certificate

Source: thunderbird-to-outlook-converter.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: F:\gs1\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: thunderbird-to-outlook-converter.exe, MSI36CB.tmp.2.dr, MSI3739.tmp.2.dr, 5d34b7.msi.2.dr, MSIF618.tmp.0.dr, 5d34b9.msi.2.dr, MSIF8D8.tmp.1.dr, MSIF85A.tmp.1.dr
Source:	Binary string: e:\Develope\msi2exe\release\msi2exestub.pdb source: thunderbird-to-outlook-converter.exe
Source:	Binary string: F:\gs1\VS\out\binaries\x86ret\bin\i386\DPCA.pdb? source: thunderbird-to-outlook-converter.exe, MSI36CB.tmp.2.dr, MSI3739.tmp.2.dr, 5d34b7.msi.2.dr, MSIF618.tmp.0.dr, 5d34b9.msi.2.dr, MSIF8D8.tmp.1.dr, MSIF85A.tmp.1.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match

File source: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL, type: DROPPED

Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.godaddy.com/gdig2s5-5.crl0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/masterstarfield2issuing.crl0P
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sf_issuing_ca-g2.crt0T
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://ocsp.godaddy.com/0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://ocsp.godaddy.com/05
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0H
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: TreeksLicensingLibrary2.DLL.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: thunderbird-to-outlook-converter.exe	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: MailsdaddyThunderbirdToOutlookConverter.exe.2.dr	String found in binary or memory: https://purchase.aspose.com/policies/use-license
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: Aspose.Email.DLL.2.dr	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d34b7.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI36CB.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3739.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI37A7.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d34b9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5d34b9.msi	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI36CB.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Code function: 0_2_00404C68		0_2_00404C68
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Code function: 0_2_00402F70		0_2_00402F70

Sample file is different than original file name gathered from version info

Source: thunderbird-to-outlook-converter.exe	Binary or memory string: OriginalFilename vs thunderbird-to-outlook-converter.exe
Source: thunderbird-to-outlook-converter.exe, 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDPCA.DLLT vs thunderbird-to-outlook-converter.exe
Source: thunderbird-to-outlook-converter.exe	Binary or memory string: OriginalFilenameDPCA.DLLT vs thunderbird-to-outlook-converter.exe

Uses 32bit PE files

Source: thunderbird-to-outlook-converter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TreeksLicensingLibrary2.DLL.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: sus36.troj.evad.winEXE@8/40@0/0

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_0040134E __EH_prolog3_catch,_memset,_memset,GetTempPathW,GetTempFileNameW,__CxxThrowException@8,FindResourceW,SizeofResource,LoadResource,LockResource,CreateFileW,ShowWindow,ShowWindow,WriteFile,InvalidateRect,ShowWindow,CloseHandle,_swprintf,_memset,CreateProcessW,ExitProcess,

0_2_0040134E

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML3822.tmp

Jump to behavior

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

File created: C:\Users\user\AppData\Local\Temp\MSIF618.tmp

Jump to behavior

Source: thunderbird-to-outlook-converter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe "C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe"
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i C:\Users\user\AppData\Local\Temp\MSIF618.tmp
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7290A6845925C195E7014D9F7E4EB858 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C3F8760112445D68E9871B76E5B0FA05
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Process created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i C:\Users\user\AppData\Local\Temp\MSIF618.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7290A6845925C195E7014D9F7E4EB858 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C3F8760112445D68E9871B76E5B0FA05	Jump to behavior

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior

Source: Mailsdaddy Thunderbird To Outlook Converter.lnk.2.dr	LNK file: ..\..\..\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe
Source: Mailsdaddy Thunderbird To Outlook Converter.lnk0.2.dr	LNK file: ..\..\..\..\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe
Source: Mailsdaddy Thunderbird To Outlook Converter.lnk1.2.dr	LNK file: ..\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: I Agree
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >

PE / OLE file has a valid certificate

Source: thunderbird-to-outlook-converter.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: thunderbird-to-outlook-converter.exe

Static file information: File size 8612560 > 1048576

PE file has a big raw section

Source: thunderbird-to-outlook-converter.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x825000

PE file contains a debug data directory

Source: thunderbird-to-outlook-converter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: F:\gs1\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: thunderbird-to-outlook-converter.exe, MSI36CB.tmp.2.dr, MSI3739.tmp.2.dr, 5d34b7.msi.2.dr, MSIF618.tmp.0.dr, 5d34b9.msi.2.dr, MSIF8D8.tmp.1.dr, MSIF85A.tmp.1.dr
Source:	Binary string: e:\Develope\msi2exe\release\msi2exestub.pdb source: thunderbird-to-outlook-converter.exe
Source:	Binary string: F:\gs1\VS\out\binaries\x86ret\bin\i386\DPCA.pdb? source: thunderbird-to-outlook-converter.exe, MSI36CB.tmp.2.dr, MSI3739.tmp.2.dr, 5d34b7.msi.2.dr, MSIF618.tmp.0.dr, 5d34b9.msi.2.dr, MSIF8D8.tmp.1.dr, MSIF85A.tmp.1.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: TreeksLicensingLibrary2.DLL.2.dr, --.cs

.Net Code: _0002 System.Reflection.Assembly.Load(byte[])

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_004065BA LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_004065BA

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_00402F51 push ecx; ret

0_2_00402F64

Source: TreeksLicensingLibrary2.DLL.2.dr

Static PE information: section name: .text entropy: 7.909684201630082

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI36CB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3739.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF85A.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI36CB.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3739.tmp			Jump to dropped file

Creates license or readme file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf			Jump to behavior

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy\Mailsdaddy Thunderbird To Outlook Converter.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI36CB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3739.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF85A.tmp	Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-2146

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}	Jump to behavior

Source: Aspose.Email.DLL.2.dr	Binary or memory string: #=zGCaIGGoy1$NUKmG_CsftXG5sKlnzNzvmCIEDug0mz3qn
Source: Aspose.Email.DLL.2.dr	Binary or memory string: #=z5_Nge9eohgfsrfkPRCICQG$IG0R7
Source: Aspose.Email.DLL.2.dr	Binary or memory string: #=zoIn7JTGecCpYn2AbMCMTDb_46$hGFSZ5oQ==
Source: Aspose.Email.DLL.2.dr	Binary or memory string: #=zi0jHgfsah8Ev

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	API call chain: ExitProcess graph end node			graph_0-2159
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	API call chain: ExitProcess graph end node			graph_0-2147

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_00401A49 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00401A49

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_004065BA LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__invoke_watson,GetProcAddress,GetProcAddress,__invoke_watson,

0_2_004065BA

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Code function: 0_2_00401A49 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00401A49
Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe	Code function: 0_2_0040214A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0040214A

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe

Code function: 0_2_00404A38 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00404A38

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	22 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Search Order Hijacking	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Search Order Hijacking	12 Software Packing	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
thunderbird-to-outlook-converter.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL	0%	ReversingLabs
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe	4%	ReversingLabs
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIF85A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI36CB.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI3739.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.godaddy.com/gdroot-g2.crl0F	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Aspose.Email.DLL.2.dr	false	URL Reputation: safe	unknown
http://ocsp.starfieldtech.com/0H	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.starfieldtech.com/repository/0	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.starfieldtech.com/repository/masterstarfield2issuing.crl0P	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	TreeksLicensingLibrary2.DLL.2.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	Aspose.Email.DLL.2.dr	false	URL Reputation: safe	unknown
https://certs.starfieldtech.com/repository/0	thunderbird-to-outlook-converter.exe	false		unknown
http://certificates.godaddy.com/repository/0	thunderbird-to-outlook-converter.exe	false		unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	Aspose.Email.DLL.2.dr	false	URL Reputation: safe	unknown
http://certs.starfieldtech.com/repository/1402	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.starfieldtech.com/sfroot-g2.crl0L	thunderbird-to-outlook-converter.exe	false		unknown
http://ocsp.thawte.com0	TreeksLicensingLibrary2.DLL.2.dr	false	URL Reputation: safe	unknown
http://certs.godaddy.com/repository/1301	thunderbird-to-outlook-converter.exe	false		unknown
https://sectigo.com/CPS0D	Aspose.Email.DLL.2.dr	false		unknown
http://crl.godaddy.com/gdig2s5-5.crl0	thunderbird-to-outlook-converter.exe	false		unknown
http://crl.starfieldtech.com/repository/sf_issuing_ca-g2.crt0T	thunderbird-to-outlook-converter.exe	false		unknown
http://ocsp.starfieldtech.com/0;	thunderbird-to-outlook-converter.exe	false		unknown
https://certs.godaddy.com/repository/0	thunderbird-to-outlook-converter.exe	false		unknown
http://certificates.godaddy.com/repository/gdig2.crt0	thunderbird-to-outlook-converter.exe	false		unknown
https://purchase.aspose.com/policies/use-license	MailsdaddyThunderbirdToOutlookConverter.exe.2.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545749
Start date and time:	2024-10-30 22:55:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	thunderbird-to-outlook-converter.exe
Detection:	SUS
Classification:	sus36.troj.evad.winEXE@8/40@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: thunderbird-to-outlook-converter.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSIF85A.tmp	UTSetup.msi	Get hash	malicious	Unknown	Browse
	ICE_Auto_Setup1.3signed.exe	Get hash	malicious	Unknown	Browse
	ICE_Auto_Setup1.3signed.exe	Get hash	malicious	Unknown	Browse
	Setupfr.msi	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp	UTSetup.msi	Get hash	malicious	Unknown	Browse
	ICE_Auto_Setup1.3signed.exe	Get hash	malicious	Unknown	Browse
	ICE_Auto_Setup1.3signed.exe	Get hash	malicious	Unknown	Browse
	Setupfr.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\5d34b8.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	18100
Entropy (8bit):	5.793248747965284
Encrypted:	false
SSDEEP:	192:yeIS8ReET1ZsZDO9a4CPEaXV/eN+0gqfXI7fXxlh27m43Wpj7:yex0eET1ZsZDO9VCPEa+fkfhIw7
MD5:	B6101A7F00764E9593DB073F0DD47013
SHA1:	72097776F7196AE51995CD4E0504A204F9FA8949
SHA-256:	DEC8B6F52BF542AF1671535B26BC14A0B02638C9C90B40502DDB63BCE35767A0
SHA-512:	84A7A11402F31B70C0951F4BA784EC649D3C468EBB4E58990A65A3790E4667AF18C91F2D1034ABC42598576F949C8996F11C6E92ED755932DB88E9BA51A3031B
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@$.^Y.@.....@.....@.....@.....@.....@......&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}+.MailsDaddy Thunderbird to Outlook Converter..MSIF618.tmp.@.....@.....@.....@......_853F67D554F05449430E7E.exe..&.{A232982E-298B-41EA-93F1-4F055FADF244}.....@.....@.....@.....@.......@.....@.....@.......@....+.MailsDaddy Thunderbird to Outlook Converter......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{D98F3635-E5A6-E697-8AEA-FF9A58963D52}&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}.@......&.{D8237FD1-DE18-5DC1-0EC9-35347546BBF7}&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}.@......&.{06856F88-F013-FCFE-B98E-FDE3FF5B6CA6}&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}.@......&.{325BB016-F14B-FDB3-C4FB-A0F8035BB9B8}&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}.@......&.{1726AEA8-C667-60A0-49C4-33100DCDA45B}&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}.@......&.{5BF9B5B7-EB23-661A-5842-A9681649CFCD}&.{7A41F43B-6BBA-41C

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8361128
Entropy (8bit):	6.4686495954120815
Encrypted:	false
SSDEEP:	49152:Lc+Rj4xCbeoC87zWh6PoW0HhYMvoL1IVatbyhtrSYJLcF+sOVD1s4/PADnflQz/B:Lc+RjBHWh6QHhYYcWISL6OVDBPEjc
MD5:	7AA8C8CCC671A094EBCD0FB12CF15329
SHA1:	3BE9BCCAAC4923E0922B13212EEAF977BD075DA1
SHA-256:	05D51AD015EB7492A5D1FD1D506C4D4C587A926D8C9D9A2D40ABE4EB89185276
SHA-512:	159890986E72C37E38179DB5D4BD8603AB989CBCF4BC18D3DCFF2BC2D177CF889E9ACF0C83CAF900F30535CB831FFE684936A94C8F8014A8B5C46E7B64B30170
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(.V^...........!.....j............... ........@.. ..............................C.....@.....................................W....................t... ........................................................... ............... ..H............text....i... ...j.................. ..`.rsrc................l..............@..@.reloc...............r..............@..B........................H........)G..^8.........0C;.(...X)G......................................0...........-..-.+.(....+.(....+...0.............-.&..(....+.&+...0...........(.......-.&&+.}....+...0.............-.&{....+.&+.....0.............-.&&+.}....+.....0.............-.&(.........+.&+....0..i........u....,.........-.&&+.(....+..u....,........j.,.&&+.(....+..u....,........j.-.&&+.(....+...(....(........0..0.......s....%...-.&{....o....%...-.&(....o....+.&+.&+.*.0&...........o.....:\|..

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46173
Entropy (8bit):	5.074058089289603
Encrypted:	false
SSDEEP:	384:VNgyfWWLFKrN7DozVzEFepdMua9qwwqMQCqpCi6rGs+ZAUw5PTsxCYDnMNLDp:VNgyfbBpdQ9qwwqhCqjqUisx+NLDp
MD5:	014F3513951BBBE0B419C193402C39D8
SHA1:	32E322ECBCC3F3D280A7225C3D3B0170CBC3BF95
SHA-256:	71B60F9C8D440BBD012636850A4499A3F7DA4756A03A4AF145AE525E3245D1BC
SHA-512:	C2693C0F723C5CE96C95C17F7EE3CF519A236E478CA902E72722A77E08155A816C713E6E446943AC33CED643B9AB3686C3B8E64EB78D73A5D4D254BA623A108A
Malicious:	false
Reputation:	low
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0302020204030204}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f3150

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Mailsdaddy Thunderbird To Outlook Converter.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	3219
Entropy (8bit):	3.0246305641353337
Encrypted:	false
SSDEEP:	48:8FTU6IuPSpIZQIHMIZjdYwQW6IHMIZAl3wvdu1tHMIZ:8FUaSpIZHHMIZzZHMIZkgvcHHMIZ
MD5:	7B5AB87556D7F1F2E5EF26EB44E574A1
SHA1:	6021EECB40938030A076904CCFE068F4C59EFAAC
SHA-256:	1338FA7549794061124241439CBF34D471DDEEFAC72F000804FC753B232EBD91
SHA-512:	A6B27EB645A1AF52D2D887A9AEC4D15A90209A0C526BDBB7E1671BCB31EF56F009848EA4E3C62AD05A151E8306E936D5556C65F735C47D6956160C040BC14F1B
Malicious:	false
Reputation:	low
Preview:	L..................F.P......................................................u....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH^Y......................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....^Y....user.<......CW.^^Y............................y.5.j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^^Y.............................%..A.p.p.D.a.t.a.....V.1.....^Y....Roaming.@......CW.^^Y..............................0.R.o.a.m.i.n.g.....\.1.....^Y$...MICROS~1..D......CW.^^Y$...........................;...M.i.c.r.o.s.o.f.t.....\.1.....^Y$...INSTAL~1..D......^Y$.^Y$.....D.....................>...I.n.s.t.a.l.l.e.r.......1.....^Y$...{7A41F~1..~......^Y$.^Y$.....I......................+..{.7.A.4.1.F.4.3.B.-.6.B.B.A.-.4.1.C.2.-.9.3.0.2.-.0.B.D.D.E.B.B.C.0.3.8.C.}.......2.&}..^Y$.!._039DB~1.EXE..h......^Y$.^Y$...........................>..._.0.3.9.D.B.A.7.7.5.4.D.F.C.A.A.B.D.6.4.8.C.2...e.x.e.......{.....\.....\.....\.U.s.e.r.s.\.j.o.n

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5264896
Entropy (8bit):	7.3434710418909965
Encrypted:	false
SSDEEP:	49152:c7xReUTjyuM/xReUTjyuM/ePpGxoN5ooovzdPj57T3jYkQDReUTjyuM/ZReUTjyA:c7rrGTrGmpGm5XcNRXQFrGLrG
MD5:	0E8BBF4FFFA92BBF2D8FD00182C658A0
SHA1:	DD469F71D0D8EB50B0E35987DD824ECB3FFEAB1A
SHA-256:	12D71471EB9C102FED52E857B36947E6B0432896D587BF40DB836D1FAEC5BF15
SHA-512:	76D1340638A679777F1B5C8D2CD498A3E1F4A9AD92DFB2BC9B17AB78AE424DA825DDE347282B8581630870FC5472E1600F2301F2E46B1A23496AAE6A95A6B5C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p}_..................O..RP.....n.O.. ....P...@.. ........................P...............................................O.W.... P......................P...................................................... ............... ..H............text...t.O.. ....O................. ..`.reloc........P.......O.............@..B.rsrc....... P.......O.............@..@................P.O.....H........QO.(............O..h.M..........................................0...........,) ......+...o.....a ....Z...X...o..../.+....R..}.....(.....(........0..&........,..{.......+....,..{....o......(....*...0...............(....s......s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....{....o ....{....o!....{....o ....( ....{....("...o#....{.....o$....

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	614096
Entropy (8bit):	7.897350357149182
Encrypted:	false
SSDEEP:	12288:l8R9dd8EqZi2vJg8UqlMpD+v4YN/hV1ACV:CR9RR2BMp24S/1V
MD5:	71406D8868500DB8154F225B96902E8F
SHA1:	C417242856524807087B4B392A502DAC7899322D
SHA-256:	5E9ED3B4A107908EDF7551985BD489333DE0895ED039E66B078E2DE1800A73FE
SHA-512:	584E1AE09E47F030DE0FAE7AAC0BAF7C35DFF1347366F89B3D7D35B0106451DB26D4E0703D64D3B16DD727A01CFFEDB8B2F25EB579D346C55317D63435B4E992
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zhV\...........!.....8...B......zW... ...`....@.. ...............................M...................................... W..W....................F.......`....................................................... ............... ..H............text....7... ...8.................. ..`.reloc.......`.......:..............@..B.rsrc................<..............@..@................\W......H.......h...................X............................................(....(......(..... .........}.....s....}......{......}.......f.{.....{....o......}.......0..>........{.....{......2..o.....{.....{....(.... ...._...{......}........0...........o.....]....0.."........./. /V.!(....s....z.......o........0...........o......l#.......A[6.{.....o........( .....%..!...s!...(".....}......}.....o......0..!........,..{....,..{....o#.......($.....}..................0..$...

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.tlb

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7548
Entropy (8bit):	4.143571137228021
Encrypted:	false
SSDEEP:	96:V4t2aVjOg4izf3GW8n3tUh7V8W1qZK/v93lgJup:V4McJZPGW298SW4ZK/v93kup
MD5:	70BA3CC095C1638CF9E8E87F236761FE
SHA1:	9563D993A60E23763278FB95078D1A8ECD5765AF
SHA-256:	E76E9E560F8D8D5FFB574027A2BF9C5753C4C913ECA37377FD35B6C1B277F7FE
SHA-512:	95291CA391060D0FF8127CCAF301140E929E1E1FC3BFAEC15DBF34EA0D76B2D0A3EDE816BCA6FB6B23BEFD2CD8338174F675F96BBAF5C87ECA4C45652C63F9E1
Malicious:	false
Reputation:	low
Preview:	MSFT................A...................................$.......h... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................L...............d...8...........l...............t...................x...............................H...............................................................$...............t...........................................%!..\|...............................................................................................%!..\|.......................................H....................................... ...............%!..\|.......................................`.......4...............................@...............%!..\|.......................................x.......H...................$...........`...............%!..\|...............................................`...................0...........................%!..\|...............................................t...

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\header.jpg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 497x69, components 3
Category:	dropped
Size (bytes):	8164
Entropy (8bit):	7.537492701868835
Encrypted:	false
SSDEEP:	96:SnHF+N26MT0D5MdtbZPAVwzVeEufWdAJGj9hZo5Auf0ahoWv+O32CwHo+yy:UvYNMtKwsNVJehiiuBKWvpqHony
MD5:	6E54CFEA2D19E91EF8C424B7F1E3F7E4
SHA1:	7E5C9D6793B0C86349E662F8EAA46C782DA9AA4F
SHA-256:	FEE72CA0E794BD078B8E5AE44F33878016FA07F555DAA66CF9D65E28B5DE3B21
SHA-512:	B325FE6BD2AA233FF74A6762FB00A108F574EC400EC10871A62B730FA76A2B55365C543B9228346F8DF97C756F697B0CB3539FAB6616A48BF52D68411EA64DB5
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....\Exif..MM.*.................>Q...........Q...........Q...............Photoshop ICC profile....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Vi

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\mailsdaddy.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	3.9225061132461403
Encrypted:	false
SSDEEP:	192:HM0v0/PuzXNe7R8BgImucDiBKy8xe2MVsqh1v5h4p6d475zDnSBjCuFsX:s8muxe7RbycDikbBMVsivAp62VWBj
MD5:	C86658E2071AAEF5D7B32F60B035C2F3
SHA1:	ECF794F3F18B68AF08BE0A65887356DE817E9FB7
SHA-256:	4B65C48912BB076CE07F9E1D18A72F8B05E6CA597C267FA918D17E78150FF5C5
SHA-512:	126C8DBCA28C6FD40612B460E5A1E6E386499EDD239FBC1CE24B349F437DBDCC1ABC115C6EDE2DC1A7813F1A975CA74EDCB701030F3686097E5D419DC67EE2E5
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .....@.......................................................................................zx..$!.i.......q?A............................................... .Q...................." .5.......................................................................eD<......................43.%............................................)(.-.......................................................................[UZ.........................s),.1JB..&$.!...................................."..;LC.........-............(%.E...........................e...................S.......k...#...............................i...................].......q...{...'....................((.G..............._...............a...S...........s...........................................+...............................g...............G.......................W...............M...............................................................g...?..

C:\Users\user\AppData\Local\Temp\CFG3728.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.014256965044084
Encrypted:	false
SSDEEP:	3:vFWWMNHUz/cIMOoT02V7VKXRAmIRMNHjFHr0lUfEyhTRD+RAW4QIMOov:TMV0kI002V7VQ7VJdfEyFRDuAW4QIm
MD5:	84F2F872035A2B2007494208AC3B98C4
SHA1:	385B4BF0D62025D669935F690B9B64345DE41273
SHA-256:	F5BA88B4A9928B710C9DBF757F0C4DEE5BC6B6A56985D5BFEBA8620C8AE65B6C
SHA-512:	D1F141DA4761D82FEB78563DDBAEF0C7B422CC4D80DB23A9895B71EC525FFDB907351D9ECFD263EE1004DCF919EF66E287A254117E24EAB6DA2AE539779DB2E6
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>...<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/>...</startup>..</configuration>..

C:\Users\user\AppData\Local\Temp\CFGF8C8.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.014256965044084
Encrypted:	false
SSDEEP:	3:vFWWMNHUz/cIMOoT02V7VKXRAmIRMNHjFHr0lUfEyhTRD+RAW4QIMOov:TMV0kI002V7VQ7VJdfEyFRDuAW4QIm
MD5:	84F2F872035A2B2007494208AC3B98C4
SHA1:	385B4BF0D62025D669935F690B9B64345DE41273
SHA-256:	F5BA88B4A9928B710C9DBF757F0C4DEE5BC6B6A56985D5BFEBA8620C8AE65B6C
SHA-512:	D1F141DA4761D82FEB78563DDBAEF0C7B422CC4D80DB23A9895B71EC525FFDB907351D9ECFD263EE1004DCF919EF66E287A254117E24EAB6DA2AE539779DB2E6
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>...<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/>...</startup>..</configuration>..

C:\Users\user\AppData\Local\Temp\MSIF618.tmp

Download File

Process:	C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
Category:	dropped
Size (bytes):	8503808
Entropy (8bit):	7.943057438543247
Encrypted:	false
SSDEEP:	196608:wKx7EobZC0JsWLJPC8O1tDEZmsoinEVhzRSW8KHhKKV:x7ElSsWLJK8eOmsHO8Kg
MD5:	7F5CBD30246515F4E8CEF07794854EDF
SHA1:	51C38B3AF8AD36C7772D189A27D2B785CBDF326F
SHA-256:	2C0B55E2732CD820C82E91B9C9E63CAC50CC4E278D2DF9BCFFCABAB5D900E9F2
SHA-512:	D49F8165B8A7B4D7C8C1E22CDF30239F03B8BB32428BB0D435B084A795F07C378C99DA129A2B391397879AE3C6A4B6D6FBC9325B9EFFBA56942B7D2EBA2A6A78
Malicious:	false
Preview:	......................>...................................8...................u...v...w...x...y.......j.......u.......^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...............................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...F...k...:...;...<...=...>...?...@...A...B...C...D...Y.......G...H...I...J...K...L...M...N...O...P...Q...R.......'...U...V...W...X...\...h...[...m...]...^..._...`...a...b...c...d...e...f...g...o...i...j...l.......p...n...E...q...S...r...s...t...........................

C:\Users\user\AppData\Local\Temp\MSIF85A.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.502472638528862
Encrypted:	false
SSDEEP:	6144:BvAODIPKUuUw4hZXvadywUyZPTXfHjo4yAhbhuKuNY0mGA7yYGuDqf4uY:tZIPKUZw4/XvAHUyhPHjo4yAhbJuNY0S
MD5:	373E46A1E858B6A10432D589DE09732F
SHA1:	26E71B5373999A23EB6E2A282DE3683DD9D698B5
SHA-256:	0357B1185454D1A7D0C72DE5AF8E82A2185C0F1E52FB2D21B53E149D0A688041
SHA-512:	9B83F10F5E1CBE8FF97A5EAD0CA02FCE5F58E6E573077D2293F5C34E8D894836DD8E2A6B1DCDFA6C98F156704208F85E8595046527ADAB3FBE831236C71AAEF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: UTSetup.msi, Detection: malicious, Browse Filename: ICE_Auto_Setup1.3signed.exe, Detection: malicious, Browse Filename: ICE_Auto_Setup1.3signed.exe, Detection: malicious, Browse Filename: Setupfr.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|U..84..84..84...Z..;4......;4...U..<4....0.54....2..4....3.%4...Y..j4...Y..)4...Y..-4......#4..84..f5...Z..$4...Z..94...Z>.94...Z..94..Rich84..........PE..L.....__.........."!.....N...v......%........`............................................@.........................@Z..:............... .......................p....'..T............................(..@............................................text...zL.......N.................. ..`.data...<....`.......R..............@....idata...............b..............@..@.rsrc... ............r..............@..@.reloc..p........0...x..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.502472638528862
Encrypted:	false
SSDEEP:	6144:BvAODIPKUuUw4hZXvadywUyZPTXfHjo4yAhbhuKuNY0mGA7yYGuDqf4uY:tZIPKUZw4/XvAHUyhPHjo4yAhbJuNY0S
MD5:	373E46A1E858B6A10432D589DE09732F
SHA1:	26E71B5373999A23EB6E2A282DE3683DD9D698B5
SHA-256:	0357B1185454D1A7D0C72DE5AF8E82A2185C0F1E52FB2D21B53E149D0A688041
SHA-512:	9B83F10F5E1CBE8FF97A5EAD0CA02FCE5F58E6E573077D2293F5C34E8D894836DD8E2A6B1DCDFA6C98F156704208F85E8595046527ADAB3FBE831236C71AAEF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: UTSetup.msi, Detection: malicious, Browse Filename: ICE_Auto_Setup1.3signed.exe, Detection: malicious, Browse Filename: ICE_Auto_Setup1.3signed.exe, Detection: malicious, Browse Filename: Setupfr.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|U..84..84..84...Z..;4......;4...U..<4....0.54....2..4....3.%4...Y..j4...Y..)4...Y..-4......#4..84..f5...Z..$4...Z..94...Z>.94...Z..94..Rich84..........PE..L.....__.........."!.....N...v......%........`............................................@.........................@Z..:............... .......................p....'..T............................(..@............................................text...zL.......N.................. ..`.data...<....`.......R..............@....idata...............b..............@..@.rsrc... ............r..............@..@.reloc..p........0...x..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	3.9209881965027082
Encrypted:	false
SSDEEP:	192:DM0v0/PezXNe7RPBgImucDiBKyexe2MVsqh1v5h4p6d475zDnSBjCuFsX:Q8mexe7ROycDik5BMVsivAp62VWBj
MD5:	FC8C28EC894EEF0CBB35A6FFBD6572C6
SHA1:	8BA6DB21304875FF8651B6638814043694230A5A
SHA-256:	B2ECF59D2459DD11B73007636AE7914101E59531BBF087F1A9477C10F174E221
SHA-512:	39502B54747CB2ABF4E6E74A4A39F1DBE78B358F338C2C196C689CDC50DAFA461844594FC90A3066E6D1FBB4B3A0F4390F12472AFFE8A497679D3697CD0356FC
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .............................................................................................zx..$!.i.......q?A............................................... .Q...................." .5.......................................................................eD<......................43.%............................................)(.-.......................................................................[UZ.........................s),.1JB..&$.!...................................."..;LC.........-............(%.E...........................e...................S.......k...#...............................i...................].......q...{...'....................((.G..............._...............a...S...........s...........................................+...............................g...............G.......................W...............M...............................................................g...?..

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	3.9209881965027082
Encrypted:	false
SSDEEP:	192:DM0v0/PezXNe7RPBgImucDiBKyexe2MVsqh1v5h4p6d475zDnSBjCuFsX:Q8mexe7ROycDik5BMVsivAp62VWBj
MD5:	FC8C28EC894EEF0CBB35A6FFBD6572C6
SHA1:	8BA6DB21304875FF8651B6638814043694230A5A
SHA-256:	B2ECF59D2459DD11B73007636AE7914101E59531BBF087F1A9477C10F174E221
SHA-512:	39502B54747CB2ABF4E6E74A4A39F1DBE78B358F338C2C196C689CDC50DAFA461844594FC90A3066E6D1FBB4B3A0F4390F12472AFFE8A497679D3697CD0356FC
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .............................................................................................zx..$!.i.......q?A............................................... .Q...................." .5.......................................................................eD<......................43.%............................................)(.-.......................................................................[UZ.........................s),.1JB..&$.!...................................."..;LC.........-............(%.E...........................e...................S.......k...#...............................i...................].......q...{...'....................((.G..............._...............a...S...........s...........................................+...............................g...............G.......................W...............M...............................................................g...?..

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	3.9209881965027082
Encrypted:	false
SSDEEP:	192:DM0v0/PezXNe7RPBgImucDiBKyexe2MVsqh1v5h4p6d475zDnSBjCuFsX:Q8mexe7ROycDik5BMVsivAp62VWBj
MD5:	FC8C28EC894EEF0CBB35A6FFBD6572C6
SHA1:	8BA6DB21304875FF8651B6638814043694230A5A
SHA-256:	B2ECF59D2459DD11B73007636AE7914101E59531BBF087F1A9477C10F174E221
SHA-512:	39502B54747CB2ABF4E6E74A4A39F1DBE78B358F338C2C196C689CDC50DAFA461844594FC90A3066E6D1FBB4B3A0F4390F12472AFFE8A497679D3697CD0356FC
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .............................................................................................zx..$!.i.......q?A............................................... .Q...................." .5.......................................................................eD<......................43.%............................................)(.-.......................................................................[UZ.........................s),.1JB..&$.!...................................."..;LC.........-............(%.E...........................e...................S.......k...#...............................i...................].......q...{...'....................((.G..............._...............a...S...........s...........................................+...............................g...............G.......................W...............M...............................................................g...?..

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_853F67D554F05449430E7E.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	32038
Entropy (8bit):	3.9209881965027082
Encrypted:	false
SSDEEP:	192:DM0v0/PezXNe7RPBgImucDiBKyexe2MVsqh1v5h4p6d475zDnSBjCuFsX:Q8mexe7ROycDik5BMVsivAp62VWBj
MD5:	FC8C28EC894EEF0CBB35A6FFBD6572C6
SHA1:	8BA6DB21304875FF8651B6638814043694230A5A
SHA-256:	B2ECF59D2459DD11B73007636AE7914101E59531BBF087F1A9477C10F174E221
SHA-512:	39502B54747CB2ABF4E6E74A4A39F1DBE78B358F338C2C196C689CDC50DAFA461844594FC90A3066E6D1FBB4B3A0F4390F12472AFFE8A497679D3697CD0356FC
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V...@@.... .(B...:..(....... ..... .............................................................................................zx..$!.i.......q?A............................................... .Q...................." .5.......................................................................eD<......................43.%............................................)(.-.......................................................................[UZ.........................s),.1JB..&$.!...................................."..;LC.........-............(%.E...........................e...................S.......k...#...............................i...................].......q...{...'....................((.G..............._...............a...S...........s...........................................+...............................g...............G.......................W...............M...............................................................g...?..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy\Mailsdaddy Thunderbird To Outlook Converter.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	3149
Entropy (8bit):	3.0027955473954524
Encrypted:	false
SSDEEP:	24:8ARGTU9drsg67IuNA7CYti+D5S2whjaDnFdDEwQUZo/vLrkjaDnCl3HOG4+Ydu1T:8FTU6IuwSRwdYwQW6IJl3wvdu1U
MD5:	D5FC57D56430E56F7B4FD799B187148D
SHA1:	BBF188779C07BA1EC347CEE3E20ED6A6EEE5381A
SHA-256:	67276745ED804EB0E8FC136789577E21E38EA5243A27E7391E8D7052B592D7F9
SHA-512:	87648BECD389C130A9875B346982BB10FCF6AB5BF89DB8615D390844D4B7B484558F255DB22455E27A532B2ACA67DA6C514F2B2F9DB4064177F3C56EBCB0EF33
Malicious:	false
Preview:	L..................F.P......................................................u....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH^Y......................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....^Y....user.<......CW.^^Y............................y.5.j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^^Y.............................%..A.p.p.D.a.t.a.....V.1.....^Y....Roaming.@......CW.^^Y..............................0.R.o.a.m.i.n.g.....\.1.....^Y$...MICROS~1..D......CW.^^Y$...........................;...M.i.c.r.o.s.o.f.t.....\.1.....^Y$...INSTAL~1..D......^Y$.^Y$.....D.....................>...I.n.s.t.a.l.l.e.r.......1.....^Y$...{7A41F~1..~......^Y$.^Y$.....I.....................~...{.7.A.4.1.F.4.3.B.-.6.B.B.A.-.4.1.C.2.-.9.3.0.2.-.0.B.D.D.E.B.B.C.0.3.8.C.}.......2.&}..^Y$.!._59A44~1.EXE..h......^Y$.^Y$............................+.._.5.9.A.4.4.D.4.F.4.9.2.8.D.8.4.7.A.B.3.E.4.3...e.x.e.......X.....\.....\.....\.....\.I.n.s.t.a.l

C:\Users\user\Desktop\Mailsdaddy Thunderbird To Outlook Converter.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	3183
Entropy (8bit):	3.0107411655289824
Encrypted:	false
SSDEEP:	24:8ARGTU9drsg67IuNA7CYti+D5SM3kjaDSdDEwQUZo/vLrkjaDLl3HOG4+Ydu1DQ5:8FTU6IuwSM03dYwQW6Isl3wvdu1z
MD5:	CA317E63270B528FB12620EE9014B5A6
SHA1:	AA3A6B6F8BBBC451588971AF199BEA9229C20755
SHA-256:	75B03EF1F6F8BA7A16CD2D5B91C2B91990009F61A8518DC161A7EEC53A978F83
SHA-512:	2422C58CAC2C67F011F3AC07A1E0517687E46302C49D2E27E0EEBF2CBC5131383C3DEE4529138923B93DEFA34634B39B71C898DA2BFBCE172EFC52DF8C80ED0C
Malicious:	false
Preview:	L..................F.P......................................................u....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH^Y......................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....^Y....user.<......CW.^^Y............................y.5.j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^^Y.............................%..A.p.p.D.a.t.a.....V.1.....^Y....Roaming.@......CW.^^Y..............................0.R.o.a.m.i.n.g.....\.1.....^Y$...MICROS~1..D......CW.^^Y$...........................;...M.i.c.r.o.s.o.f.t.....\.1.....^Y$...INSTAL~1..D......^Y$.^Y$.....D.....................>...I.n.s.t.a.l.l.e.r.......1.....^Y$...{7A41F~1..~......^Y$.^Y$.....I.....................~...{.7.A.4.1.F.4.3.B.-.6.B.B.A.-.4.1.C.2.-.9.3.0.2.-.0.B.D.D.E.B.B.C.0.3.8.C.}.......2.&}..^Y$.!._1ABCA~1.EXE..h......^Y$.^Y$...........................~..._.1.A.B.C.A.D.3.7.8.3.6.1.F.6.7.8.0.5.0.D.B.6...e.x.e.......i.....\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g

C:\Windows\Installer\5d34b7.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
Category:	dropped
Size (bytes):	8503808
Entropy (8bit):	7.943057438543247
Encrypted:	false
SSDEEP:	196608:wKx7EobZC0JsWLJPC8O1tDEZmsoinEVhzRSW8KHhKKV:x7ElSsWLJK8eOmsHO8Kg
MD5:	7F5CBD30246515F4E8CEF07794854EDF
SHA1:	51C38B3AF8AD36C7772D189A27D2B785CBDF326F
SHA-256:	2C0B55E2732CD820C82E91B9C9E63CAC50CC4E278D2DF9BCFFCABAB5D900E9F2
SHA-512:	D49F8165B8A7B4D7C8C1E22CDF30239F03B8BB32428BB0D435B084A795F07C378C99DA129A2B391397879AE3C6A4B6D6FBC9325B9EFFBA56942B7D2EBA2A6A78
Malicious:	false
Preview:	......................>...................................8...................u...v...w...x...y.......j.......u.......^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...............................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...F...k...:...;...<...=...>...?...@...A...B...C...D...Y.......G...H...I...J...K...L...M...N...O...P...Q...R.......'...U...V...W...X...\...h...[...m...]...^..._...`...a...b...c...d...e...f...g...o...i...j...l.......p...n...E...q...S...r...s...t...........................

C:\Windows\Installer\5d34b9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
Category:	dropped
Size (bytes):	8503808
Entropy (8bit):	7.943057438543247
Encrypted:	false
SSDEEP:	196608:wKx7EobZC0JsWLJPC8O1tDEZmsoinEVhzRSW8KHhKKV:x7ElSsWLJK8eOmsHO8Kg
MD5:	7F5CBD30246515F4E8CEF07794854EDF
SHA1:	51C38B3AF8AD36C7772D189A27D2B785CBDF326F
SHA-256:	2C0B55E2732CD820C82E91B9C9E63CAC50CC4E278D2DF9BCFFCABAB5D900E9F2
SHA-512:	D49F8165B8A7B4D7C8C1E22CDF30239F03B8BB32428BB0D435B084A795F07C378C99DA129A2B391397879AE3C6A4B6D6FBC9325B9EFFBA56942B7D2EBA2A6A78
Malicious:	false
Preview:	......................>...................................8...................u...v...w...x...y.......j.......u.......^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...............................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...F...k...:...;...<...=...>...?...@...A...B...C...D...Y.......G...H...I...J...K...L...M...N...O...P...Q...R.......'...U...V...W...X...\...h...[...m...]...^..._...`...a...b...c...d...e...f...g...o...i...j...l.......p...n...E...q...S...r...s...t...........................

C:\Windows\Installer\MSI36CB.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.502472638528862
Encrypted:	false
SSDEEP:	6144:BvAODIPKUuUw4hZXvadywUyZPTXfHjo4yAhbhuKuNY0mGA7yYGuDqf4uY:tZIPKUZw4/XvAHUyhPHjo4yAhbJuNY0S
MD5:	373E46A1E858B6A10432D589DE09732F
SHA1:	26E71B5373999A23EB6E2A282DE3683DD9D698B5
SHA-256:	0357B1185454D1A7D0C72DE5AF8E82A2185C0F1E52FB2D21B53E149D0A688041
SHA-512:	9B83F10F5E1CBE8FF97A5EAD0CA02FCE5F58E6E573077D2293F5C34E8D894836DD8E2A6B1DCDFA6C98F156704208F85E8595046527ADAB3FBE831236C71AAEF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|U..84..84..84...Z..;4......;4...U..<4....0.54....2..4....3.%4...Y..j4...Y..)4...Y..-4......#4..84..f5...Z..$4...Z..94...Z>.94...Z..94..Rich84..........PE..L.....__.........."!.....N...v......%........`............................................@.........................@Z..:............... .......................p....'..T............................(..@............................................text...zL.......N.................. ..`.data...<....`.......R..............@....idata...............b..............@..@.rsrc... ............r..............@..@.reloc..p........0...x..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3739.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.502472638528862
Encrypted:	false
SSDEEP:	6144:BvAODIPKUuUw4hZXvadywUyZPTXfHjo4yAhbhuKuNY0mGA7yYGuDqf4uY:tZIPKUZw4/XvAHUyhPHjo4yAhbJuNY0S
MD5:	373E46A1E858B6A10432D589DE09732F
SHA1:	26E71B5373999A23EB6E2A282DE3683DD9D698B5
SHA-256:	0357B1185454D1A7D0C72DE5AF8E82A2185C0F1E52FB2D21B53E149D0A688041
SHA-512:	9B83F10F5E1CBE8FF97A5EAD0CA02FCE5F58E6E573077D2293F5C34E8D894836DD8E2A6B1DCDFA6C98F156704208F85E8595046527ADAB3FBE831236C71AAEF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|U..84..84..84...Z..;4......;4...U..<4....0.54....2..4....3.%4...Y..j4...Y..)4...Y..-4......#4..84..f5...Z..$4...Z..94...Z>.94...Z..94..Rich84..........PE..L.....__.........."!.....N...v......%........`............................................@.........................@Z..:............... .......................p....'..T............................(..@............................................text...zL.......N.................. ..`.data...<....`.......R..............@....idata...............b..............@..@.rsrc... ............r..............@..@.reloc..p........0...x..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI37A7.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	140232
Entropy (8bit):	4.364749405051337
Encrypted:	false
SSDEEP:	1536:r7RLqGLuwE7RLqGLuwx7RLqGLuwe7RLqGLuwfMYg/ZluGbBr:rLELxLeLfMYg/ZluGbBr
MD5:	40DF49538A4F1568ACBD53FE6E21B684
SHA1:	195BF1469C709B76B147EF81C0A4FD18040481D4
SHA-256:	43493F5E06DA94AA0E8F8D77B3959792BD096ED3E9CFE1A4AB4D5C3CC4515E38
SHA-512:	13C91FEFA8431ED586ECDCFF3D6634E60DECDE791F7803379B1E3B896DBEEDDF1E0CF2EB82423EB1CC14CEF27E4F7C59D1F2F16FEBEEE5AA061E7EFA81F73EA2
Malicious:	false
Preview:	...@IXOS.@.....@#.^Y.@.....@.....@.....@.....@.....@......&.{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}+.MailsDaddy Thunderbird to Outlook Converter..MSIF618.tmp.@.....@.....@.....@......_853F67D554F05449430E7E.exe..&.{A232982E-298B-41EA-93F1-4F055FADF244}.....@.....@.....@.....@.......@.....@.....@.......@....+.MailsDaddy Thunderbird to Outlook Converter......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{D98F3635-E5A6-E697-8AEA-FF9A58963D52}z.C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.tlb.@.......@.....@.....@......&.{D8237FD1-DE18-5DC1-0EC9-35347546BBF7}z.C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL.@.......@.....@.....@......&.{06856F88-F013-FCFE-B98E-FDE3FF5B6CA6}i.C:\Program Files (x86)\MailsDaddy So

C:\Windows\Installer\SourceHash{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1629380802620353
Encrypted:	false
SSDEEP:	12:JSbX72FjGSAGiLIlHVRpY5h/7777777777777777777777777vDHFzuUOdy/spdz:JYSQI5eof0/JF
MD5:	65E9F716AA8BFC8478E962734D154B71
SHA1:	6EDF0FDEE72D49ECE16AA9B4B09F2D95742A0632
SHA-256:	D7AC05F8F8F70D0C6B3FBD71C7E80E9C9A29D75E4963BCA41208D1B7708247D3
SHA-512:	8117E65EB38049448AEF186678C3E141E33FBA6C7B6E6A5AE8C1244DC224D0F7CA2CDD0BFECA29D1E9AA0469B4450AD5AA3B7DD8C9AE45750B111165EC0BBA66
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7612796069995205
Encrypted:	false
SSDEEP:	48:b8PhauRc06WXJEjT5SlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQWG:Cha1HjT0brcuH60CiIH70CG
MD5:	4C572B71A7E1C13B1B741F50726B9E3F
SHA1:	E252FF259CE45F915753ED0F8716D405FCF3E704
SHA-256:	D17B0FACD095B03DD902202FA7469D4F50E80071101F938563D2FA3A50C3A97A
SHA-512:	2D6A81EA2D04194B4615CF806B5AAFBD5B4ED42763A58F7D33EB255963E37457D536CEDF18A2951653CC7AC3A843C44CBFCA76D1C035FD2DBB823C6EE1C047D8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432220
Entropy (8bit):	5.375169812639068
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauq:zTtbmkExhMJCIpEr1
MD5:	72E179D38A9DED4264AAAD3117709864
SHA1:	C7321E41AFC02AB9A8F5412D5790EA21831793BF
SHA-256:	19CDCAA04590EA4390AB81BDDF8A4356F1594E0F63ED51D3CCC265F698E023E9
SHA-512:	D4D88A01582F08B6C804854D730100B5693B5504289F977C9F11D0FF5F1422EB4D96EE54F15EBEDEA12FF405FD322375A8071509A9AA5234128AE4643F891238
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF024FF338AFB7C580.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7612796069995205
Encrypted:	false
SSDEEP:	48:b8PhauRc06WXJEjT5SlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQWG:Cha1HjT0brcuH60CiIH70CG
MD5:	4C572B71A7E1C13B1B741F50726B9E3F
SHA1:	E252FF259CE45F915753ED0F8716D405FCF3E704
SHA-256:	D17B0FACD095B03DD902202FA7469D4F50E80071101F938563D2FA3A50C3A97A
SHA-512:	2D6A81EA2D04194B4615CF806B5AAFBD5B4ED42763A58F7D33EB255963E37457D536CEDF18A2951653CC7AC3A843C44CBFCA76D1C035FD2DBB823C6EE1C047D8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF05E92B92D98D84B0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1B4961396F494972.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.22317736253951748
Encrypted:	false
SSDEEP:	48:3kT+SkdYwQW71iCyGSkdYwQW61iCyX5lt4pW5lt4goowrKlQrQ9nol:3vH70CdH60CihQr1
MD5:	73B74CC4FBEA19D850258659FD863548
SHA1:	D6987EDE5B8898FA4DBF55F39571ACBB6551D698
SHA-256:	75D951CA0BF6462A1A16920F9F51136B238FBF02E78E64A313DC896B9693B9B3
SHA-512:	2F2306817BC6CB12B8389B2034328B7E2212E9164384E55E4E5E136FD9B72373C227BE72D191BDD10138700B416DA5CC7E3DF4A7A2CB2A64E019C5116EACC19C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF398311AC0ED6BE97.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF425128921A3C3CF1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.396048141246669
Encrypted:	false
SSDEEP:	48:ZHyu0JveFXJfT50oMlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQW7S:VyuHTOLbrcuH60CiIH70CG
MD5:	06D2E64146ABBC71597BC74BBFE85B0C
SHA1:	DDCB38E12410FDED48DD60CEB275EF70E24D3DBD
SHA-256:	75117BB1D2C2250877465380E867D38F50B96D2820C74F01762A7EB5776D9894
SHA-512:	C52F3D29E495F1C961A323A7CBCC2B9FEF0707F5EE8A3C83B7A96B534F8989ADA08B1CB28A24B0CE4E1A8663248D62099D8B30D28F6CCB9A2395F49F6F4FB596
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6F331D9E6A1A4B55.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.396048141246669
Encrypted:	false
SSDEEP:	48:ZHyu0JveFXJfT50oMlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQW7S:VyuHTOLbrcuH60CiIH70CG
MD5:	06D2E64146ABBC71597BC74BBFE85B0C
SHA1:	DDCB38E12410FDED48DD60CEB275EF70E24D3DBD
SHA-256:	75117BB1D2C2250877465380E867D38F50B96D2820C74F01762A7EB5776D9894
SHA-512:	C52F3D29E495F1C961A323A7CBCC2B9FEF0707F5EE8A3C83B7A96B534F8989ADA08B1CB28A24B0CE4E1A8663248D62099D8B30D28F6CCB9A2395F49F6F4FB596
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF733F5D7A6A2BFFF0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF74B0A4B7829CD6FD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7612796069995205
Encrypted:	false
SSDEEP:	48:b8PhauRc06WXJEjT5SlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQWG:Cha1HjT0brcuH60CiIH70CG
MD5:	4C572B71A7E1C13B1B741F50726B9E3F
SHA1:	E252FF259CE45F915753ED0F8716D405FCF3E704
SHA-256:	D17B0FACD095B03DD902202FA7469D4F50E80071101F938563D2FA3A50C3A97A
SHA-512:	2D6A81EA2D04194B4615CF806B5AAFBD5B4ED42763A58F7D33EB255963E37457D536CEDF18A2951653CC7AC3A843C44CBFCA76D1C035FD2DBB823C6EE1C047D8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9AFC030D0E740FB6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0702180129077671
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOyIJjuWTOIbETyfVky6lf1:2F0i8n0itFzDHFzuUOdyid
MD5:	915A5E99D988337F53F6EDB4194AB90F
SHA1:	8E1C01EE20D1135DB38173BD739D62B9A512C56C
SHA-256:	0076AD1D7BE382D922A40386F5B0B22FEBA06C60E720AC4B4466C5BD8A00FDDF
SHA-512:	81923BDDCEDDE4C95C9143C2661C05ED163FD2EE8941E52546F2B142D7B4A122A5815243B16A84B0DAB8E7DE5D249BA437EB1EBD16E181F4036F012A769788B8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB53C683215404C64.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.396048141246669
Encrypted:	false
SSDEEP:	48:ZHyu0JveFXJfT50oMlSE99r0luSkdYwQW61iCyX5lt4pW5lt4goowrTSkdYwQW7S:VyuHTOLbrcuH60CiIH70CG
MD5:	06D2E64146ABBC71597BC74BBFE85B0C
SHA1:	DDCB38E12410FDED48DD60CEB275EF70E24D3DBD
SHA-256:	75117BB1D2C2250877465380E867D38F50B96D2820C74F01762A7EB5776D9894
SHA-512:	C52F3D29E495F1C961A323A7CBCC2B9FEF0707F5EE8A3C83B7A96B534F8989ADA08B1CB28A24B0CE4E1A8663248D62099D8B30D28F6CCB9A2395F49F6F4FB596
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD094D166183BA70A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD3B2D85F736F5F4F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.932118436915041
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	thunderbird-to-outlook-converter.exe
File size:	8'612'560 bytes
MD5:	ed6c1f0e4bc19623cbbad48cf84ab099
SHA1:	ea54f4b7f52c6948c102d452a615671738427bce
SHA256:	28923cdeb17db6f79d0f7c134daa9343cb99253921c1f4054d201b1e242305ca
SHA512:	a91b1286e23bfd4d4daadbb20536df223787ddc1264a575de412d4cf48491ab06f595ce358cc883be6a8877f457086f78051f8ab053f01ed8d2d4b02b3ca3eac
SSDEEP:	196608:gKx7EobZC0JsWLJPC8O1tDEZmsoinEVhzRSW8KHhKKVr:h7ElSsWLJK8eOmsHO8KgE
TLSH:	B08623C63041D63AC19931F9691AD26011EAFF1068E096B7A374F2781D329C3DF6AF5E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m..............&~......&m......&n.......^..............&q......&.......&{.....Rich............................PE..L.....kI...

File Icon


Icon Hash:	07236d2632190541

Static PE Info

General

Entrypoint:	0x401f54
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x496BFC80 [Tue Jan 13 02:29:20 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0f7d0ed8477bf9ca9b4b2ce07e02a90e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	07/04/2020 11:32:51 12/04/2021 20:35:51
Subject Chain	CN=Mails Daddy Software Private Limited, O=Mails Daddy Software Private Limited, L=Delhi, C=IN
Version:	3
Thumbprint MD5:	3763B7CA36279068AF0AB9644E09AF35
Thumbprint SHA-1:	3D5FE267B4A737514BB6A8CC2505C7FE7956E623
Thumbprint SHA-256:	A98DB06864310A11083457FD9102A1D13E8E958ABD2D827C9F01B832655B4E23
Serial:	00F5AD6D27109B5ED4

Entrypoint Preview

Instruction
call 00007FB41CB12B04h
jmp 00007FB41CB0FE3Ch
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007FB41CB13606h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
test al, 82h
pop ecx
jne 00007FB41CB10039h
call 00007FB41CB1034Eh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007FB41CB10152h
test al, 40h
je 00007FB41CB1002Fh
call 00007FB41CB10333h
mov dword ptr [eax], 00000022h
jmp 00007FB41CB10005h
push ebx
xor ebx, ebx
test al, 01h
je 00007FB41CB10038h
test al, 10h
mov dword ptr [esi+04h], ebx
je 00007FB41CB100ABh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
test ax, 0000010Ch
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
jne 00007FB41CB1004Eh
call 00007FB41CB133F8h
add eax, 20h
cmp esi, eax
je 00007FB41CB1002Eh
call 00007FB41CB133ECh
add eax, 40h
cmp esi, eax
jne 00007FB41CB1002Fh
push dword ptr [ebp+0Ch]
call 00007FB41CB1337Fh
test eax, eax
pop ecx
jne 00007FB41CB10029h
push esi
call 00007FB41CB13330h
pop ecx
test word ptr [esi+0Ch], 0108h
push edi
je 00007FB41CB100A6h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx
mov ecx, dword ptr [esi+18h]
sub edi, eax

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[C++] VS2005 build 50727
[ C ] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5e8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x824315	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x835000	0x1ad0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc200	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xde78	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc000	0x1b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa494	0xb000	faa20d416cf66a0e758d51d62d506053	False	0.5961692116477273	data	6.374283196502087	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc000	0x2f56	0x3000	191e5dfc6ac85f3b137e574ecc199dee	False	0.3616536458333333	data	5.33958366807718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf000	0x2d3c	0x1000	605cb8f363da7eb9d3c143ecb2c1f1c2	False	0.22607421875	data	2.365699420498644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12000	0x824315	0x825000	10b2a7064423f5968165250d22c52ce2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MSI	0x121d4	0x81c200	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020	English	United States	0.5271825790405273
RT_ICON	0x82e3d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5328014184397163
RT_ICON	0x82e83c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.37922138836772984
RT_ICON	0x82f8e4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.337448132780083
RT_ICON	0x831e8c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.30969532357109114
RT_GROUP_ICON	0x8360b4	0x3e	data	English	United States	0.8225806451612904
RT_MANIFEST	0x8360f4	0x221	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5486238532110091

Imports

DLL	Import
KERNEL32.dll	GetTempPathW, GetTempFileNameW, FindResourceW, SizeofResource, LoadResource, LockResource, CreateThread, CreateFileW, DeleteFileW, CreateFileA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, ExitProcess, CreateProcessW, GetLastError, WriteFile, FlushFileBuffers, CloseHandle, GetProcAddress, GetModuleHandleA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, GetStdHandle, GetModuleFileNameA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSection, GetModuleFileNameW, FreeEnvironmentStringsA, MultiByteToWideChar, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, Sleep, HeapSize, RtlUnwind, GetLocaleInfoA, VirtualAlloc, HeapReAlloc, SetStdHandle, RaiseException
USER32.dll	DefWindowProcW, PostQuitMessage, EndPaint, BeginPaint, UpdateWindow, ShowWindow, CreateWindowExW, GetSystemMetrics, RegisterClassExW, GetSysColorBrush, LoadCursorW, PostMessageW, DispatchMessageW, TranslateMessage, GetMessageW, MessageBoxW, InvalidateRect
GDI32.dll	TextOutW, SetBkMode, SelectObject, GetStockObject, DeleteObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	17:56:49
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe"
Imagebase:	0x400000
File size:	8'612'560 bytes
MD5 hash:	ED6C1F0E4BC19623CBBAD48CF84AB099
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:56:49
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	msiexec.exe /i C:\Users\user\AppData\Local\Temp\MSIF618.tmp
Imagebase:	0x640000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:56:49
Start date:	30/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6ea700000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:56:49
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 7290A6845925C195E7014D9F7E4EB858 C
Imagebase:	0x640000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:57:05
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding C3F8760112445D68E9871B76E5B0FA05
Imagebase:	0x640000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.9%
Total number of Nodes:	621
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040134E Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 192
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00401370
_memset.LIBCMT ref: 00401395
_memset.LIBCMT ref: 004013AA
GetTempPathW.KERNEL32(00000104,?), ref: 004013C6
GetTempFileNameW.KERNELBASE(?,MSI,00000000,?), ref: 004013F1
__CxxThrowException@8.LIBCMT ref: 0040140B
FindResourceW.KERNEL32(?,DATA,MSI), ref: 00401417
SizeofResource.KERNEL32(?,00000000), ref: 00401438
LoadResource.KERNEL32(?,00000000), ref: 00401459
LockResource.KERNEL32(00000000), ref: 00401475
CreateFileW.KERNELBASE(?,00120116,00000003,00000000,00000002,00000080,00000000), ref: 004014AD
ShowWindow.USER32(00000005), ref: 004014EF
WriteFile.KERNELBASE(?,?,00002000,?,00000000), ref: 0040150B
InvalidateRect.USER32(00000000,00000001), ref: 00401540
ShowWindow.USER32(00000000), ref: 00401551
CloseHandle.KERNELBASE(?), ref: 00401556
_swprintf.LIBCMT ref: 00401576
_memset.LIBCMT ref: 00401585
CreateProcessW.KERNELBASE ref: 004015C2
ExitProcess.KERNEL32 ref: 004015C9

Strings

msiexec.exe, xrefs: 00401563
MSI, xrefs: 004013E4, 004013E9, 00401410
DATA, xrefs: 00401411
%s /i %s, xrefs: 00401568

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: Resource$File_memset$CreateProcessShowTempWindow$CloseException@8ExitFindH_prolog3_catchHandleInvalidateLoadLockNamePathRectSizeofThrowWrite_swprintf
String ID: %s /i %s$DATA$MSI$msiexec.exe
API String ID: 595904572-4018923517
Opcode ID: 6749e29da5631927e082cef264a39af6d613541d54a80a6319aa98c742fdb2b9
Instruction ID: 20377c8c5a59a0e20dd786114ab2e7341586cf19af3ec8ffaaf84ee0be96f013
Opcode Fuzzy Hash: 6749e29da5631927e082cef264a39af6d613541d54a80a6319aa98c742fdb2b9
Instruction Fuzzy Hash: 49618B71900218EBDB20DFE5DD89EEE7AB8BB08704F20453AF505F61E1D7789A05CB69

Non-executed Functions

Function 004065BA Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(USER32.DLL,00000000,00000000,00000314,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 004065E7
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00406603

Part of subcall function 00402355: TlsGetValue.KERNEL32(00000000,004023CA,00000000,004065C8,00000000,00000000,00000314,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 00402362
Part of subcall function 00402355: TlsGetValue.KERNEL32(00000004,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 00402379

GetProcAddress.KERNEL32(00000000,00000000), ref: 00406620

Part of subcall function 00402355: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 0040238E
Part of subcall function 00402355: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004023A9

GetProcAddress.KERNEL32(00000000,00000000), ref: 00406635
__invoke_watson.LIBCMT ref: 00406656

Part of subcall function 0040214A: _memset.LIBCMT ref: 004021D6
Part of subcall function 0040214A: IsDebuggerPresent.KERNEL32(?,?,00000000), ref: 004021F4
Part of subcall function 0040214A: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000000), ref: 004021FE
Part of subcall function 0040214A: UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00402208
Part of subcall function 0040214A: GetCurrentProcess.KERNEL32(C000000D,?,?,00000000), ref: 00402223
Part of subcall function 0040214A: TerminateProcess.KERNEL32(00000000,?,?,00000000), ref: 0040222A

Part of subcall function 004023CC: TlsGetValue.KERNEL32(00000000,00402461), ref: 004023D9
Part of subcall function 004023CC: TlsGetValue.KERNEL32(00000004), ref: 004023F0

Part of subcall function 004023CC: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 00402405
Part of subcall function 004023CC: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00402420

GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0040666A
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00406682
__invoke_watson.LIBCMT ref: 004066F5

Strings

GetProcessWindowStation, xrefs: 0040667C
USER32.DLL, xrefs: 004065E2
MessageBoxA, xrefs: 004065FD
GetUserObjectInformationA, xrefs: 00406664

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: AddressProc$Value$ExceptionFilterHandleModuleProcessUnhandled__invoke_watson$CurrentDebuggerLibraryLoadPresentTerminate_memset
String ID: GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2940365033-1046234306
Opcode ID: f92e63f97473645d0ee2bbb4634820050cc61aa16b2c6853a90bedad70716cb5
Instruction ID: 903c93859fa46a6f4ea376e20a98d8dd23118c8d58616714cf58463bdc1121ca
Opcode Fuzzy Hash: f92e63f97473645d0ee2bbb4634820050cc61aa16b2c6853a90bedad70716cb5
Instruction Fuzzy Hash: 8641B471900205EADF10AFB59D8596F7BA9AE44348B25093FE40AF32D0DBBC99508B6D

Function 00401A49 Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 004037E1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004037F6
UnhandledExceptionFilter.KERNEL32(0040C8AC), ref: 00403801
GetCurrentProcess.KERNEL32(C0000409), ref: 0040381D
TerminateProcess.KERNEL32(00000000), ref: 00403824

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: e1a142f2597a4008e7613153095846bbf84df19b1d486ef0f12ac1990e7fc7c8
Instruction ID: 3151b91aa872a883dad0193dde7ea169f4a89536d61c20abba83bbf876892fdd
Opcode Fuzzy Hash: e1a142f2597a4008e7613153095846bbf84df19b1d486ef0f12ac1990e7fc7c8
Instruction Fuzzy Hash: 0B21CBB4941208EFD740DF68F9846843BA5FB98305F50913AE909A32A0E7B85AD18F5D

Function 004028A5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcpy_s.LIBCMT ref: 00402911
__invoke_watson.LIBCMT ref: 00402922
GetModuleFileNameA.KERNEL32(00000000,00410081,00000104,0040259A,00000001,00000214), ref: 0040293E
_strcpy_s.LIBCMT ref: 00402953
__invoke_watson.LIBCMT ref: 00402966
_strlen.LIBCMT ref: 0040296F
_strlen.LIBCMT ref: 0040297C
__invoke_watson.LIBCMT ref: 004029A9
_strcat_s.LIBCMT ref: 004029BC
__invoke_watson.LIBCMT ref: 004029CD
_strcat_s.LIBCMT ref: 004029DE
__invoke_watson.LIBCMT ref: 004029EF
GetStdHandle.KERNEL32(000000F4,00000001,00000001,00000000,76ED5E70,00000003,00402A71,000000FC,00407037,00000001,00000000,00000000,?,004061B6,0040259A,00000001), ref: 00402A0E
_strlen.LIBCMT ref: 00402A2F
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,004061B6,0040259A,00000001,00000001,00402B7E,00000018,0040E0A0,0000000C,00402C0D,00000001), ref: 00402A39

Strings

Runtime Error!Program: , xrefs: 00402900
Microsoft Visual C++ Runtime Library, xrefs: 004029FC
<program name unknown>, xrefs: 00402948
..., xrefs: 0040298D

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: __invoke_watson$_strlen$File_strcat_s_strcpy_s$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1879448924-4022980321
Opcode ID: 409424b9660b85a0269d64acb115b1ad67300d71880ba7c06291fded9d5e2056
Instruction ID: 93a8d7d5ea80ae4c3e828802d8d553a9b5e06a216e86f543143183862d938038
Opcode Fuzzy Hash: 409424b9660b85a0269d64acb115b1ad67300d71880ba7c06291fded9d5e2056
Instruction Fuzzy Hash: 9F3127B3A402007AE52132615E8EF6B364C9B15318F15023BFD0AB52D2EAFD8D5081BD

Function 004024B2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040E058,0000000C,004025C3,00000000,00000000), ref: 004024C3
GetProcAddress.KERNEL32(?,EncodePointer), ref: 004024F7
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402507
InterlockedIncrement.KERNEL32(0040F6F8), ref: 00402529
__lock.LIBCMT ref: 00402531
___addlocaleref.LIBCMT ref: 00402550

Strings

EncodePointer, xrefs: 004024E9
KERNEL32.DLL, xrefs: 004024BE
DecodePointer, xrefs: 004024FF

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: AddressProc$HandleIncrementInterlockedModule___addlocaleref__lock
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1036688887-2843748187
Opcode ID: 2274a066ac026ae925fe5652a49c290d3624d1abdb19e6b261c600bba24699d5
Instruction ID: fbdbd79d6d8703cd58bfce1346c9629dc42ac9281775cfae9e4e5af3c7655ebc
Opcode Fuzzy Hash: 2274a066ac026ae925fe5652a49c290d3624d1abdb19e6b261c600bba24699d5
Instruction Fuzzy Hash: EA116070940701DED720AFBA9D49B5ABBF0AF00304F10467FA959B26D0CBB89504DF1C

Function 00402355 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,004023CA,00000000,004065C8,00000000,00000000,00000314,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 00402362
TlsGetValue.KERNEL32(00000004,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 00402379
GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,?,00410068,00402A07,00410068,Microsoft Visual C++ Runtime Library,00012010), ref: 0040238E
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004023A9

Strings

EncodePointer, xrefs: 004023A3
KERNEL32.DLL, xrefs: 00402389

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: EncodePointer$KERNEL32.DLL
API String ID: 1929421221-3682587211
Opcode ID: 2a42737889a403e7d8afdae4d2f3ffc8d2942cebba98d6740baa3c3f948ea94e
Instruction ID: 54e1165a2b9932306059abba70c4f1523072c5380ccb0acef97fefcbe4b4d81e
Opcode Fuzzy Hash: 2a42737889a403e7d8afdae4d2f3ffc8d2942cebba98d6740baa3c3f948ea94e
Instruction Fuzzy Hash: 1AF01D30944213DBC7225BB5EE48A6B3AA49F417507144376ED18F6AF4DBBCCC41CA9D

Function 004023CC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000,00402461), ref: 004023D9
TlsGetValue.KERNEL32(00000004), ref: 004023F0
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 00402405
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00402420

Strings

KERNEL32.DLL, xrefs: 00402400
DecodePointer, xrefs: 0040241A

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: Value$AddressHandleModuleProc
String ID: DecodePointer$KERNEL32.DLL
API String ID: 1929421221-629428536
Opcode ID: cafb124f787224b482a95b2ac3b4a91c0234f5a1e4f0cc787b7d164dfc720926
Instruction ID: c78dc7a9585208a99074aea40c6bc01db638a5f6f1ffce41ee587fa2e8510638
Opcode Fuzzy Hash: cafb124f787224b482a95b2ac3b4a91c0234f5a1e4f0cc787b7d164dfc720926
Instruction Fuzzy Hash: 1EF09030905213DBC6255BB5EF88A6B3AA4AF013547148376F808F66F5CB78CC41CA9D

Function 0040611B Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00406139

Part of subcall function 00402BF4: __mtinitlocknum.LIBCMT ref: 00402C08
Part of subcall function 00402BF4: __amsg_exit.LIBCMT ref: 00402C14
Part of subcall function 00402BF4: EnterCriticalSection.KERNEL32(0040258B,0040258B,?,00408D0B,00000004,0040E328,0000000C,004061FC,00000000,00000000,00000000,00000000,00000000,0040259A,00000001,00000214), ref: 00402C1C

___sbh_find_block.LIBCMT ref: 00406144
___sbh_free_block.LIBCMT ref: 00406153
HeapFree.KERNEL32(00000000,00000001,0040E260,0000000C,00402BD5,00000000,0040E0A0,0000000C,00402C0D,00000001,0040258B,?,00408D0B,00000004,0040E328,0000000C), ref: 00406183
GetLastError.KERNEL32(?,00408D0B,00000004,0040E328,0000000C,004061FC,00000000,00000000,00000000,00000000,00000000,0040259A,00000001,00000214), ref: 00406194

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: ec309f13ac6ed2460b9bc622685fdac9bcbdfdb6d37f39f168fb5652b14ded11
Instruction ID: 2a96ef66e3485db1b055fe51310aebddc08bfb44f5d3ca0f1bd79134f6b4c0cc
Opcode Fuzzy Hash: ec309f13ac6ed2460b9bc622685fdac9bcbdfdb6d37f39f168fb5652b14ded11
Instruction Fuzzy Hash: D5018F31945202EAEF206FB29D0AB4E3774AF00769F11423FF505BA2C2CA7C95519A5D

Function 0040632B Relevance: 6.1, APIs: 4, Instructions: 101
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040635B
__isleadbyte_l.LIBCMT ref: 0040638F
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?,?,?), ref: 004063C0
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?), ref: 0040642E

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3d6466147ee63cab85e1936a5fef035c853123870c94230fcfdac984927a4de7
Instruction ID: 7491b92a4c32cea02cca1e18898105e8535631cd0ddae29ab752054e9d357e5d
Opcode Fuzzy Hash: 3d6466147ee63cab85e1936a5fef035c853123870c94230fcfdac984927a4de7
Instruction Fuzzy Hash: 7131E230500245EFDB20DFA4C880AAE7BB5FF01310F1A817AE866AB2D1D734DD60DB99

Function 00405788 Relevance: 6.0, APIs: 4, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004025E8: __amsg_exit.LIBCMT ref: 004025F6

__amsg_exit.LIBCMT ref: 004057B4
__lock.LIBCMT ref: 004057C4
InterlockedDecrement.KERNEL32(?), ref: 004057E1
InterlockedIncrement.KERNEL32(00D32BF8), ref: 0040580C

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__lock
String ID:
API String ID: 4129207761-0
Opcode ID: 92750075eb3ef2bf1ee2714700a2e6cd28c9732acaf63113e8133cc47fa9dec7
Instruction ID: 4349d519936afe56ffc5c276bbf6f90d14a5f85baeece521cae09b1fc0886954
Opcode Fuzzy Hash: 92750075eb3ef2bf1ee2714700a2e6cd28c9732acaf63113e8133cc47fa9dec7
Instruction Fuzzy Hash: 67017936901A12DBD620BBA6994A74B77B0BB04714F04413BE805B76D1CB3CA841EF9D

Function 00402571 Relevance: 6.0, APIs: 4, Instructions: 45
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000,004022AA,00401B88,00000000,00000000,?,004016E4,?,?,?,00000000,00000208,0040157B,?,00000208), ref: 00402573

Part of subcall function 00402443: TlsGetValue.KERNEL32(00000000,00402586), ref: 0040244A
Part of subcall function 00402443: TlsSetValue.KERNEL32(00000000), ref: 0040246B

__calloc_crt.LIBCMT ref: 00402595

Part of subcall function 004061E9: __calloc_impl.LIBCMT ref: 004061F7
Part of subcall function 004061E9: Sleep.KERNEL32(00000000,0040259A,00000001,00000214), ref: 0040620E

Part of subcall function 004023CC: TlsGetValue.KERNEL32(00000000,00402461), ref: 004023D9
Part of subcall function 004023CC: TlsGetValue.KERNEL32(00000004), ref: 004023F0

Part of subcall function 004024B2: GetModuleHandleA.KERNEL32(KERNEL32.DLL,0040E058,0000000C,004025C3,00000000,00000000), ref: 004024C3
Part of subcall function 004024B2: GetProcAddress.KERNEL32(?,EncodePointer), ref: 004024F7
Part of subcall function 004024B2: GetProcAddress.KERNEL32(?,DecodePointer), ref: 00402507
Part of subcall function 004024B2: InterlockedIncrement.KERNEL32(0040F6F8), ref: 00402529
Part of subcall function 004024B2: __lock.LIBCMT ref: 00402531
Part of subcall function 004024B2: ___addlocaleref.LIBCMT ref: 00402550

GetCurrentThreadId.KERNEL32 ref: 004025C5
SetLastError.KERNEL32(00000000), ref: 004025DD

Memory Dump Source

Source File: 00000000.00000002.1707141423.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1707124625.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707159750.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707176336.000000000040F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707192629.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_thunderbird-to-outlook-converter.jbxd

Similarity

API ID: Value$AddressErrorLastProc$CurrentHandleIncrementInterlockedModuleSleepThread___addlocaleref__calloc_crt__calloc_impl__lock
String ID:
API String ID: 1081334783-0
Opcode ID: 4b477ac62d0d8da954439966bd98dbafc4556b3d36004d3aa4a932d628616111
Instruction ID: c34bda9c1bb9a39f5e0c4412eb6bf616bca4bee9ab0c0707fc9fbb88643eb821
Opcode Fuzzy Hash: 4b477ac62d0d8da954439966bd98dbafc4556b3d36004d3aa4a932d628616111
Instruction Fuzzy Hash: CDF02832104622EAC2313BB57E0E64B3E518F00771710023FF504BA5E2CEB8C981CA9D

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report thunderbird-to-outlook-converter.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5d34b8.rbs

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Mailsdaddy Thunderbird To Outlook Converter.lnk

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.tlb

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\header.jpg

C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\mailsdaddy.ico

C:\Users\user\AppData\Local\Temp\CFG3728.tmp

C:\Users\user\AppData\Local\Temp\CFGF8C8.tmp

C:\Users\user\AppData\Local\Temp\MSIF618.tmp

C:\Users\user\AppData\Local\Temp\MSIF85A.tmp

C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe

C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_853F67D554F05449430E7E.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy\Mailsdaddy Thunderbird To Outlook Converter.lnk

C:\Users\user\Desktop\Mailsdaddy Thunderbird To Outlook Converter.lnk

C:\Windows\Installer\5d34b7.msi

C:\Windows\Installer\5d34b9.msi

Windows Analysis Report
thunderbird-to-outlook-converter.exe

Function 0040134E Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 192
fileprocessCOMMON

Function 004065BA Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 164
libraryloaderCOMMONLIBRARYCODE

Function 00401A49 Relevance: 7.6, APIs: 5, Instructions: 57
COMMONLIBRARYCODE

Function 004028A5 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 156
fileCOMMONLIBRARYCODE

Function 004024B2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 49
libraryloaderCOMMONLIBRARYCODE

Function 00402355 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
libraryloaderCOMMONLIBRARYCODE