Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe |
| Analysis ID: | 1547563 |
| MD5: | d8188612b8eaf56cebceae7c54c12426 |
| SHA1: | c82a28a4954ea5e11a221f89747c03c3c5f5d2ea |
| SHA256: | 33e83e77afd9dbcf216839f46d32803571c3242a03680f6b7e40892cd530b49d |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Entry point lies outside standard sections
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Classification
- System is w10x64
SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe (PID: 7284 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Win64.Malw areX-gen.2 6402.21423 .exe" MD5: D8188612B8EAF56CEBCEAE7C54C12426) 
conhost.exe (PID: 7292 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7396 cmdline:
C:\Windows \system32\ cmd.exe /c cls MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Binary or memory string: | memstr_f9152404-d | |
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | DNS query: | ||
| Source: | DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static file information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
Boot Survival | |
|---|
| Source: | Window searched: | Jump to behavior | ||
| Source: | Window searched: | Jump to behavior | ||
| Source: | Window searched: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | System information queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | Registry key queried: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | System information queried: | Jump to behavior | ||
| Source: | Process information queried: | Jump to behavior | ||
Anti Debugging | |
|---|
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Thread information set: | Jump to behavior | ||
| Source: | Open window title or class name: | ||
| Source: | Open window title or class name: | ||
| Source: | Open window title or class name: | ||
| Source: | Open window title or class name: | ||
| Source: | Open window title or class name: | ||
| Source: | Open window title or class name: | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Process queried: | Jump to behavior | ||
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | NtSetInformationThread: | Jump to behavior | ||
| Source: | NtQueryInformationProcess: | Jump to behavior | ||
| Source: | NtQueryInformationProcess: | Jump to behavior | ||
| Source: | NtSetInformationThread: | Jump to behavior | ||
| Source: | NtCreateThreadEx: | Jump to behavior | ||
| Source: | NtQuerySystemInformation: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 11 Process Injection | 33 Virtualization/Sandbox Evasion | OS Credential Dumping | 641 Security Software Discovery | Remote Services | 1 Archive Collected Data | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 Abuse Elevation Control Mechanism | 11 Process Injection | LSASS Memory | 33 Virtualization/Sandbox Evasion | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Abuse Elevation Control Mechanism | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Software Packing | NTDS | 1 System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 12 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | URL Reputation | safe | ||
| 0% | URL Reputation | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| api.ipify.org | 104.26.12.205 | true | false | unknown | |
| dullwave.ru | unknown | unknown | false | unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | unknown | |||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false | unknown | |||
| false |
| unknown | ||
| false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.26.12.205 | api.ipify.org | United States | 13335 | CLOUDFLARENETUS | false |
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1547563 |
| Start date and time: | 2024-11-02 17:33:10 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 2m 39s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 3 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe |
| Detection: | MAL |
| Classification: | mal80.evad.winEXE@4/1@2/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Excluded IPs from analysis (whitelisted): 4.175.87.197
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, sls.update.microsoft.com, ctldl.windowsupdate.com, glb.sls.prod.dcat.dsp.trafficmanager.net
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.26.12.205 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Remcos | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
| ||
| Get hash | malicious | RDPWrap Tool | Browse |
| ||
| Get hash | malicious | RDPWrap Tool | Browse |
| ||
| Get hash | malicious | RDPWrap Tool | Browse |
| ||
| Get hash | malicious | RDPWrap Tool | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| api.ipify.org | Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | AgentTesla, PureLog Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla, GuLoader | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AgentTesla | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | AsyncRAT, PureLog Stealer, zgRAT | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| ce5f3254611a8c095a3d821d44539877 | Get hash | malicious | Unknown | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
⊘No context
| Process: | C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 189 |
| Entropy (8bit): | 4.65143144403424 |
| Encrypted: | false |
| SSDEEP: | 3:7AeTABFReHLLmzRcPLStA3YEIAeeSAZQ68AeTABFReHLLmzRz6zX6AbQZ/Mj9GXY:YoLLmRM0A3YhveVQ6PoLLmRzMqI |
| MD5: | 0C486B471EC0CB8315A78D385BA87320 |
| SHA1: | 1C4541DC73F4636AEBE6013D18D23FA1253A1BFC |
| SHA-256: | 72B2E02B178A0DCAC14DC894A874FA7753EBE6B8224393DD7AF6F95CB45FAB58 |
| SHA-512: | 82C3C3AC8F2AC3C4D37EEA19B0FEBD4A36DD681EEBE882929AC6E7880D3663F1A99C133570781F7E0FEF5F29B050FCFDA2490B1AF1639CD5F9BF579219763085 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.969478726781011 |
| TrID: |
|
| File name: | SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe |
| File size: | 22'509'072 bytes |
| MD5: | d8188612b8eaf56cebceae7c54c12426 |
| SHA1: | c82a28a4954ea5e11a221f89747c03c3c5f5d2ea |
| SHA256: | 33e83e77afd9dbcf216839f46d32803571c3242a03680f6b7e40892cd530b49d |
| SHA512: | a73eb049c2a4d767a018be7094e8c192b22c2490c34295cdab7bf45b44be2c83165f0b2c3003d37da53703c71e48d119eabac58268ac006ac90bb47d3a1ac81d |
| SSDEEP: | 393216:uGmEP/TbVLYeJvFTXqVPTQmbTz6Um6TJjo8mBeH4fqNEed6/b/SuTt:uq5YeZF7yMSz6Umqo8UeYfuEed67Sq |
| TLSH: | 3837333428C37E2AEAB597B58FF7148D8630AA1546DF69C76B4F30474A5731F4BB2208 |
| File Content Preview: | MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......Z.....w...w...w.U.t...w.U.r...w.U.s...w...s...w...s.v.w...r.=.w...t...w.-.s...w.......w.x.....w.L.s...w.L.t...w.L.r.~.w...s...w |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x1423f7058 |
| Entrypoint Section: | .boot |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x67207A0F [Tue Oct 29 06:00:47 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 4c217a11cb1e73ae3df30fb8b8c95892 |
| Instruction |
|---|
| call 00007F0A44DA7C77h |
| inc ecx |
| push edx |
| dec ecx |
| mov edx, esp |
| inc ecx |
| push edx |
| dec ecx |
| mov esi, dword ptr [edx+10h] |
| dec ecx |
| mov edi, dword ptr [edx+20h] |
| cld |
| mov dl, 80h |
| mov al, byte ptr [esi] |
| dec eax |
| inc esi |
| mov byte ptr [edi], al |
| dec eax |
| inc edi |
| mov ebx, 00000002h |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| jnc 00007F0A44DA7AD6h |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| jnc 00007F0A44DA7B50h |
| xor eax, eax |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| jnc 00007F0A44DA7BF8h |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| je 00007F0A44DA7AFBh |
| push edi |
| mov eax, eax |
| dec eax |
| sub edi, eax |
| mov al, byte ptr [edi] |
| pop edi |
| mov byte ptr [edi], al |
| dec eax |
| inc edi |
| mov ebx, 00000002h |
| jmp 00007F0A44DA7A7Ah |
| mov eax, 00000001h |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| adc eax, eax |
| add dl, dl |
| jne 00007F0A44DA7AF9h |
| mov dl, byte ptr [esi] |
| dec eax |
| inc esi |
| adc dl, dl |
| jc 00007F0A44DA7AD8h |
| sub eax, ebx |
| mov ebx, 00000001h |
| jne 00007F0A44DA7B20h |
| mov ecx, 00000001h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x4b40e4 | 0x160 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x4b6000 | 0x1e4 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x2383200 | 0x359b8 | .bhnb |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x3752000 | 0x10 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x4b5018 | 0x28 | .tls |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| 0x1000 | 0x3117bf | 0x17f200 | 90584633929883ccf7bd949847b5f933 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | |
| 0x313000 | 0x131fe6 | 0x64200 | 3ce3e6a2b665a0cba7543ab346ea701e | False | 0.9884494967228464 | data | 7.967722916173756 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x445000 | 0x39590 | 0x1ee00 | 8b4722ff9bde9def87c7c9db204e2dac | False | 0.997327302631579 | data | 7.980826378015273 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
| 0x47f000 | 0x27c00 | 0x15a00 | ae39fca3d4d336ec4b89bef282fa4da1 | False | 0.9357952492774566 | OpenPGP Public Key | 7.639174288639525 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x4a7000 | 0xf4 | 0x200 | 43705aebb240ab792fe8de0b0e267a8f | False | 0.30859375 | data | 2.6102546981887302 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x4a8000 | 0x1e8 | 0x200 | f900991f0e5afd193bd87a37ce42f60b | False | 0.578125 | data | 4.796281619111505 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | |
| 0x4a9000 | 0xa164 | 0x4400 | 2a5e604efc34ebb33ea6959f3baa4340 | False | 0.9507697610294118 | data | 7.869525233927884 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | |
| .idata | 0x4b4000 | 0x1000 | 0x400 | 20634607a89b9b499059f8c447c8ac0f | False | 0.2626953125 | data | 2.2499948325101418 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0x4b5000 | 0x1000 | 0x200 | 3ef58f471990ed2fd6b612d91337872c | False | 0.0625 | data | 0.28456851570206254 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x4b6000 | 0x1000 | 0x200 | e692f3880af66948bf9886847bb6c35e | False | 0.53515625 | data | 4.772037401703051 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .bhnb | 0x4b7000 | 0x1f40000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .boot | 0x23f7000 | 0x135a400 | 0x135a400 | 948440173498d1792157d4696e2a79b1 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .reloc | 0x3752000 | 0x1000 | 0x10 | 7031894b7c72147c48baad4bf437a25a | False | 1.5 | GLS_BINARY_LSB_FIRST | 2.474601752714581 | IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_MANIFEST | 0x4b6058 | 0x188 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5892857142857143 |
| DLL | Import |
|---|---|
| kernel32.dll | GetModuleHandleA |
| WS2_32.dll | ioctlsocket |
| USER32.dll | MessageBoxA |
| ADVAPI32.dll | CryptCreateHash |
| SHELL32.dll | ShellExecuteW |
| bcrypt.dll | BCryptGenRandom |
| ntdll.dll | VerSetConditionMask |
| CRYPT32.dll | CertOpenStore |
| WLDAP32.dll |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 2, 2024 17:34:14.177484035 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:14.177544117 CET | 443 | 49738 | 104.26.12.205 | 192.168.2.4 |
| Nov 2, 2024 17:34:14.177623034 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:14.350873947 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:14.350900888 CET | 443 | 49738 | 104.26.12.205 | 192.168.2.4 |
| Nov 2, 2024 17:34:14.971205950 CET | 443 | 49738 | 104.26.12.205 | 192.168.2.4 |
| Nov 2, 2024 17:34:14.971276045 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:16.049856901 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:16.049887896 CET | 443 | 49738 | 104.26.12.205 | 192.168.2.4 |
| Nov 2, 2024 17:34:16.049983978 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Nov 2, 2024 17:34:16.050106049 CET | 443 | 49738 | 104.26.12.205 | 192.168.2.4 |
| Nov 2, 2024 17:34:16.050162077 CET | 49738 | 443 | 192.168.2.4 | 104.26.12.205 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 2, 2024 17:34:12.453196049 CET | 62665 | 53 | 192.168.2.4 | 1.1.1.1 |
| Nov 2, 2024 17:34:12.476638079 CET | 53 | 62665 | 1.1.1.1 | 192.168.2.4 |
| Nov 2, 2024 17:34:13.679858923 CET | 56542 | 53 | 192.168.2.4 | 1.1.1.1 |
| Nov 2, 2024 17:34:13.687139988 CET | 53 | 56542 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 2, 2024 17:34:12.453196049 CET | 192.168.2.4 | 1.1.1.1 | 0xc1b3 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Nov 2, 2024 17:34:13.679858923 CET | 192.168.2.4 | 1.1.1.1 | 0xc6b7 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 2, 2024 17:34:13.687139988 CET | 1.1.1.1 | 192.168.2.4 | 0xc6b7 | No error (0) | 104.26.12.205 | A (IP address) | IN (0x0001) | false | ||
| Nov 2, 2024 17:34:13.687139988 CET | 1.1.1.1 | 192.168.2.4 | 0xc6b7 | No error (0) | 104.26.13.205 | A (IP address) | IN (0x0001) | false | ||
| Nov 2, 2024 17:34:13.687139988 CET | 1.1.1.1 | 192.168.2.4 | 0xc6b7 | No error (0) | 172.67.74.152 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 12:34:07 |
| Start date: | 02/11/2024 |
| Path: | C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.26402.21423.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x140000000 |
| File size: | 22'509'072 bytes |
| MD5 hash: | D8188612B8EAF56CEBCEAE7C54C12426 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 12:34:07 |
| Start date: | 02/11/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 12:34:11 |
| Start date: | 02/11/2024 |
| Path: | C:\Windows\System32\cmd.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6e1af0000 |
| File size: | 289'792 bytes |
| MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
⊘No disassembly