Windows Analysis Report
IMAGE000Pdf.exe

AI detected suspicious sample

Source: Yara match

File source: 00000003.00000002.3000369795.0000000034940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: IMAGE000Pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: IMAGE000Pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp
Source:	Binary string: wntdll.pdbUGP source: IMAGE000Pdf.exe, 00000003.00000003.2925211684.0000000034AF0000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923122471.000000003494F000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034CA0000.00000040.00001000.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034E3E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IMAGE000Pdf.exe, IMAGE000Pdf.exe, 00000003.00000003.2925211684.0000000034AF0000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923122471.000000003494F000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034CA0000.00000040.00001000.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034E3E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Code function: 0_2_0040674C FindFirstFileW,FindClose,		0_2_0040674C
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Code function: 0_2_00405B00 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405B00

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49845 -> 173.249.193.48:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49889

Source: global traffic

HTTP traffic detected: GET /VdpAwrpsFeHTHv196.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 173.249.193.48Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.249.193.48

Source: global traffic

HTTP traffic detected: GET /VdpAwrpsFeHTHv196.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 173.249.193.48Cache-Control: no-cache

Source: IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/
Source: IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B4C000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/VdpAwrpsFeHTHv196.bin
Source: IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/VdpAwrpsFeHTHv196.bin8J
Source: IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/VdpAwrpsFeHTHv196.bin8v
Source: IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/VdpAwrpsFeHTHv196.binHI
Source: IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://173.249.193.48/VdpAwrpsFeHTHv196.binlI/
Source: IMAGE000Pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.ftp.ftp://ftp.gopher.
Source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.00000000005F2000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.00000000005F2000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match

File source: 00000003.00000002.3000369795.0000000034940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static PE information: Filename: IMAGE000Pdf.exe

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Code function: 0_2_004034A2 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034A2

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File created: C:\Windows\resources\0809

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Code function: 0_2_6F931B5F

0_2_6F931B5F

Source: IMAGE000Pdf.exe

Static PE information: invalid certificate

Source: IMAGE000Pdf.exe, 00000003.00000003.2925211684.0000000034C1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IMAGE000Pdf.exe
Source: IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034F71000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IMAGE000Pdf.exe
Source: IMAGE000Pdf.exe, 00000003.00000003.2923122471.0000000034A72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs IMAGE000Pdf.exe

Source: IMAGE000Pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.troj.evad.winEXE@3/11@0/1

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

0_2_004034A2

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File created: C:\Program Files (x86)\Common Files\kvindagtigt.ini

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File created: C:\Users\user\kretekniske.ini

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nskBA98.tmp

Source: IMAGE000Pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: IMAGE000Pdf.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File read: C:\Users\user\Desktop\IMAGE000Pdf.exe

Source: unknown	Process created: C:\Users\user\Desktop\IMAGE000Pdf.exe "C:\Users\user\Desktop\IMAGE000Pdf.exe"
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Process created: C:\Users\user\Desktop\IMAGE000Pdf.exe "C:\Users\user\Desktop\IMAGE000Pdf.exe"
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Process created: C:\Users\user\Desktop\IMAGE000Pdf.exe "C:\Users\user\Desktop\IMAGE000Pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Section loaded: srvcli.dll	Jump to behavior

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File written: C:\Program Files (x86)\Common Files\kvindagtigt.ini

Switches to a custom stack to bypass stack traces

Source: IMAGE000Pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp
Source:	Binary string: wntdll.pdbUGP source: IMAGE000Pdf.exe, 00000003.00000003.2925211684.0000000034AF0000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923122471.000000003494F000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034CA0000.00000040.00001000.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034E3E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: IMAGE000Pdf.exe, IMAGE000Pdf.exe, 00000003.00000003.2925211684.0000000034AF0000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923122471.000000003494F000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034CA0000.00000040.00001000.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.3000415181.0000000034E3E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2445993498.0000000005213000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Code function: 0_2_6F931B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F931B5F

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nslBEDE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	API/Special instruction interceptor: Address: 5222FD0
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	API/Special instruction interceptor: Address: 2162FD0

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	RDTSC instruction interceptor: First address: 51F96E2 second address: 51F96E2 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, ch 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F17AC502336h 0x00000008 cmp ah, ch 0x0000000a inc ebp 0x0000000b inc ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	RDTSC instruction interceptor: First address: 21396E2 second address: 21396E2 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, ch 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F17ACEF6846h 0x00000008 cmp ah, ch 0x0000000a inc ebp 0x0000000b inc ebx 0x0000000c rdtsc

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslBEDE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe TID: 7124

Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Code function: 0_2_0040674C FindFirstFileW,FindClose,		0_2_0040674C
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	Code function: 0_2_00405B00 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_00405B00

Source: IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B4C000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHB
Source: IMAGE000Pdf.exe, 00000003.00000003.2923373012.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973864207.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	API call chain: ExitProcess graph end node			graph_0-2286
Source: C:\Users\user\Desktop\IMAGE000Pdf.exe	API call chain: ExitProcess graph end node			graph_0-2498

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Code function: 0_2_6F931B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6F931B5F

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

Process created: C:\Users\user\Desktop\IMAGE000Pdf.exe "C:\Users\user\Desktop\IMAGE000Pdf.exe"

Source: C:\Users\user\Desktop\IMAGE000Pdf.exe

0_2_004034A2

Stealing of Sensitive Information

Source: Yara match

File source: 00000003.00000002.3000369795.0000000034940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match

File source: 00000003.00000002.3000369795.0000000034940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IMAGE000Pdf.exe	13%	ReversingLabs	Win32.Trojan.NsisInject
IMAGE000Pdf.exe	100%	Avira	HEUR/AGEN.1333748

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nslBEDE.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://173.249.193.48/VdpAwrpsFeHTHv196.bin8v	0%	Avira URL Cloud	safe
http://173.249.193.48/VdpAwrpsFeHTHv196.binHI	0%	Avira URL Cloud	safe
http://173.249.193.48/	0%	Avira URL Cloud	safe
http://173.249.193.48/VdpAwrpsFeHTHv196.bin	0%	Avira URL Cloud	safe
http://173.249.193.48/VdpAwrpsFeHTHv196.bin8J	0%	Avira URL Cloud	safe
http://173.249.193.48/VdpAwrpsFeHTHv196.binlI/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://173.249.193.48/VdpAwrpsFeHTHv196.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	IMAGE000Pdf.exe, 00000003.00000001.2444020022.00000000005F2000.00000008.00000001.01000000.00000008.sdmp	false		high
http://173.249.193.48/VdpAwrpsFeHTHv196.binlI/	IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ftp.ftp://ftp.gopher.	IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	IMAGE000Pdf.exe, 00000003.00000001.2444020022.00000000005F2000.00000008.00000001.01000000.00000008.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	IMAGE000Pdf.exe	false		high
http://173.249.193.48/VdpAwrpsFeHTHv196.binHI	IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://173.249.193.48/VdpAwrpsFeHTHv196.bin8J	IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://173.249.193.48/	IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://173.249.193.48/VdpAwrpsFeHTHv196.bin8v	IMAGE000Pdf.exe, 00000003.00000003.2923410565.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000003.2923595719.0000000004B64000.00000004.00000020.00020000.00000000.sdmp, IMAGE000Pdf.exe, 00000003.00000002.2973809712.0000000004B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	IMAGE000Pdf.exe, 00000003.00000001.2444020022.0000000000649000.00000008.00000001.01000000.00000008.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.249.193.48	unknown	United States		11878	TZULOUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548539
Start date and time:	2024-11-04 16:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IMAGE000Pdf.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@3/11@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 52% Number of executed functions: 30 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: IMAGE000Pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
10:09:25	API Interceptor	3x Sleep call for process: IMAGE000Pdf.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TZULOUS	Brneforsorgspdagogers.exe	Get hash	malicious	FormBook, GuLoader	Browse	173.249.193.66
	Brneforsorgspdagogers.exe	Get hash	malicious	FormBook, GuLoader	Browse	173.249.193.66
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	173.249.236.72
	byte.arm5.elf	Get hash	malicious	Okiru	Browse	173.249.236.51
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse	173.249.199.16
	D6wsFZIM58.elf	Get hash	malicious	Unknown	Browse	173.249.236.64
	https://netorgft4648155-my.sharepoint.com/:f:/g/personal/cgriffith_nationsbest_net/ErhP9j6s6O5LtAYvSf-k7fgBJJeB0TUcEyK1gf2JqcFeEw?e=iS1Nd2	Get hash	malicious	Unknown	Browse	173.249.199.16
	http://www.multichainbridges.com/	Get hash	malicious	Unknown	Browse	198.54.132.29
	sora.arm.elf	Get hash	malicious	Mirai	Browse	173.249.236.58
	17247087656292f1fee39f411973c3f3722ee5485ed0d6445a4852bc2661fe5272ea752502946.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	173.249.196.110

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nslBEDE.tmp\System.dll	orders_PI 008-01.exe	Get hash	malicious	Remcos, GuLoader	Browse
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse
	8737738_19082024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	8737738_19082024.vbs	Get hash	malicious	GuLoader	Browse
	Dhl Delivery(AWB 9849791014).exe	Get hash	malicious	GuLoader	Browse
	Dhl Delivery(AWB 9849791014).exe	Get hash	malicious	GuLoader	Browse
	89.hta	Get hash	malicious	Cobalt Strike, GuLoader	Browse
	sahost.exe	Get hash	malicious	GuLoader	Browse
	HSBC Advice_ACH_Credit_08082024 (1).xls	Get hash	malicious	GuLoader	Browse
	sahost.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\kvindagtigt.ini

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0121618346445365
Encrypted:	false
SSDEEP:	3:BPi4YDgAmcAKDHMnhv:BPiBkAmc0nhv
MD5:	F298228D2D42CED0A00B0C5320000835
SHA1:	FB06F02DDCDA4C9EC752A688EE617064DB3A49EB
SHA-256:	E399AFE89F97EAE7BCDAE626913DA1618F4F42BA11887217CDBF524720532AB2
SHA-512:	464DA89F9E1D5935810443B20C3D19F77585D964DF89F5CB427482A03C8EF6274D06CBC01533D92C691FFD55E1725BA5F427D023A45A5128BCED0EEE11E083FE
Malicious:	false
Reputation:	low
Preview:	[skaaltalerens]..nonsaleability=sammenstuvningerne..

C:\Users\user\AppData\Local\Temp\nslBEDE.tmp\System.dll

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.737556724687435
Encrypted:	false
SSDEEP:	192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5:	6E55A6E7C3FDBD244042EB15CB1EC739
SHA1:	070EA80E2192ABC42F358D47B276990B5FA285A9
SHA-256:	ACF90AB6F4EDC687E94AAF604D05E16E6CFB5E35873783B50C66F307A35C6506
SHA-512:	2D504B74DA38EDC967E3859733A2A9CACD885DB82F0CA69BFB66872E882707314C54238344D45945DC98BAE85772ACEEF71A741787922D640627D3C8AE8F1C35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: orders_PI 008-01.exe, Detection: malicious, Browse Filename: RemotePCViewer.exe, Detection: malicious, Browse Filename: 8737738_19082024.vbs, Detection: malicious, Browse Filename: 8737738_19082024.vbs, Detection: malicious, Browse Filename: Dhl Delivery(AWB 9849791014).exe, Detection: malicious, Browse Filename: Dhl Delivery(AWB 9849791014).exe, Detection: malicious, Browse Filename: 89.hta, Detection: malicious, Browse Filename: sahost.exe, Detection: malicious, Browse Filename: HSBC Advice_ACH_Credit_08082024 (1).xls, Detection: malicious, Browse Filename: sahost.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L...X..`...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Minkfarms\leakers.txt

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	4.277818373535095
Encrypted:	false
SSDEEP:	12:mScXAtJsdW8lLQIVVCTP1t0laiam6mObo/Bpqwnh2yKbdB1j1f:mSrTsdRTVVM9Yz69Hwh2yKb7ff
MD5:	E80E34F461528DF8F86C4248C971B2AD
SHA1:	A1A74D8F5711DEED35AF2B81BE070CA471C39500
SHA-256:	F2552D843F4D62F481743A15B7C95AA322C14EA5DBB999C8C889A42CBB093A8E
SHA-512:	46A5D6487131677DAC16C2BE4FC29517C14CB8DB6228B40344D733597462122EF0D1D7DD69B4D5A7A10F9C86635F99D91E91AC2CEBDF923C6B72EF3809637622
Malicious:	false
Reputation:	low
Preview:	pervalvar udvalgsarbejderne illegitime besully.trvarefabrikkers stemmeslugers binomialfordelingernes metropolit.mariolatrous griffy fiskeeksporten valutapuklerne spekulanter infusioners quantifys unconsolidation digitalises forvaltningsret..steticismens advents syde rebaptization returneredes chemosterilants agtvrdige,balklines sludres drengestregers topful koordinatvrdien angorakats tendensromanens blockheadish lidelsesfller eskapismes amiably phenicious nontenurial..overspringe udmntede agnostiker polycarpic stolper lbskes forhandlingsomraader acquires duskly kildnes gaultherase..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Minkfarms\persongalleriers.una

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	276701
Entropy (8bit):	1.2570216910370695
Encrypted:	false
SSDEEP:	768:yFPJSwGwS4JXi8PNDQNMDeMW3SGBqGHw1zwpmPMoaO64g1abi4IZxeMcdN9vfd95:/rFf4EoTti54LkFvI3oDW
MD5:	18C3DA2AA022FF0B89999E28E6A2AE9A
SHA1:	0659DDE0FD4B39B22825F1645A0BAE7E7202C7F9
SHA-256:	05DE1FF63CC38C7C4B3034091A311791BFF578658FF17D156AA4FB41A2E197C6
SHA-512:	D3A51D8B29FEF026F94B339087413319E03DA3193D9159A43AD7B4FEE35A67EEEBC3E66A0092B5ED14F57458173D518C618F2EE00F4203F428EBE0FC162F667C
Malicious:	false
Reputation:	low
Preview:	......................................................(.L.................................3........&.................."...........l........................s.....................................-...........................8..........@.........................................................h..................................@.........).........................I.................F..................................................................T..............................................................j..".......#I.............r.............&..................\|...............................................................................:.Z......................).............................................................................H.......C...........................................................................................t.........................................................M.............4........'........................................}..+.......................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Minkfarms\porkiest.mis

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	313672
Entropy (8bit):	1.2567166720965932
Encrypted:	false
SSDEEP:	768:iEGLlMkjkYtwS3MeXM3OpckON5VIbjnI3Oif4NxZSqJbDvz+hE7IkHAYsaW3DQLF:LtWLdp3I3yrt+3SoTMU5oT5
MD5:	17B0342D31B6E728E13DF79009833371
SHA1:	B9F3354C4E886382D220D5EC4FA91F389585BD40
SHA-256:	8CAF84CE635BD92186709E81D12AE352E049C83B53F1C22A6DCB221E8F1C011E
SHA-512:	4772F5AE64E0619B23114A41785DDE7DD1A9BACE12A9ABEDEF3400EDB3660D4E780C9B91E23A9FDEC1D97BCF7DC48E201771D7D58EB1740191A05CCFDB433C83
Malicious:	false
Reputation:	low
Preview:	....................N............................k....................................................#.................................................................................`........0.............u...................................y................................................................g.........7................E.......&........w..............................................*....................<..................................3................i.......................................................................U...).................................................. ........................................................................................................................A..............................N......c.b.......................................................................................................N........T..............................................h..............................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Mutuary.civ

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	207881
Entropy (8bit):	7.331635651026833
Encrypted:	false
SSDEEP:	3072:zDyy/gxfmTCBeuVaCzUVI90J8g5sF6963goPdEWduKiKMLUW3tTS4NrQsgT99BwE:zDyR4WDsCgVImsE77KMLUS44NMx
MD5:	749F30B7C897431F55057BFE15DF7228
SHA1:	2DB933559839DD5F79454546C98CCE8E9C4C8112
SHA-256:	1506167C68DEBF892BD0E2EAD9515C1F3F80BCCA9C489E715F2436425B7D8D48
SHA-512:	8E6BC090DFE67D411EA2B386538BAF9ADE1C7A47031CD4BFA0E7D491CFEF814923E71BA1DF8A2CB0A41AFADAE896F77BD89170BB560112E2A2B7BAA8DCD60C9D
Malicious:	false
Preview:	............ ..............EEEEE...............n..............C....F.......mm...........D..............ttt...--........``..:::....S....rrrr............P.O..6....".GG...............#.0.....................E..............22...~~.......aa............,..................................&..gg........77..LLLLLL.......ii.......0..o.ff..}.x... .99.....RR...............~~~~~.....................J......................kkk........E..........C...ee.........................G............J.............YY..~...2.............l........##.........Z.........(...........h.y........000.......yy...........l..lll...........................88...@@@@@.QQ..........^^...........mm...................CCC........KKKK.........2...............++..........V......-................B.........w................ ..............!!!....MM......66................===....................NNN..........S....??.........k........D.................................(............................. .........////....x.ccc.ZZ.w..====......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Tilegnelsesevnes\Cresotinate.Oml

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	16857
Entropy (8bit):	4.532822901243277
Encrypted:	false
SSDEEP:	384:+ipfHtyeVOvFfo92BAVO4tKq/vChYFVmuF1WbTeqFb7RfW:dlyttfo9iAVO4tiGmPZW
MD5:	143CC97C03735690BA675F029A4A3A16
SHA1:	7BBA23E28EDB92B05620AA4EA667D3C04DE93593
SHA-256:	EDCF653A613FF7FB1143DF97441A7027D486CA942A333F3EA0B74C7C11F3D88B
SHA-512:	01C2C26B31488E036F6C6634636B33A0C06672FF464549D12B653326FA1A90460FAF485C59D8F0B85C6CCF57946AC4D09A70B5A5D3609E93AD3DCDE421CF16A7
Malicious:	false
Preview:	.........UU..33........Z..nnnnnn....w.[..............EE................T.......................k..8e...r...n...e...l.N.3...2..M:...:.+.C...r..de...a...t...e...F.h.i...l...e...A...(...m... ...r...4... ...,... ...i... .&&0..cx...8...0...0...0...0...0...0...0...,..w ...i..w ...0...,... ...p... ...0...,... ...i... ...4...,... ...i... ..?0...x...8...0...,... .%%i... ...0...)...i.......r...8.......k...e...r...n...e...l._.3.~.2...:...:...S.**e...t..aF...i...l...e...P...o...i...n...t...e...r...(...i... ...r...8...,... ..vi... ...2...3...0...1...2... ...,... ...i... ./.0...,...i... ...0...)...i.......r...4.......k...e...r...n...e...l...3...2.s.:...:...V...i...r...t...u...a...l...A...l...l...o..Nc...(...i..y ...0...,...i... ...5...4..B0...6...7...2..N0...0...,... .ddi..G ...0...x...3...0...0...0...,... ..Bi... ...0...x..v4...0...)...p...../.r...2.......k...e...r.}.n...e...l..B3...2..U:...:...R.+.e...a...d...F...i...l...e...(...i... ...r...8...,... ...i... ...r...2...,... ...i... ..^5...4...0...6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Tilegnelsesevnes\Maleriet213.arc

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	244482
Entropy (8bit):	1.2509108197987615
Encrypted:	false
SSDEEP:	768:ArczTS8oocp0tWLSMkXWg7PKU30gfL4Qf1AUdyM03I3xkjFlu7NDSAZd+6XYIHXd:7Yhp0ckXv78owAC3MhxqI
MD5:	E6AC7A31DA2D4322339135AD20EB0F23
SHA1:	F76C6D6EE7C9B01DB799642990AA88B140003EC4
SHA-256:	00FAD7EC11DB9706955FDF3BE0E6FB037E9F9780F94A502A774B30AB52773A94
SHA-512:	C87DABB08D092D546FF80270B052CF1C5D92D25852DBFECC139CE528CCD2A22CCE130A8C90C08117DF542E6D83DE91E92180F853C201F042BED4681D4737E75D
Malicious:	false
Preview:	............................................w.........................................................................\.............................o.............q......................................]..........................I...............!...............................................m....... ............................................................................................h......K................=............................................................r..................................W....................................................................R......................................p..0...........................................................k.........k........................d........................................................................................................................9....................................#.....A........`...9...............P.......................................................................\...............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Tilegnelsesevnes\afsgning.for

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	430713
Entropy (8bit):	1.2530301266200883
Encrypted:	false
SSDEEP:	1536:vu65sFtuGbUq4CCWG9TcLs9xEEc0MVWFnhMA:2PjbUquWUYs/9x
MD5:	8ED0D91C7C65B02A5630D1A012895C3D
SHA1:	FA74C3BD3A32123D71AEA67D386B5AC251FEC260
SHA-256:	1113E4990BEF55E4CD1D868513B2305C72803FB296D559BFA9C8C93DE2EDC8AB
SHA-512:	FBE41906CCABB44E8D71D7664B756F75ABDBF0FB80BFCBBF4BBA9D9370DF4CEDBE437BA9F116B3F9E9D2AE2FB1E2D34D34F152E518A2E5E0096A506093F8DB24
Malicious:	false
Preview:	..[.Z.....?............#......................................................0.....B..x....................................................Q.......Z......................I....j............{..........................................................................................................................................-.....7..............................M........9.U...........?...............................................................X..................../.....................t...............4................,........`........~..............d............................u............{.....................a.............................5.............{...g....Z.................H................l..........................S.............................................................................................................................J...........................................U............................x.....f.............D..../....o........................QLi...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Tilegnelsesevnes\bookishly.egg

Process:	C:\Users\user\Desktop\IMAGE000Pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	223405
Entropy (8bit):	1.2642457624863013
Encrypted:	false
SSDEEP:	768:DDh04DrooyUGbNSipoS0yYEt0ihBLBJU06zf8VWZt+il3sVxTD6I6o9+2u5inuB4:rorpFGQVWwj9bQdun2ljrAbUGl
MD5:	96E6C0CBBACF232110DF3E7FC4B4D980
SHA1:	FC18FDD4E5417AC76F68BF507AC0BA6B9A183CFE
SHA-256:	04F64748055424253509A229EE3E6F9BFC86898CBA667DA8312333552987B610
SHA-512:	8DD22ABBED1522A08E9AC3559F5CC6871B77C1B76C2A7AA0CD61E52CA7D3A43DCBAF00285BF29C1FF885FC5F424FA411F56F19EB1886DA97CC7010BCA66530A9
Malicious:	false
Preview:	....................................{............!.............Q.............................................................................:...........z..................................W.......................... ......................................3...........y...............j................!n...............................................................................3........................+.......................a.......................c........................................)............................................................................................................................?.............................................................................................S....../.....................................................6./...t..+.......................H............{..........&................................b............................R.......x....=..................V....]........>...................................m................0.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\struldbrug\bentwoods\Tilegnelsesevnes\etisk.hvs