Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Analysis ID:	1552474
MD5:	d259c61b387fcd39b3ab83dd9ee1fc26
SHA1:	e53aea122c350a2e569dfaa587cfe5af6c3fb0a4
SHA256:	616ed7e97dd87be83b59ad3fa6df8285f35b62dbe913e8d73b1ea798a6021261
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe (PID: 6688 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe" MD5: D259C61B387FCD39B3AB83DD9EE1FC26)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-08T20:24:23.702958+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49734	TCP
2024-11-08T20:25:02.810657+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49952	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \PlugMan\PlugMan\obj\Debug\PlugMan.pdb+T source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Source:	Binary string: \PlugMan\PlugMan\obj\Debug\PlugMan.pdb source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Code function: 4x nop then lea ecx, dword ptr [ebp-000000BCh]

0_2_08D49F11

Source: global traffic

HTTP traffic detected: GET /public/F_list.ini HTTP/1.1Host: 159.100.29.29Connection: Keep-Alive

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49734
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49952

Source: unknown	TCP traffic detected without corresponding DNS query: 80.78.246.154
Source: unknown	TCP traffic detected without corresponding DNS query: 80.78.246.154
Source: unknown	TCP traffic detected without corresponding DNS query: 80.78.246.154
Source: unknown	TCP traffic detected without corresponding DNS query: 80.78.246.154
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 80.78.246.154
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.29.29

Source: global traffic

HTTP traffic detected: GET /public/F_list.ini HTTP/1.1Host: 159.100.29.29Connection: Keep-Alive

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.100.29.29
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.100.29.29/public/
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.100.29.29/public/F_list.ini
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.100.29.29/public/F_list.iniP
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.100.29.29d
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.246.154
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.246.154/public/
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	String found in binary or memory: http://80.78.246.154/public/9http://159.100.29.29/public/
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3698526052.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.78.246.154/public/F_list.ini
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://80.78.246.154/public/F_list.iniP
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058D5E60	0_2_058D5E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058D6358	0_2_058D6358
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_08D488F0	0_2_08D488F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_08D49688	0_2_08D49688
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_08D488E0	0_2_08D488E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_08D4967C	0_2_08D4967C
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_093A61F0	0_2_093A61F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_093A22A4	0_2_093A22A4

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000000.1232812011.0000000000A32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePlugMan.exe0 vs SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3698526052.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Binary or memory string: OriginalFilenamePlugMan.exe0 vs SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Source: classification engine

Classification label: mal52.winEXE@1/1@0/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

File created: C:\Users\user\AppData\Roaming\BimStep

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Mutant created: NULL

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \PlugMan\PlugMan\obj\Debug\PlugMan.pdb+T source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Source:	Binary string: \PlugMan\PlugMan\obj\Debug\PlugMan.pdb source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: 0xFF0CC677 [Thu Aug 6 18:41:59 2105 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058D87C8 pushfd ; ret	0_2_058D87D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058D9F18 pushfd ; iretd	0_2_058D9F19
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058D1B8F push eax; mov dword ptr [esp], edx	0_2_058D1BA4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Code function: 0_2_058DA380 push eax; ret	0_2_058DA393

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Static PE information: section name: .text entropy: 7.458103899462974

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Memory allocated: 12E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599623	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599119	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598903	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598570	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598345	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598206	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598076	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597960	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597845	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597716	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597492	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597376	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597096	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596956	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596679	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596570	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596465	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596216	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596101	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595851	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595626	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595504	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595365	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595133	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595018	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594880	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594763	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594648	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594431	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594316	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594183	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593958	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593840	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593721	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Window / User API: threadDelayed 6575			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Window / User API: threadDelayed 3216			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599623s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599119s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -599014s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598903s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598795s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598570s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598206s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -598076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597960s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597845s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597716s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597492s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -597096s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596956s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596679s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596570s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596465s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -596101s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595986s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595851s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595504s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595365s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595133s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -595018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594880s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594763s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594648s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594316s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -594183s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -593958s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -593840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe TID: 6936	Thread sleep time: -593721s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599623	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599359	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599119	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598903	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598795	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598570	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598345	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598206	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 598076	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597960	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597845	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597716	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597492	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597376	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 597096	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596956	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596679	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596570	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596465	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596216	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 596101	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595851	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595626	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595504	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595365	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595133	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 595018	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594880	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594763	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594648	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594431	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594316	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 594183	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593958	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593840	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Thread delayed: delay time: 593721	Jump to behavior

Source: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3701271760.0000000008796000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	29%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://80.78.246.154/public/	0%	Avira URL Cloud	safe
http://159.100.29.29/public/F_list.ini	0%	Avira URL Cloud	safe
http://80.78.246.154/public/F_list.ini	0%	Avira URL Cloud	safe
http://159.100.29.29/public/	0%	Avira URL Cloud	safe
http://80.78.246.154/public/9http://159.100.29.29/public/	0%	Avira URL Cloud	safe
http://159.100.29.29d	0%	Avira URL Cloud	safe
http://80.78.246.154	0%	Avira URL Cloud	safe
http://80.78.246.154/public/F_list.iniP	0%	Avira URL Cloud	safe
http://159.100.29.29	0%	Avira URL Cloud	safe
http://159.100.29.29/public/F_list.iniP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://159.100.29.29/public/F_list.ini	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://159.100.29.29d	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.78.246.154/public/9http://159.100.29.29/public/	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe	false	Avira URL Cloud: safe	unknown
http://80.78.246.154/public/F_list.ini	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3698526052.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.78.246.154/public/F_list.iniP	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.78.246.154	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E8E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002E7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://159.100.29.29	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.78.246.154/public/	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://159.100.29.29/public/F_list.iniP	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://159.100.29.29/public/	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe, 00000000.00000002.3699554461.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.78.246.154	unknown	Russian Federation		43146	AGAVA3RU	false
159.100.29.29	unknown	Germany		203833	AT-FIRSTCOLOAustriaAT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552474
Start date and time:	2024-11-08 20:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Detection:	MAL
Classification:	mal52.winEXE@1/1@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 41 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Simulations

Behavior and APIs

Time	Type	Description
14:24:03	API Interceptor	11858980x Sleep call for process: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AGAVA3RU	http://puzzlewood.net	Get hash	malicious	Unknown	Browse	89.108.119.28
	yakov.mips.elf	Get hash	malicious	Mirai	Browse	89.108.102.237
	http://www.goo.su/c1Rnox/	Get hash	malicious	Unknown	Browse	89.108.119.43
	https://dolshepsi.ru/assets/images/dh/GlobalSources/index.php/	Get hash	malicious	HTMLPhisher	Browse	89.108.85.64
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	89.108.119.28
	http://www.goo.su/fJu2F/	Get hash	malicious	Unknown	Browse	89.108.120.68
	http://vidaliaonion.org	Get hash	malicious	Unknown	Browse	89.108.120.76
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	89.108.119.43
	https://lenta.ru/articles/2023/01/13/darkpr/	Get hash	malicious	HTMLPhisher	Browse	89.108.120.68
	http://manga-netflix10737.tinyblogging.com.xx3.kz/	Get hash	malicious	Unknown	Browse	89.108.119.28
AT-FIRSTCOLOAustriaAT	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	YIztve8dU8.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	fSLSu3PQPC.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	3kMnPQIVHR.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	F4ged15cJ3.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	cZlRw8OG35.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	j0GmmzdQRz.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	VWpmyBcWBO.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	KBW66LEndt.elf	Get hash	malicious	Mirai	Browse	79.133.46.243
	https://sothebys.us.com/ja4DCams2APwoTx4RAl4DCB4GI1AoTxp4RAoTx4DCuctsz01nQ3Et	Get hash	malicious	HTMLPhisher	Browse	79.133.57.143

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\BimStep\Settings.cfg

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.2359263506290334
Encrypted:	false
SSDEEP:	3:Bcn:+
MD5:	5EFAD9751B81AC353C2774A58A0BE0FD
SHA1:	D5D6BFFDFA7D7B10B37AB8A099A3BAC6DCFA8684
SHA-256:	52F0327ECD5E40CF50C393FB2D09C7CA0B5CC2E4B757A26CDD02CA4258A1DFEF
SHA-512:	FC21C7726E766B808A3F5746ACD281D00C473177857BF18B5463926505472E9AE62CCE5D25E95396501B89521454AD8DD184458E320974C4421EF8E2DF9D186F
Malicious:	false
Reputation:	low
Preview:	Language..RU..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.43497282842813
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
File size:	278'528 bytes
MD5:	d259c61b387fcd39b3ab83dd9ee1fc26
SHA1:	e53aea122c350a2e569dfaa587cfe5af6c3fb0a4
SHA256:	616ed7e97dd87be83b59ad3fa6df8285f35b62dbe913e8d73b1ea798a6021261
SHA512:	c861ad697fc9b76d0cabb9cc0411523f2bd0ccffd0b381217b49eb28fbd0af9f4fb6417ee4998556befde590fc092294ea68398fe61f5a30b3bb68dc44629bc0
SSDEEP:	6144:15eNsZqK0jLVDdlqIcGFJsVgLbZOvoHizVKoSi2MGGf:DMscNdq8CmZWoHoVFSi2MG
TLSH:	DE44CF063660CE5EEFFD03F1D8E526D213AC881AC615E25FBDF238A979B97804604D67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w............."...0..6..........VT... ...`....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x445456
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFF0CC677 [Thu Aug 6 18:41:59 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45403	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x45364	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4345c	0x43600	8374dec81e1e40c2bd1ae14172aad4ef	False	0.6088713184137291	data	7.458103899462974	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x59c	0x600	51dab4d518e89fe237ea8853abb2ea72	False	0.4108072916666667	data	4.0542235385711605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	d1a6f9453fa95b027d3c98aec16b7030	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x46090	0x30c	data			0.4230769230769231
RT_MANIFEST	0x463ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-08T20:24:23.702958+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49734	TCP
2024-11-08T20:25:02.810657+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49952	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 8, 2024 20:24:03.850455046 CET	49701	80	192.168.2.7	80.78.246.154
Nov 8, 2024 20:24:03.855309963 CET	80	49701	80.78.246.154	192.168.2.7
Nov 8, 2024 20:24:03.855458975 CET	49701	80	192.168.2.7	80.78.246.154
Nov 8, 2024 20:24:03.856230021 CET	49701	80	192.168.2.7	80.78.246.154
Nov 8, 2024 20:24:03.861057997 CET	80	49701	80.78.246.154	192.168.2.7
Nov 8, 2024 20:24:04.341109037 CET	49701	80	192.168.2.7	80.78.246.154
Nov 8, 2024 20:24:04.371886015 CET	49702	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.379713058 CET	80	49702	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:04.379811049 CET	49702	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.379903078 CET	49702	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.385317087 CET	80	49702	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:04.390897036 CET	80	49701	80.78.246.154	192.168.2.7
Nov 8, 2024 20:24:04.501286030 CET	80	49701	80.78.246.154	192.168.2.7
Nov 8, 2024 20:24:04.501533031 CET	49701	80	192.168.2.7	80.78.246.154
Nov 8, 2024 20:24:04.915206909 CET	49702	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.942615986 CET	49703	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.947585106 CET	80	49703	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:04.947693110 CET	49703	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.950237989 CET	49703	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:04.955329895 CET	80	49703	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:04.962399006 CET	80	49702	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:04.993340969 CET	49703	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:05.001796961 CET	80	49702	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:05.001863956 CET	49702	80	192.168.2.7	159.100.29.29
Nov 8, 2024 20:24:05.046458960 CET	80	49703	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:05.543004036 CET	80	49703	159.100.29.29	192.168.2.7
Nov 8, 2024 20:24:05.543057919 CET	49703	80	192.168.2.7	159.100.29.29

HTTP Request Dependency Graph

159.100.29.29

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	80.78.246.154	80	6688	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 20:24:03.856230021 CET	81	OUT	HEAD /public/F_list.ini HTTP/1.1 Host: 80.78.246.154 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	159.100.29.29	80	6688	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 20:24:04.379903078 CET	81	OUT	HEAD /public/F_list.ini HTTP/1.1 Host: 159.100.29.29 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	159.100.29.29	80	6688	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Timestamp	Bytes transferred	Direction	Data
Nov 8, 2024 20:24:04.950237989 CET	80	OUT	GET /public/F_list.ini HTTP/1.1 Host: 159.100.29.29 Connection: Keep-Alive

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exePID: 6688, Parent PID: 4056

General

Target ID:	0
Start time:	14:24:02
Start date:	08/11/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe"
Imagebase:	0xa30000
File size:	278'528 bytes
MD5 hash:	D259C61B387FCD39B3AB83DD9EE1FC26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exePID: 6688, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2%
Total number of Nodes:	205
Total number of Limit Nodes:	13

Executed Functions

Function 058D5E60 Relevance: 6.9, Strings: 5, Instructions: 618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 058D6A43
Hq, xrefs: 058D6ACD
Hq, xrefs: 058D6929
Hq, xrefs: 058D6B8B
Hq, xrefs: 058D69BC

Memory Dump Source

Source File: 00000000.00000002.3701187565.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq$Hq$Hq
API String ID: 0-3799487529
Opcode ID: 9001cdce07f393b9b728cbcd934174ba0922f37e6b10a50d1dd6f2846a8a4a66
Instruction ID: cdfeb527a1648e06c632db1073c58a583894b4193ecbc6d4f4cc259599c8c485
Opcode Fuzzy Hash: 9001cdce07f393b9b728cbcd934174ba0922f37e6b10a50d1dd6f2846a8a4a66
Instruction Fuzzy Hash: A6329070E003188FEB54DF69D8517AEBBF2AF84304F54856AD40AEB385EB349D45CBA1

Function 08D488F0 Relevance: 2.8, Strings: 2, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 08D489A4
PHq, xrefs: 08D48D8B

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fq$PHq
API String ID: 0-821858
Opcode ID: 0ae7b23ac46508812f22d1fbcbeab8d609a232e03664cd7ea93ea1732939c155
Instruction ID: 065f46aefb252f27849a08e8325a6a7a97bdbb41c4da17b248fe36138b0e2ca1
Opcode Fuzzy Hash: 0ae7b23ac46508812f22d1fbcbeab8d609a232e03664cd7ea93ea1732939c155
Instruction Fuzzy Hash: C1E1B174E01218CFDB64DFA9D884B9DBBB2BF49341F1091AAD409AB365DB709E85CF10

Function 08D488E0 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 08D489A4
PHq, xrefs: 08D48D8B

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: fq$PHq
API String ID: 0-821858
Opcode ID: 458d69377ec36643f0796193655af559a09977ffd2598318a65adfc248521b8d
Instruction ID: 13b4babf1a0cbfe19d39ba317c9e6949f203c79253901300ae6024716854687d
Opcode Fuzzy Hash: 458d69377ec36643f0796193655af559a09977ffd2598318a65adfc248521b8d
Instruction Fuzzy Hash: 9FC1CF74E01258CFDB54DFA9C984B9DBBF2BF89301F1081AAD409AB365DB709A85CF10

Function 093A61F0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: e97c194fa722caeadc859f5ad4e9c3a9bac4698831fc2523535c93dbb722cf3a
Instruction ID: 49dab1a96fbe157af539264b633734c74c4d58f66bb29b8abf99b4719f76b7b8
Opcode Fuzzy Hash: e97c194fa722caeadc859f5ad4e9c3a9bac4698831fc2523535c93dbb722cf3a
Instruction Fuzzy Hash: A2F14A30A00209CFDB14DFA9C949B9DBBF1FF48318F198169E409AF2A5DB75A945CF90

Function 08D49688 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6014b1ce422f6c5b27726d1ba9502a24d5178f69ff81d5476ff527b90d99f779
Instruction ID: 272ac237f49ed8438a2288b2f44e604b9f4c52837be51a30f80305df7c916d54
Opcode Fuzzy Hash: 6014b1ce422f6c5b27726d1ba9502a24d5178f69ff81d5476ff527b90d99f779
Instruction Fuzzy Hash: 9EF1A574D012288FDB64DF69D998BDDBBB2BF49301F1091EAD809A7264DB349E81CF50

Function 058D6358 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701187565.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c49949809210a1ae072d96607a8c0e6664511366347f4aa9374bbd90c95824d
Instruction ID: 7266e2a69292a225092fe4e135f046a915d9286d23354107da704a3787329591
Opcode Fuzzy Hash: 4c49949809210a1ae072d96607a8c0e6664511366347f4aa9374bbd90c95824d
Instruction Fuzzy Hash: 9FC14B31E002189FDB25DF69D884B9DFBF2BF88314F14C56AD849AB255EB309D84CB61

Function 08D4967C Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41acf4863f380ec90c1ff96bb9f4dcd7815477ed3f5dd75b0acfe7313e86d40
Instruction ID: af2c6a84f417a072141ceb5bca8453e603283d384edb8ed3379137a0a2c233e8
Opcode Fuzzy Hash: c41acf4863f380ec90c1ff96bb9f4dcd7815477ed3f5dd75b0acfe7313e86d40
Instruction Fuzzy Hash: 1071B775E412289FDB68DF6AD8447D9BBF2BF89300F1081EAD818A7265DB305E81CF50

Function 012EC7D8 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 012ECA3E

Memory Dump Source

Source File: 00000000.00000002.3699432286.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12e0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 416eb9fbd9ce3295573f5c0e094210ea750bf4101bfbaa769c86d7cb35262023
Instruction ID: 652aeac6868524e6103110e87453ab0f30d6b784fc916d358f467f4ca800a832
Opcode Fuzzy Hash: 416eb9fbd9ce3295573f5c0e094210ea750bf4101bfbaa769c86d7cb35262023
Instruction Fuzzy Hash: 16815670A10B068FE725CFA9D54976ABBF1BF88310F00892ED59ADBB40D734E815CB91

Function 058D71B5 Relevance: 1.6, APIs: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Shell_NotifyIconW.SHELL32(?,00000000), ref: 058D7284

Memory Dump Source

Source File: 00000000.00000002.3701187565.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_SecuriteInfo.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 2af801c709ac3cc79039fe7fabd06bf284c7aec2897c880f3c571403dd4465fd
Instruction ID: 0f161089edbae333230431405c87994fd5042c27465ea24b8fd0151c568de078
Opcode Fuzzy Hash: 2af801c709ac3cc79039fe7fabd06bf284c7aec2897c880f3c571403dd4465fd
Instruction Fuzzy Hash: 0C411FB0D002589FDB18DFA9C848B9EFBF6FB48300F50802AE81AE7280D7759805CF65

Function 012E4648 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E6B21

Memory Dump Source

Source File: 00000000.00000002.3699432286.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12e0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 23eaeb2ad2b7326b278dbfe9ceb99d7e17b73e3060493921bb694da53c3d7b0a
Instruction ID: 32e36653351a7e88279b6d933d2e736474afd927856537d96027a037c7729326
Opcode Fuzzy Hash: 23eaeb2ad2b7326b278dbfe9ceb99d7e17b73e3060493921bb694da53c3d7b0a
Instruction Fuzzy Hash: 1941B2B0C10719CBDF24DFA9C848B9DBBF5BF58304F60806AD509AB251D7B56946CF90

Function 012E6A65 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012E6B21

Memory Dump Source

Source File: 00000000.00000002.3699432286.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12e0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7e3b41fa21f14e4e6cbbbf071ba0cced8acf6ed48f602053dbbdb5f009fdf1b8
Instruction ID: 162f8b9cbd7519c67198bd00dcb8561d14a943664f94666e22b3a50c31f4f357
Opcode Fuzzy Hash: 7e3b41fa21f14e4e6cbbbf071ba0cced8acf6ed48f602053dbbdb5f009fdf1b8
Instruction Fuzzy Hash: 1941BDB1C10719CBEB24DFA9C888B9DBBF5BF58304F60846AD408AB251DBB56946CF50

Function 058D71C0 Relevance: 1.6, APIs: 1, Instructions: 91
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Shell_NotifyIconW.SHELL32(?,00000000), ref: 058D7284

Memory Dump Source

Source File: 00000000.00000002.3701187565.00000000058D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 058D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_58d0000_SecuriteInfo.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: e0d5794eef68075325a7b0e22df70b5860cec3771e492d324497e6e85f3bdcad
Instruction ID: 34b11c162f7a7a3b00b18a4e10970fbe212e649d93497d2e3a95c1f8dbda2d0c
Opcode Fuzzy Hash: e0d5794eef68075325a7b0e22df70b5860cec3771e492d324497e6e85f3bdcad
Instruction Fuzzy Hash: 7041F0B0D142589FDB18CFA9C448B9EFBF5BB48300F54802AE81AF7280C7759845CF65

Function 093A0208 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32(?,00000000), ref: 093A02BC

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 828f098ac31f8e2466f7058626ac2f61d6db4c018b411dd0a77295a061bdc673
Instruction ID: 4350c3e1bce119d1e2c1bac3fe10cd0f09abb273bcaa585ffa4588bcabd34e16
Opcode Fuzzy Hash: 828f098ac31f8e2466f7058626ac2f61d6db4c018b411dd0a77295a061bdc673
Instruction Fuzzy Hash: DB319FB19093999FDB16CFA9C8446CEFFF4EF5A210F1480AED444E7252D334A809CB61

Function 093A5B51 Relevance: 1.6, APIs: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 093A5BDD

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b2287a0288aef1b3c1857e2c82e501ad36c96eb23fd3d0544d3b6cd46c141e00
Instruction ID: aa1073887627b29af265a126e495facf1c5e714507c4bb7c02843fb6968be856
Opcode Fuzzy Hash: b2287a0288aef1b3c1857e2c82e501ad36c96eb23fd3d0544d3b6cd46c141e00
Instruction Fuzzy Hash: 032188B1804349CFDB11CF9AC845BDEBFF8EB09310F14845AE494A7262D378A948CFA1

Function 012EE380 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,012EEC86,?,?,?,?,?), ref: 012EED47

Memory Dump Source

Source File: 00000000.00000002.3699432286.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12e0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f0eb6ed00b3b35d2aa0ff473d40a5f6f9579261fb0a40b60330e777f7b609e25
Instruction ID: d86713c799547ceeee2de5b0f463609b8d8a641c2edd9b3bd9c7b3917f92bb32
Opcode Fuzzy Hash: f0eb6ed00b3b35d2aa0ff473d40a5f6f9579261fb0a40b60330e777f7b609e25
Instruction Fuzzy Hash: 202103B5D10208DFDB10CFAAD884AEEBBF8FB48310F14801AE914A7350C375A944CFA4

Function 093A0240 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,00000000), ref: 093A02BC

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: b126fa8683f06292a41d590033b30fff8ba6bcdf2c45d3f43c823f844ec701d9
Instruction ID: b481d3b49025753b75f4514de6a57797d6cbf28585986380f4a60935042d60a2
Opcode Fuzzy Hash: b126fa8683f06292a41d590033b30fff8ba6bcdf2c45d3f43c823f844ec701d9
Instruction Fuzzy Hash: 902104B5D017098FDB14CF9AC884ADEFBF8FB48210F14802AE859A7640D374A944CFA5

Function 08D4DA50 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08D4DAC2

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: f97eed2661d494eb31470f498bd1599a982aff8c88606aac870cc563c191e456
Instruction ID: b0bcf94349393e198a6bc3a59d7c8e87951431cb2bdb466828828f38e69da09b
Opcode Fuzzy Hash: f97eed2661d494eb31470f498bd1599a982aff8c88606aac870cc563c191e456
Instruction Fuzzy Hash: 022133B2C002498FCB10CFAAC845ADEBBF5AB88320F10812ED459A7640C379A549CFA1

Function 093A6FD8 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,093A6517), ref: 093A703D

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 789373be9c9a037340d71aae4e57e540d8d13cb04e8b54fa302be1eb2fc3311e
Instruction ID: 25ecc57f92b95ec7e5c07faa0b0a61aa75fefa8e7756a9917e39a8252ef1d09d
Opcode Fuzzy Hash: 789373be9c9a037340d71aae4e57e540d8d13cb04e8b54fa302be1eb2fc3311e
Instruction Fuzzy Hash: 032147B5C007488FCB20CF9AD444BDEFBF4EB48324F14816AD559A3640C339A545CFA5

Function 093A67B0 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,093A63D2,00000000,00000000,03D960D8,02E251E8), ref: 093A6820

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: b319eeae79dfd748432092365a1c2cbea5b918f09b2a32c10fcba04f7e25b526
Instruction ID: ae4397013f2a329fcc5f2f0b24100e0f0fe98f316760280fe253332293445d2d
Opcode Fuzzy Hash: b319eeae79dfd748432092365a1c2cbea5b918f09b2a32c10fcba04f7e25b526
Instruction Fuzzy Hash: 5C1117B5C002499FDB10CF9AD844BDEBBF8EB48324F14842AE559A3250C379A944CFA5

Function 093A4420 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,093A63D2,00000000,00000000,03D960D8,02E251E8), ref: 093A6820

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: eb9476f1bd8edc4c76a212f9a63b6ff77f8dd08d4ac24f274fb8fb86cb8e9a18
Instruction ID: 1ad807a67866be8e53cf08cf0fd3d60787f680dfe2881e301f67d0018e76f2d0
Opcode Fuzzy Hash: eb9476f1bd8edc4c76a212f9a63b6ff77f8dd08d4ac24f274fb8fb86cb8e9a18
Instruction Fuzzy Hash: D81129B5C002099FDB10DF9AD445BDEBBF8FB48324F14802AE959A3240C379A944CFA5

Function 08D4DA58 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08D4DAC2

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 486cf7103b455dda08463444112afc6b32de7b3ea795f461d4ff276b7fa4877b
Instruction ID: 53d8474d8b83e631aa9c43a09351b1002ebc9f67f7fbb72954b00fe61e72beac
Opcode Fuzzy Hash: 486cf7103b455dda08463444112afc6b32de7b3ea795f461d4ff276b7fa4877b
Instruction Fuzzy Hash: 351112B6C002498FDB14CF9AC845BDEFBF9EB88320F14842AD859A7640D379A545CFA5

Function 093A5B80 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 093A5BDD

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 11b3480f04786b1c399be1863a765ef815d3547aab012e8dac0cb5eda1433ed7
Instruction ID: 11794432800b401be8cd3952876794462789522fd5420bbd5de2a6f6b0b53d04
Opcode Fuzzy Hash: 11b3480f04786b1c399be1863a765ef815d3547aab012e8dac0cb5eda1433ed7
Instruction Fuzzy Hash: F61106B58003499FDB10CF9AC845BDEFBF8FB48320F10841AE554A3640D379A944CFA5

Function 012EC9D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 012ECA3E

Memory Dump Source

Source File: 00000000.00000002.3699432286.00000000012E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12e0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ed15ad0f4d098c550834ac049988c25526d739d17b0a733f17b0f6d259c08306
Instruction ID: a5eb0341ece8c0008183d317a8a50258d3155dd7e65cd4164d8579c0370011a8
Opcode Fuzzy Hash: ed15ad0f4d098c550834ac049988c25526d739d17b0a733f17b0f6d259c08306
Instruction Fuzzy Hash: 9A11E0B6C003498FDB24CF9AD448BDEFBF8AF88214F10841AD969A7710C379A545CFA5

Function 093A5FD0 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 093A602D

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 11342fce16e7d4c39762b7746d58764eb384ae1e3ceda50f517c443bef39a3a6
Instruction ID: 71e8d84a76bff1c06602972a72d921fc06f0111bb429fc0e1c6c5e4c6840f70d
Opcode Fuzzy Hash: 11342fce16e7d4c39762b7746d58764eb384ae1e3ceda50f517c443bef39a3a6
Instruction Fuzzy Hash: FF1103B5C00348CFDB24DFAAD445BCEBBF8EB58214F248419D519A7710D379A984CFA9

Function 08D4B050 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,05256428,?,?,?,?,?,?,08D4BAB0,00000000,00000000,?), ref: 08D4BC2D

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 293f6245a429e16b9a74e1e0470ad1d75009b4d94b1cfd83b2435320855f0b2d
Instruction ID: 4ef8cbf0af01ed562ab8e89143cf28f8f468e5e50c9aa72fae15b8fbc2b94541
Opcode Fuzzy Hash: 293f6245a429e16b9a74e1e0470ad1d75009b4d94b1cfd83b2435320855f0b2d
Instruction Fuzzy Hash: 271106B5800348DFDB10DF9AD485BDEBBF8EB58320F10881AE555A7740C375A944CFA5

Function 093A446C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,093A6517), ref: 093A703D

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 6cb6a0a4a5daaab5d8a555f5e3b4e47fa7b8a031a33e084d236547c0bd80fbe1
Instruction ID: de7d5ac11932cbec15bc8fd6203b269e56f95c1aa55a3f02f57c8a7854257ee7
Opcode Fuzzy Hash: 6cb6a0a4a5daaab5d8a555f5e3b4e47fa7b8a031a33e084d236547c0bd80fbe1
Instruction Fuzzy Hash: 5C11F2B5C046488FCB20DF9AD444BDEFBF8EB48314F10841AE519A7650D379A544CFA9

Function 093A20B4 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 093A2115

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 05368129a3a46004dbedde45f61cb15ddfea88f017eaa4783524c26ce3e71701
Instruction ID: f71e907405d68ad7cd65389676047ad48890048ba7b0e3ad1f90f962c129ed3a
Opcode Fuzzy Hash: 05368129a3a46004dbedde45f61cb15ddfea88f017eaa4783524c26ce3e71701
Instruction Fuzzy Hash: F91103B58003499FDB10DF9AC885BDEBBF8EB58310F10841AE558A7600C375A944CFA5

Function 093A43C0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 093A602D

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: a5952a9bc27ff01b99cf3a916f0142360d1e00e9f5d1c63c43cf2f0a1d3a6f40
Instruction ID: e83f4da9fe97eb2a5e23a6cfd97b22128d10c3d3a59f345da53afe489f52e921
Opcode Fuzzy Hash: a5952a9bc27ff01b99cf3a916f0142360d1e00e9f5d1c63c43cf2f0a1d3a6f40
Instruction Fuzzy Hash: 551103B5C04348CFDB20DFAAD449B9EBBF8EB48214F248419E519A7640D379A944CFA9

Function 08D4BBC8 Relevance: 1.5, APIs: 1, Instructions: 46timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,05256428,?,?,?,?,?,?,08D4BAB0,00000000,00000000,?), ref: 08D4BC2D

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 8de4e4230d369fb207225ff2f14a807cd05e0de2a14da24973bec2a3909cbd0c
Instruction ID: d98320635f645b4d047ac5b865dd94b795070560bc4e27efbe4a5893e7660bb8
Opcode Fuzzy Hash: 8de4e4230d369fb207225ff2f14a807cd05e0de2a14da24973bec2a3909cbd0c
Instruction Fuzzy Hash: 111106B58003499FDB10DF99D885BDEBBF8FB48320F10841AE555A7300C375A544CFA1

Function 08D4ECBD Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 08D4ED1D

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 60ec296ef002e5c7c360ca230ad02f3573fdd784c3704ed9cb329d520b4f835f
Instruction ID: 21d62610b32a2ea62dd40da594987dfe039a809a4e389a8c8fe9947f8812aa2a
Opcode Fuzzy Hash: 60ec296ef002e5c7c360ca230ad02f3573fdd784c3704ed9cb329d520b4f835f
Instruction Fuzzy Hash: 431103B58003489FDB20CF9AD485BDEFBF8FB48320F20841AE559A7600C375A544CFA1

Function 093A20B8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 093A2115

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 33675a099fa2a9986eb34168448aeda696d5193dd60990189f9f2d6c56241705
Instruction ID: d097496c5e1faaf16855fd5fa02f5c17a18f947171fc9d5b6a19379c5fa4f7f0
Opcode Fuzzy Hash: 33675a099fa2a9986eb34168448aeda696d5193dd60990189f9f2d6c56241705
Instruction Fuzzy Hash: AA11D3B58003499FDB10DF9AC885BDEBBF8EB58314F10841AE559A7640C375A944CFA5

Function 08D4ECC0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 08D4ED1D

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bd21546317250f90f57e3bdd525db811e764b099a7caf49d8f497ad2af1ba3b
Instruction ID: 2f7445e5c45253fc0ccaf9e009e9a2cf000c5848fd38de49fce0b8d8e002872d
Opcode Fuzzy Hash: 7bd21546317250f90f57e3bdd525db811e764b099a7caf49d8f497ad2af1ba3b
Instruction Fuzzy Hash: 5011D0B58003499FDB20DF9AD985BDEFBF8FB48320F20841AE559A7640C375A944CFA5

Function 093A2144 Relevance: 1.5, APIs: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 093A2115

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 929afa763e89bfc04302b6ed959193fc5eecc1fce5dc3e64eb9b49d14fe00657
Instruction ID: 18b27b568f0458f13518dc92d44f8d6cae31210d031cc50c733199c602044ede
Opcode Fuzzy Hash: 929afa763e89bfc04302b6ed959193fc5eecc1fce5dc3e64eb9b49d14fe00657
Instruction Fuzzy Hash: 4EF02BB7C09380CFDB229BA5A8143DBBFE0DB62355F15448FD1948B552D23C9049CB61

Function 08D43239 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 08D4326A

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 81fe7ee6d880fb8057f055cc4f1b4f05016c129b266ff0a7cbf71ad181840db0
Instruction ID: 810fa868f7b37ee97a94531abcf2ddcf20332ca8f4292a75804eed19525b4c7e
Opcode Fuzzy Hash: 81fe7ee6d880fb8057f055cc4f1b4f05016c129b266ff0a7cbf71ad181840db0
Instruction Fuzzy Hash: 7BE092757043502BCB29ABBC846886E7FB55E4656130945EFD84ACF3A2CE24CC02C361

Function 08D43248 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 08D4326A

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 374c9a5bc9f4389372afb4e32934c789a13ab40ad00b934a1038778a5f484f9c
Instruction ID: 9f98e4864b61bfb5b6628738e948d22de2ea009e0b208b0ed487fe91d1c35de2
Opcode Fuzzy Hash: 374c9a5bc9f4389372afb4e32934c789a13ab40ad00b934a1038778a5f484f9c
Instruction Fuzzy Hash: 84E0C2317003207B8A18AA7ED418C6FB3EDAF86961340456EE906CB360DE20DC0287A0

Function 00F7D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3698468753.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c757926ce8351e7ae64f261ab1659563bc9a0ab52485609ddeb1404c713ca91d
Instruction ID: e42d5e37dca379708d986c66e63202f7288a72fd2dcf482eda89489525566ec9
Opcode Fuzzy Hash: c757926ce8351e7ae64f261ab1659563bc9a0ab52485609ddeb1404c713ca91d
Instruction Fuzzy Hash: CE21F472904240DFDB15DF14D9C0B26BB75FF84328F68C56AE8090B256C336D856EAA2

Function 0125D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3699245130.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b9c03ee4a59da1ffab25c733088aaa363a6d2769318e8cafa33ace211d2e89
Instruction ID: ba6d78927ba0d8e2760211d7e5fcd9677b58567d2e248d5fb27b2b5f62fcf360
Opcode Fuzzy Hash: e1b9c03ee4a59da1ffab25c733088aaa363a6d2769318e8cafa33ace211d2e89
Instruction Fuzzy Hash: 4721F271914308EFDB55DFA4D9C0B26BBA5FB84324F20C56DED098B293C376D846CA62

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3699245130.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceff887aee1ead7fce31a5b24eae4b1f2e0ebddbcfbb158dcdf064b11562655
Instruction ID: 7829004ce53b59daccafae094d44b70f61e9ce4443a3b98c2c85a6e6b6563407
Opcode Fuzzy Hash: 5ceff887aee1ead7fce31a5b24eae4b1f2e0ebddbcfbb158dcdf064b11562655
Instruction Fuzzy Hash: C6210071614208EFDB55DF64D9C0B16BBA1EB84314F20C56DED0A4B292C37AD447CA62

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3699245130.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9806313fb02b3ea48082ff6fd5e9055f2e4ddaeb523a35e55cac0792eac6c31c
Instruction ID: 066f89705b887f471ac6c1aefe5c96fa14b04d1383d65e1df0af9a5f849264c8
Opcode Fuzzy Hash: 9806313fb02b3ea48082ff6fd5e9055f2e4ddaeb523a35e55cac0792eac6c31c
Instruction Fuzzy Hash: 9521CA755083848FCB12CF24D9D0B05BF71EB46314F28C5EAD9498B6A3C33A980ACB62

Function 00F7D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3698468753.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f7d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: 121dedd60f3df98c3cba1d34dba6543078aa9baa3cb77859b41bfdd52df3c553
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: 6E11B176904280CFCB16CF14D5C4B16BF72FF94328F28C6AAD8494B656C336D856DBA2

Function 0125D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3699245130.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 0d1153f4210f15d504672a42e4e7cc56d120aa03863376be75e4b9534e27363b
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 8511EB75504284CFDB12CF54C5C0B15BBA1FB84324F24C6ADDD098B693C33AD40ACB61

Non-executed Functions

Function 093A22A4 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701614960.00000000093A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 093A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47dbbb88abeafd8182d796e8c44b403aea0e0486dc4da6051bd0db81f393848f
Instruction ID: 91b384e185b25af79cfc557f25ee13b52e58e2e56f881f736e7a3ff55b4820c8
Opcode Fuzzy Hash: 47dbbb88abeafd8182d796e8c44b403aea0e0486dc4da6051bd0db81f393848f
Instruction Fuzzy Hash: F8E137357102118BDB29AF348598B2F73A7EF85B50F14816AE9168B3A5DF34DC42CF52

Function 08D49F11 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3701399924.0000000008D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 08D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d40000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1514e7d0fcf63a6045af39527ba50df445eec4f085bdb24b67f0636e34e635
Instruction ID: 5c72ebaf9493d7898b3783d352452c0c575db023328000e68f01b51da0792b62
Opcode Fuzzy Hash: 9b1514e7d0fcf63a6045af39527ba50df445eec4f085bdb24b67f0636e34e635
Instruction Fuzzy Hash: 91A1D23494122ACFDB25CF24C988BE9BBB2BF49345F0091E9D809A7261DB349EC5DF40

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\BimStep\Settings.cfg

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exePID: 6688, Parent PID: 4056

Windows Analysis Report
SecuriteInfo.com.W32.ABTrojan.TFWF-7096.22699.18150.exe

Function 058D5E60 Relevance: 6.9, Strings: 5, Instructions: 618
COMMON

Function 08D488F0 Relevance: 2.8, Strings: 2, Instructions: 323
COMMON

Function 08D488E0 Relevance: 2.7, Strings: 2, Instructions: 248
COMMON

Function 012EC7D8 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Function 058D71B5 Relevance: 1.6, APIs: 1, Instructions: 97
windowCOMMON

Function 012E4648 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 012E6A65 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 058D71C0 Relevance: 1.6, APIs: 1, Instructions: 91
windowCOMMON

Function 093A0208 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON