Edit tour

Windows Analysis Report
ship's particulars-TBN.pdf.scr.exe

Overview

General Information

Sample name:	ship's particulars-TBN.pdf.scr.exe
Analysis ID:	1566627
MD5:	5ad9fe85b2c0e0d32a589ce54e7b902e
SHA1:	73eb76b140f25ceecb6eb7dc1ba5c97114e46618
SHA256:	e9be7f50bd810d3b8a459a54c2310b567dd7065cb52803306cc5e6132eb9e12f
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ship's particulars-TBN.pdf.scr.exe (PID: 7508 cmdline: "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe" MD5: 5AD9FE85B2C0E0D32A589CE54E7B902E)

powershell.exe (PID: 7716 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ship's particulars-TBN.pdf.scr.exe (PID: 7724 cmdline: "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe" MD5: 5AD9FE85B2C0E0D32A589CE54E7B902E)

ship's particulars-TBN.pdf.scr.exe (PID: 7752 cmdline: "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe" MD5: 5AD9FE85B2C0E0D32A589CE54E7B902E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1467342543.0000000004FC0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7752	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x14410b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x2cab63:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x305183:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x14417d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x2cabd5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3051f5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x144207:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x2cac5f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x30527f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x144299:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x2cacf1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x305311:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x144303:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x2cad5b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x30537b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x144375:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2cadcd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3053ed:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x14440b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2cae63:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x305483:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x1414fe:$s2: GetPrivateProfileString 0x2c7f56:$s2: GetPrivateProfileString 0x302576:$s2: GetPrivateProfileString 0x140bfd:$s3: get_OSFullName 0x2c7655:$s3: get_OSFullName 0x301c75:$s3: get_OSFullName 0x14223b:$s5: remove_Key 0x1423ca:$s5: remove_Key 0x2c8c93:$s5: remove_Key 0x2c8e22:$s5: remove_Key 0x3032b3:$s5: remove_Key 0x303442:$s5: remove_Key 0x1432ab:$s6: FtpWebRequest 0x2c9d03:$s6: FtpWebRequest 0x304323:$s6: FtpWebRequest 0x1440ed:$s7: logins 0x14465f:$s7: logins 0x147342:$s7: logins 0x147422:$s7: logins 0x148d1e:$s7: logins 0x2cab45:$s7: logins
1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x846c9:$s1: file:/// 0x84625:$s2: {11111-22222-10009-11112} 0x84659:$s3: {11111-22222-50001-00000} 0x829f3:$s4: get_Module 0x140f1e:$s5: Reverse 0x2c7976:$s5: Reverse 0x301f96:$s5: Reverse 0x31154:$s6: BlockCopy 0x1438be:$s6: BlockCopy 0x2ca316:$s6: BlockCopy 0x304936:$s6: BlockCopy 0x30fcc:$s7: ReadByte 0x141183:$s7: ReadByte 0x2c7bdb:$s7: ReadByte 0x3021fb:$s7: ReadByte 0x846db:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe, ParentProcessId: 7508, ParentProcessName: ship's particulars-TBN.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", ProcessId: 7716, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe, ParentProcessId: 7508, ParentProcessName: ship's particulars-TBN.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe", ProcessId: 7716, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Multi AV Scanner detection for submitted file

Source: ship's particulars-TBN.pdf.scr.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ship's particulars-TBN.pdf.scr.exe

Joe Sandbox ML: detected

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49706 version: TLS 1.2

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: TiFL.pdbSHA256&J source: ship's particulars-TBN.pdf.scr.exe
Source:	Binary string: TiFL.pdb source: ship's particulars-TBN.pdf.scr.exe

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 50.87.144.157 50.87.144.157
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: beirutrest.com

Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://beirutrest.com
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1462135543.0000000002451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: ship's particulars-TBN.pdf.scr.exe	String found in binary or memory: https://cdn.pixabay.com/photo/2017/02/12/21/29/false-2061132_640.png

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: ship's particulars-TBN.pdf.scr.exe

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_009B4210	1_2_009B4210
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_009B6F92	1_2_009B6F92
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_009BD524	1_2_009BD524
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C694E9	1_2_06C694E9
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C60040	1_2_06C60040
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C64000	1_2_06C64000
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6C4A0	1_2_06C6C4A0
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6E550	1_2_06C6E550
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6E53F	1_2_06C6E53F
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6D148	1_2_06C6D148
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6CD08	1_2_06C6CD08
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6CD10	1_2_06C6CD10
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C6C8D8	1_2_06C6C8D8
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C63883	1_2_06C63883
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C63888	1_2_06C63888
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_0B6E25B8	1_2_0B6E25B8
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_0B6E3E18	1_2_0B6E3E18
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015BA9E0	6_2_015BA9E0
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015B4A58	6_2_015B4A58
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015B3E40	6_2_015B3E40
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015B4188	6_2_015B4188
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D58970	6_2_06D58970
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D5B850	6_2_06D5B850
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D5B84F	6_2_06D5B84F
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D6B248	6_2_06D6B248
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D62AE8	6_2_06D62AE8
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D676A0	6_2_06D676A0

Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1468020882.0000000008750000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1462135543.000000000249B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1467342543.0000000004FC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1460380999.000000000058E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1467541980.0000000006A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1467541980.0000000006A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000000.1426910035.000000000016A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTiFL.exeJ vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893550975.0000000001139000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs ship's particulars-TBN.pdf.scr.exe
Source: ship's particulars-TBN.pdf.scr.exe	Binary or memory string: OriginalFilenameTiFL.exeJ vs ship's particulars-TBN.pdf.scr.exe

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/4@2/2

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ship's particulars-TBN.pdf.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arfndbq2.hui.ps1

Jump to behavior

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ship's particulars-TBN.pdf.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ship's particulars-TBN.pdf.scr.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: TiFL.pdbSHA256&J source: ship's particulars-TBN.pdf.scr.exe
Source:	Binary string: TiFL.pdb source: ship's particulars-TBN.pdf.scr.exe

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: 0xE9B06FC8 [Sun Mar 28 22:38:00 2094 UTC]

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 1_2_06C63FF1 pushfd ; retn 0006h	1_2_06C63FF2
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015BAA98 push eax; iretd	6_2_015BAA99
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_015B0C77 push edi; retf	6_2_015B0C7A
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D5FD7D push es; ret	6_2_06D5FD80
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D687E3 push esi; retf	6_2_06D687EA
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D687E1 push edi; retf	6_2_06D687E2
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D6F239 push ds; iretd	6_2_06D6F23E
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D683C9 push esp; retf	6_2_06D683CA
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D64089 push cs; retf	6_2_06D64092
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D64001 push ebx; retf 0005h	6_2_06D64002
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D69149 pushad ; retf	6_2_06D69152
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Code function: 6_2_06D6E897 push ss; iretd	6_2_06D6E89A

Source: ship's particulars-TBN.pdf.scr.exe

Static PE information: section name: .text entropy: 7.0158745783234275

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.scr

Static PE information: ship's particulars-TBN.pdf.scr.exe

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 2450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 4450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 88D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 98D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 9AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: AAE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 15B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Memory allocated: 5060000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599542	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599090	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598976	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595299	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595150	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594724	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593687	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1973	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Window / User API: threadDelayed 2369	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Window / User API: threadDelayed 7476	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep count: 1973 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7936	Thread sleep count: 2369 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7936	Thread sleep count: 7476 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599542s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -599090s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598976s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595299s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -595150s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -594724s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -594124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -594015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -593906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -593796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe TID: 7932	Thread sleep time: -593687s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599542	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 599090	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598976	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596452	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596124	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595299	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 595150	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594724	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594124	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593796	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Thread delayed: delay time: 593687	Jump to behavior

Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1460380999.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1460380999.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893615907.000000000123E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Memory written: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Process created: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1467342543.0000000004FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7752, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 6.2.ship's particulars-TBN.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ship's particulars-TBN.pdf.scr.exe PID: 7752, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.4fc0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1467342543.0000000004FC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match

File source: 1.2.ship's particulars-TBN.pdf.scr.exe.34a0060.3.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	12 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ship's particulars-TBN.pdf.scr.exe	71%	ReversingLabs	Win32.Trojan.Leonem
ship's particulars-TBN.pdf.scr.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beirutrest.com	50.87.144.157	true	false		high
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://account.dyn.com/	ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ship's particulars-TBN.pdf.scr.exe, 00000001.00000002.1462135543.0000000002451000.00000004.00000800.00020000.00000000.sdmp, ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	high
http://beirutrest.com	ship's particulars-TBN.pdf.scr.exe, 00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.pixabay.com/photo/2017/02/12/21/29/false-2061132_640.png	ship's particulars-TBN.pdf.scr.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.87.144.157	beirutrest.com	United States		46606	UNIFIEDLAYER-AS-1US	false
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566627
Start date and time:	2024-12-02 14:37:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ship's particulars-TBN.pdf.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/4@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 101 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ship's particulars-TBN.pdf.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
08:38:01	API Interceptor	9464562x Sleep call for process: ship's particulars-TBN.pdf.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.87.144.157	Packing List - SAPPHIRE X.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beirutrest.com	Packing List - SAPPHIRE X.xlsx.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	50.87.144.157
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	50.87.144.157
	CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
api.ipify.org	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://drive.google.com/uc?export=download&id=1YBKJhy1GWwuEta_1b7KX-jKtXfpHDuuY	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	1d5sraR1S1.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	P4toChrGer.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	zed.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	back.ps1	Get hash	malicious	Unknown	Browse	104.26.13.205
	zed.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	kyjjrfgjjsedf.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	kohjaekdfth.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	kthkksefd.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	lKvXJ7VVCK.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	Finalize_Agreement_DocuSign.pdf	Get hash	malicious	Captcha Phish	Browse	192.254.225.121
	1d5sraR1S1.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	P4toChrGer.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	162.144.19.14
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	142.6.141.61
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	142.7.26.16
	https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https://www.google.com/amp/t.co/N0QLoca1EY&appName=YMailNorrin&partner=1&locale=1&pageId=commerce_intent&clickRef=message_header&region=us&annotation=&buckets=&segment=&interactedItem=&slot=&uuid=mailNA	Get hash	malicious	Unknown	Browse	50.6.173.246
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	69.49.230.198
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse	50.6.196.212
CLOUDFLARENETUS	swift.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	172.67.186.192
	021337ISOGENERAL.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.74.152
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	HBL BLJ2T2411809005 & DAJKT2411000812.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SPP_14667098030794_8611971920#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.74.152
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	021337ISOGENERAL.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	11315781264#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152
	30180908_signed#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.6599547231656377
Encrypted:	false
SSDEEP:	3:NlllulRlltl:NllU
MD5:	2AAC5546A51052C82C51A111418615EB
SHA1:	14CFBEF3B3D238893C68F1BD6FE985DACF1953F1
SHA-256:	DBBA7151765EDB3661C0B1AD08037C0BDDC43227D2F2E8DDAC33C4A1E7C4151F
SHA-512:	1273F4B0365E213134E7FBC3BE45CAC33CB32AB6CED85479905C702F0429A0491A5E9C878E5FEFFA05BB0D1AA7F704949D13DD1DA9FCEB93665F1CC110FB24B8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wdfubv3.lum.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arfndbq2.hui.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.007434814298171
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ship's particulars-TBN.pdf.scr.exe
File size:	880'128 bytes
MD5:	5ad9fe85b2c0e0d32a589ce54e7b902e
SHA1:	73eb76b140f25ceecb6eb7dc1ba5c97114e46618
SHA256:	e9be7f50bd810d3b8a459a54c2310b567dd7065cb52803306cc5e6132eb9e12f
SHA512:	7899f2cec191bebd1214ba7d6ff6472e59daeb202e3a0d5d46747ddbbe731abe34aaa8f220be3ab7485515ea0038ebc18d64d6c6be4961e8d25b3cc272329979
SSDEEP:	12288:ZS+OlRrvLX8RD8BnN+F179Oks2u4ayy+k5h/2IYw62:oARDI6+Z27t2hOPw5
TLSH:	9715C43E19B8622BB1B9C7A5FBE48127B07096EFF151AD64D4EB435A4302A0374C327D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o................0..b..........F.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4d8146
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE9B06FC8 [Sun Mar 28 22:38:00 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F01951FE7D2h
je 00007F01951FE7D2h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F01951FE7D2h
imul eax, dword ptr [eax], 00610076h
je 00007F01951FE7D2h
outsd
add byte ptr [edx+00h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd80f3	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xda000	0x644	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd6d8c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd616c	0xd6200	bcbed4f4404f305252ea1d2f0f236a2a	False	0.7144025010945709	data	7.0158745783234275	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xda000	0x644	0x800	f14743ede6c7f890e0c97b26f3cfa954	False	0.34228515625	data	3.4931321820752284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdc000	0xc	0x200	3914ffac2ab5ed7e68a78ccedfc72a8a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xda090	0x3b4	data			0.41244725738396626
RT_MANIFEST	0xda454	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 14:38:04.606153011 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:04.606215000 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:04.606278896 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:04.635550976 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:04.635564089 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:05.903661966 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:05.903820992 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:05.907682896 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:05.907705069 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:05.908107042 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:05.958760977 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:06.003325939 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:06.357253075 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:06.357322931 CET	443	49706	172.67.74.152	192.168.2.8
Dec 2, 2024 14:38:06.357465982 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:06.363157988 CET	49706	443	192.168.2.8	172.67.74.152
Dec 2, 2024 14:38:07.543973923 CET	49708	21	192.168.2.8	50.87.144.157
Dec 2, 2024 14:38:07.664134026 CET	21	49708	50.87.144.157	192.168.2.8
Dec 2, 2024 14:38:07.664299011 CET	49708	21	192.168.2.8	50.87.144.157
Dec 2, 2024 14:38:07.683224916 CET	49708	21	192.168.2.8	50.87.144.157
Dec 2, 2024 14:38:07.804776907 CET	21	49708	50.87.144.157	192.168.2.8
Dec 2, 2024 14:38:07.804832935 CET	49708	21	192.168.2.8	50.87.144.157

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 14:38:04.443201065 CET	64468	53	192.168.2.8	1.1.1.1
Dec 2, 2024 14:38:04.585820913 CET	53	64468	1.1.1.1	192.168.2.8
Dec 2, 2024 14:38:06.870264053 CET	51285	53	192.168.2.8	1.1.1.1
Dec 2, 2024 14:38:07.543209076 CET	53	51285	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 14:38:04.443201065 CET	192.168.2.8	1.1.1.1	0xe696	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:06.870264053 CET	192.168.2.8	1.1.1.1	0xcecb	Standard query (0)	beirutrest.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 14:38:04.585820913 CET	1.1.1.1	192.168.2.8	0xe696	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:04.585820913 CET	1.1.1.1	192.168.2.8	0xe696	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:04.585820913 CET	1.1.1.1	192.168.2.8	0xe696	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 2, 2024 14:38:07.543209076 CET	1.1.1.1	192.168.2.8	0xcecb	No error (0)	beirutrest.com	50.87.144.157	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	172.67.74.152	443	7752	C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 13:38:05 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-02 13:38:06 UTC	424	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 13:38:06 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ebbb72498cd8c15-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1782&min_rtt=1775&rtt_var=681&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1590413&cwnd=238&unsent_bytes=0&cid=998434008c513b9f&ts=469&x=0"
2024-12-02 13:38:06 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	1
Start time:	08:37:59
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Imagebase:	0x90000
File size:	880'128 bytes
MD5 hash:	5AD9FE85B2C0E0D32A589CE54E7B902E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1467342543.0000000004FC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.1464053375.0000000003451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:38:03
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Imagebase:	0x620000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:38:03
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Imagebase:	0x90000
File size:	880'128 bytes
MD5 hash:	5AD9FE85B2C0E0D32A589CE54E7B902E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:38:03
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:38:03
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ship's particulars-TBN.pdf.scr.exe"
Imagebase:	0xca0000
File size:	880'128 bytes
MD5 hash:	5AD9FE85B2C0E0D32A589CE54E7B902E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.3893399847.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.3895415343.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.3895415343.00000000030B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	182
Total number of Limit Nodes:	9

Executed Functions

Function 06C60040 Relevance: 2.3, Strings: 1, Instructions: 1022
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<ov!, xrefs: 06C6043C

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID: <ov!
API String ID: 0-3980319286
Opcode ID: fc0bdff20af0afdf48da97b88da2d5c49d9c9af0e324e35335daf0ff0c445b47
Instruction ID: 293e81742bfe6bf0ed0d53e2adefca6206b2b67584fc3985363949c56a659637
Opcode Fuzzy Hash: fc0bdff20af0afdf48da97b88da2d5c49d9c9af0e324e35335daf0ff0c445b47
Instruction Fuzzy Hash: 3FB2A574E00628CFDB64CF69C984BD9BBB2BF89304F1581E5E509AB225DB319E81CF40

Function 0B6E25B8 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1469250766.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b6e0000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ab4d6501495047aa5af644f7b6b0f199a0af902c8798bbaa830caad47918ea
Instruction ID: 6e4280abdfbb38c38edd5c4f515f78b30b5e8469e85fee05432de0ead1684f3a
Opcode Fuzzy Hash: e6ab4d6501495047aa5af644f7b6b0f199a0af902c8798bbaa830caad47918ea
Instruction Fuzzy Hash: 8E32BDB0B022049FDB19DB69C560BAEB7FBEF88700F144469E5569B3A1DB34ED01CB61

Function 06C64000 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db39957f99095301264824930e3ad9cf0c05c4d9391905dd1bb42df9e68a3af
Instruction ID: e4920b95df6460e5f36f2e418e0e8d75b9863f3344d7ed274b8125c781d117f8
Opcode Fuzzy Hash: 1db39957f99095301264824930e3ad9cf0c05c4d9391905dd1bb42df9e68a3af
Instruction Fuzzy Hash: 6971F670D05218CFEB58DFAAD8846EEBBF6FB99301F20D02AE519A7211D7345946CF84

Function 009B4210 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3288a478a6625466972ad31a9f51039351661a91f81bb03eb5720c4a944ceebc
Instruction ID: e38fda4fb9a12aa9f763179b146deca488a83e107d02ad8bdbee53d7f98d3b04
Opcode Fuzzy Hash: 3288a478a6625466972ad31a9f51039351661a91f81bb03eb5720c4a944ceebc
Instruction Fuzzy Hash: 4F51A670E013189FDB08DFA9D991AEEBBF2FF88310F548429D409BB264DB359942DB50

Function 009B6F92 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730a01b0f399ae96524919f2cbd2bc6c48804195ac8d273692cd2789478afccd
Instruction ID: a138ed30c07bb7076732ac83630b41fe7a259aa3c579877cb9175441d2b9427f
Opcode Fuzzy Hash: 730a01b0f399ae96524919f2cbd2bc6c48804195ac8d273692cd2789478afccd
Instruction Fuzzy Hash: 5C51B670E012089FDB08DFA9D991AEEBBF2FF88310F548029D409AB264DB355942DF50

Function 06C694E9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d08d96c3bd451f03a80fc915ece6ae09631004e5902185ae52ba2b27fc6318
Instruction ID: 8e78525d6fefac57cca5312490df21d2267bb711f646acd07c68be2d2afc77c5
Opcode Fuzzy Hash: 72d08d96c3bd451f03a80fc915ece6ae09631004e5902185ae52ba2b27fc6318
Instruction Fuzzy Hash: 9E21E4B0D046199BEB58CFA7C8543DEFBF2AFC9300F14C06AD409AA254DB74094ACF94

Function 06C6F2F8 Relevance: 3.1, APIs: 2, Instructions: 82
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C6F2A6
VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06C6F36E

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: AllocContextThreadVirtualWow64
String ID:
API String ID: 2727713192-0
Opcode ID: 02303f23d402d2e0f86fab5307134d7dfa2d679497b677fcdb802a45b6faede2
Instruction ID: 28ccb192a640e9eae2c170fdf234811e30565b5078576672dc1cfd96620cb9fe
Opcode Fuzzy Hash: 02303f23d402d2e0f86fab5307134d7dfa2d679497b677fcdb802a45b6faede2
Instruction Fuzzy Hash: 3031897680034A8FDB10DFAAD8447DEFBF6AF88320F14882DE569A7250C7399541CFA4

Function 06C6F63C Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06C6F87E

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e9c89681bb5f000370ab0624842a9a43e768e8b2db0cfa27af754c71dbb937e1
Instruction ID: e703140a220eb7adbbc37318ce1b27db0338fb3d31847587a31037e542268c34
Opcode Fuzzy Hash: e9c89681bb5f000370ab0624842a9a43e768e8b2db0cfa27af754c71dbb937e1
Instruction Fuzzy Hash: B2A18A71D00219DFEB60CF69D8807EEBBB2BF48314F1485ADE858A7240DB749A85CF95

Function 06C6F648 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 06C6F87E

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 651ddb04eaaa3ed9532a6e5e9b7b0254fb014a4bf3fa9fce9c730f55f525d83b
Instruction ID: a7dcbbde3a0bfd6c649648e5873f234b8f0c3612a508b25628a146a32bd5dd52
Opcode Fuzzy Hash: 651ddb04eaaa3ed9532a6e5e9b7b0254fb014a4bf3fa9fce9c730f55f525d83b
Instruction Fuzzy Hash: EC916B71D0031A9FEB50CF69D8817DEBBB2BF48314F1485ADE818A7280DB749A85CF95

Function 009BAEB7 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 009BB11E

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3e5e06349146b86ac13fa4983d0799a1c875f4403059828f2c4f76a24e8ab188
Instruction ID: b5be42e2ec65d40106d9e9d49ae7f15ab95321a2265291f1c0b427e5cae84160
Opcode Fuzzy Hash: 3e5e06349146b86ac13fa4983d0799a1c875f4403059828f2c4f76a24e8ab188
Instruction Fuzzy Hash: 23815670A00B058FD724DF29D5557AABBF5FF88310F008A2DE09AD7A40D775E946CB91

Function 009B590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009B59C9

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 845e65b99c914f49d9507f5b33db0bf7bf7848c4e3d97f12263b6f0a506f9e72
Instruction ID: bd23fd27b50d7c1878f2ae2fb12d9d04002ada20619c88350220898d62f59bf0
Opcode Fuzzy Hash: 845e65b99c914f49d9507f5b33db0bf7bf7848c4e3d97f12263b6f0a506f9e72
Instruction Fuzzy Hash: CB41EFB1D00719CFDB24DFA9C9847CEBBB5BF88714F20816AD408AB251DB756946CF90

Function 009B44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 009B59C9

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4650842458df47daaedb144bfe31b5d6b6a359a9b21344a22b47603e8fca0b71
Instruction ID: 1c4896001988a3f28cf20a76e4835af5b9077a931fa5ed8ea18a10379b8d43a8
Opcode Fuzzy Hash: 4650842458df47daaedb144bfe31b5d6b6a359a9b21344a22b47603e8fca0b71
Instruction Fuzzy Hash: 4F41CFB1D00B19CBDB24DFA9C984B8EBBF5BF88714F20816AD408AB251DB756945CF90

Function 06C6F3B9 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06C6F450

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 68b12ee7012bcf0e20d5626ffa1ebfb79f88f88e56fbe955a379f571f7177c14
Instruction ID: 776454e3d3e90dcd6ad9e8a61a437b34364c91c11f03e0849468221a4e07cde6
Opcode Fuzzy Hash: 68b12ee7012bcf0e20d5626ffa1ebfb79f88f88e56fbe955a379f571f7177c14
Instruction Fuzzy Hash: 6621467590034A9FDB10CFAAD880BEEBBF5FF48310F10842EE959A7640C7789A54CB64

Function 06C6F3C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06C6F450

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ae30c255815249494ad919121ebc4b12620fb541acdd4ac2e1e8a6b723d4c04
Instruction ID: 4f18a2f5e050be13286d7f7a1ec6a24f5200a4660adb41e90a63a1b5717a71c9
Opcode Fuzzy Hash: 9ae30c255815249494ad919121ebc4b12620fb541acdd4ac2e1e8a6b723d4c04
Instruction Fuzzy Hash: F32126759003499FDB10DFAAD881BEEBBF5FF48310F10842EE919A7640C7789944CBA4

Function 06C6F4A8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06C6F530

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 20b037eb0522293e3ebe3734390a082e7fc9bdeceeb3aecc0f4ad5eced86f72d
Instruction ID: 2faa5d2bd9ce8081aa5a1251ad4ea393d852b198db446e2cc68d11b9668c1946
Opcode Fuzzy Hash: 20b037eb0522293e3ebe3734390a082e7fc9bdeceeb3aecc0f4ad5eced86f72d
Instruction Fuzzy Hash: C421157180034A9FDB10DFAAD881ADEBBF5FF48310F50842AE559A3240D77899418BA4

Function 06C6F220 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C6F2A6

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7471a5ff89430c4570c3f5dc53d295770185253e88366bccf2a495fd82eff095
Instruction ID: 19566a204331dcf93fc61f270b05f311e3558397270f60736a2be2db954c795c
Opcode Fuzzy Hash: 7471a5ff89430c4570c3f5dc53d295770185253e88366bccf2a495fd82eff095
Instruction Fuzzy Hash: 6B214A75D0034A9FDB50DFAAC4857DEBBF5AF48214F10842DE459A7240C7789945CFA4

Function 009BBC40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,009BD776,?,?,?,?,?), ref: 009BD837

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0e5044bbe995cb9a47a4c62d57c84f94cc8eab336684626498c557af05700f76
Instruction ID: dea3bec201218c1a82bb5e631b5e710767a8fc65bbee7164768210fa64d37a0f
Opcode Fuzzy Hash: 0e5044bbe995cb9a47a4c62d57c84f94cc8eab336684626498c557af05700f76
Instruction Fuzzy Hash: BB21E7B5901349AFDB10CF9AD584ADEFBF9EB48320F14841AE918A3350D374A951CFA4

Function 009BD7A9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,009BD776,?,?,?,?,?), ref: 009BD837

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7f2bbf0ae4c50fed9094b49449347c18ff4d68b1d8fd6add923de718296046f3
Instruction ID: a7e2db0a9ac86496a94b710b55ef31eccf0e02cfe2ec91401ca2fd9210c2b6aa
Opcode Fuzzy Hash: 7f2bbf0ae4c50fed9094b49449347c18ff4d68b1d8fd6add923de718296046f3
Instruction Fuzzy Hash: 9C21E5B5D013499FDB10CFAAD584ADEFBF5EB48320F14841AE918A3350D3749955CFA1

Function 06C6F4B0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06C6F530

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6bd8c19f6aa3c9e27a949c4ab2c36b886029061da416efb931823d1289e3c269
Instruction ID: 626c0e5f85a0c2af14a23495469d7851613d0333e69ddf58b63414270988672c
Opcode Fuzzy Hash: 6bd8c19f6aa3c9e27a949c4ab2c36b886029061da416efb931823d1289e3c269
Instruction Fuzzy Hash: 7A2105718003499FDB10DFAAD880BEEFBF5FF48310F508429E559A7240C7789941DBA4

Function 06C6F228 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C6F2A6

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5006c170d5c2a206c204fb74ca0484fe10f6f25cd3c0833ece81d0a3b5a13654
Instruction ID: 3f85214608a26abcee1b1cdcc24d710a8deebe47aabe4085f4de9cf0de66418c
Opcode Fuzzy Hash: 5006c170d5c2a206c204fb74ca0484fe10f6f25cd3c0833ece81d0a3b5a13654
Instruction Fuzzy Hash: ED213775D0034A8FDB50DFAAC4857AEBBF5AF88224F14842DD419A7240CB789945CFA4

Function 06C6F300 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06C6F36E

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b32bf26d587b80fed3e84354e017a6e2389b7f3b1dfd0bf2b5045361af28b72b
Instruction ID: 979a1b3c5fc570977f86ac77e33dd00a6d214ccb26cb0d34134b6610c5cf277e
Opcode Fuzzy Hash: b32bf26d587b80fed3e84354e017a6e2389b7f3b1dfd0bf2b5045361af28b72b
Instruction Fuzzy Hash: 4C1156718003499FDB10DFAAC844BDEBBF9EF88320F108819E525A7250C7799940CFA4

Function 06C6F170 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06C6F1DA

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: efb4079b81563196315d1508e945dc98a463eb4cc7225eab3ef9a9d6f5f9b4c5
Instruction ID: 38130c164f77e77cfcf3516c1b32d71d9762e4a590f1bd1112bcf8e43938500a
Opcode Fuzzy Hash: efb4079b81563196315d1508e945dc98a463eb4cc7225eab3ef9a9d6f5f9b4c5
Instruction Fuzzy Hash: 2D1179B190034A8FDB20DFAAD4447DEFBF5AF88324F20881DD459A7240C7399545CBA4

Function 06C6F178 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 06C6F1DA

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f602e358310ca5e54c9b088d21155c2e32c5dbbba6f971ae46003449dc70c306
Instruction ID: 82ebc992fbd61aecd9f9fd127696c680db45488b1514884bde6a5183856cbf16
Opcode Fuzzy Hash: f602e358310ca5e54c9b088d21155c2e32c5dbbba6f971ae46003449dc70c306
Instruction Fuzzy Hash: AF1158B1D003498FDB10DFAAC84479EFBF9AB88720F20881DD419A7240CB79A541CBA4

Function 009BB0B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 009BB11E

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 412e80bf122f9ecd1f407e0fe1860c6a722310da3b8361f7784f44ca9a6d01b4
Instruction ID: 4ef2f93714149d861f570aa598b46fbcae4131bb90ebb2a582291237b384c906
Opcode Fuzzy Hash: 412e80bf122f9ecd1f407e0fe1860c6a722310da3b8361f7784f44ca9a6d01b4
Instruction Fuzzy Hash: A61113B5C003498FCB10CF9AD944BDEFBF8EB88724F10841AD419A7240C3B9A545CFA1

Function 0B6E18F1 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0B6E1955

Memory Dump Source

Source File: 00000001.00000002.1469250766.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b6e0000_ship's particulars-TBN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e3076f5d0bf5c1c5e454cbad307505d578303ed6cf73a1a49e90f389b6fd55cf
Instruction ID: f85649d209482046b78e517bcc0f99b3d694da425f27c9b55cb700f2cd7119db
Opcode Fuzzy Hash: e3076f5d0bf5c1c5e454cbad307505d578303ed6cf73a1a49e90f389b6fd55cf
Instruction Fuzzy Hash: AF11F2B580034A9FDB10DF9AD885BDEFBF8FB48720F108819E569A3240C375A544CFA1

Function 0B6E18F8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0B6E1955

Memory Dump Source

Source File: 00000001.00000002.1469250766.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b6e0000_ship's particulars-TBN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 73e4414dfbce55dfe2117ab17203c9736a2314c54eed6a8c6e18599ab8b3878f
Instruction ID: 4095eb7f719615926fe68f9e579aa86f9a774587caf453061d147eae044f1bb0
Opcode Fuzzy Hash: 73e4414dfbce55dfe2117ab17203c9736a2314c54eed6a8c6e18599ab8b3878f
Instruction Fuzzy Hash: 9C11C2B58003499FDB10DF9AD885BDEFBF8FB48720F108419D559A7640C375A544CFA5

Function 0093D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d9c3b79121b80207b5e53dd4482bdb4b4d7c8bd5b595e4218791bc980e868a
Instruction ID: 4ed567422153ad3fc216866f3502656ba4983ec5c84f3eddbead34c05039747c
Opcode Fuzzy Hash: 13d9c3b79121b80207b5e53dd4482bdb4b4d7c8bd5b595e4218791bc980e868a
Instruction Fuzzy Hash: FB212875605304DFDB05DF10E9D8B16BB69FB94324F20C569D8090B2A6C33AE856CFA2

Function 0093D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68fc6e6a72b4e8c41545a71b413e9ed357bf24957ff7bb158a879f27f767987
Instruction ID: 2ab9cc5c50d64d340102927791a611bf4b5397057702b500f97fa31efdfcc519
Opcode Fuzzy Hash: a68fc6e6a72b4e8c41545a71b413e9ed357bf24957ff7bb158a879f27f767987
Instruction Fuzzy Hash: ED210671605340DFDB05DF14E9D4B26BF66FBC4318F20C569E8050B25AC33AD856CBA2

Function 0094D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461094185.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_94d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f15e432d887a231834b5ce7dff514001fce1e09c83de35eca570422f1c0f6b
Instruction ID: 8c96e330a7c34c44f1f662a8a90e20091127bdfeb41056d1a8e2318d754fa3e5
Opcode Fuzzy Hash: 76f15e432d887a231834b5ce7dff514001fce1e09c83de35eca570422f1c0f6b
Instruction Fuzzy Hash: C621D079605304AFDB05DF10D9C4F26BBA5FB88314F20CA6DE8494B292C3BAD846CA61

Function 0094D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461094185.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_94d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0e02aeda78413b707bb5f5005c0aed5a48dc94bd96ce865f70521d7a573c81
Instruction ID: 7238bc8c94b37b7a03dace267a4697bbb8587d86fc4a5c06598fce3787128541
Opcode Fuzzy Hash: 9b0e02aeda78413b707bb5f5005c0aed5a48dc94bd96ce865f70521d7a573c81
Instruction Fuzzy Hash: 2B21D079605304DFDB14DF14D984F26BB65FB84714F20C96DD84A4B286C37AD847CA62

Function 0094D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461094185.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_94d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f292f1b9a23732f7822b22764f166b84f9983e8cd9c2ae75ad2923c1bc8cb4
Instruction ID: 906ce4367e2150228908d6aa8ad60cc48a4ec608e5f9105fe415fd0a4f609b8f
Opcode Fuzzy Hash: 12f292f1b9a23732f7822b22764f166b84f9983e8cd9c2ae75ad2923c1bc8cb4
Instruction Fuzzy Hash: 2C2150795093808FCB16CF24D994B15BF71EB46314F28C5DAD8498F6A7C33A980ACB62

Function 0093D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 0ef33c34245f52f2e4230fd3ed6c78e9ba58f51d23c50dd4209116dfa4d0d3d3
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 2011D376504240DFDB16CF14E5C4B16BF72FB94324F24C6A9D8490B6A6C33AE856CFA2

Function 0093D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 61417235ee2c953608f2e7072d32255299602178e980baa078c5e88c4b3d4d05
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 84112676504280CFCB02CF10D5C0B16BF72FB84324F24C6A9E8490B25AC33AD856CFA2

Function 0094D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461094185.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_94d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 17921e54122de47fd8d6c209c59b78cbda3a132d51b6ac80d9e8525c1ae973ec
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: A711DD79504280DFDB01CF10C5C4B15FBB2FB84324F24C6ADD8494B296C37AD80ACB61

Function 0093D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671012c0d0f8bd92c87842ad4e1aa558155bcd587982a5b44efe49ad29f4a0b6
Instruction ID: 37c217e2ddc95033f5e9d9edb98a1f4d142e18bd0bce0d5cc3c7381f515f107d
Opcode Fuzzy Hash: 671012c0d0f8bd92c87842ad4e1aa558155bcd587982a5b44efe49ad29f4a0b6
Instruction Fuzzy Hash: C501F7B10053449BF7105A25DD94B66BBDCEF41765F14C51AED0A4A282C23D9841CF72

Function 0093D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1460969596.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_93d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ba95df834f4844680aa95116fd2b6bed5e9f00b9c5116e3d0291ebaedab50a
Instruction ID: 4d08cf42c94d226b201ccf89fc4f82973c0b86ae818aa82711af2e09f08c0169
Opcode Fuzzy Hash: 05ba95df834f4844680aa95116fd2b6bed5e9f00b9c5116e3d0291ebaedab50a
Instruction Fuzzy Hash: 49F0CD72405344AFE7108E16DC88B62FFDCEB91734F18C05AED094A286C279A840CFB1

Non-executed Functions

Function 06C6C4A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e192ce121977aa5609f3de50ce508d36dead876ae093ce4eb7f2f6bc5c9df4b
Instruction ID: 20924b7f3ec2cab6c4f3401bda845908bb1847e863372ddb11dcf56c84b702fc
Opcode Fuzzy Hash: 2e192ce121977aa5609f3de50ce508d36dead876ae093ce4eb7f2f6bc5c9df4b
Instruction Fuzzy Hash: 56E11D74E002198FDB14DF99C5809AEFBF2FF89305F248169E858AB356D730A942CF65

Function 06C6E550 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7456c3cd1502c8a094d894c89b3b8f5bf4f8b3e3cad888649c6d356a02f98587
Instruction ID: 982a163c46ddc433cdf14790869157acfafb89b2ed6808aae0e0e10062f393a7
Opcode Fuzzy Hash: 7456c3cd1502c8a094d894c89b3b8f5bf4f8b3e3cad888649c6d356a02f98587
Instruction Fuzzy Hash: BBE12E74E042198FDB14DF99C5809AEFBF2FF89305F24816AE818AB356D730A941CF65

Function 06C6D148 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b5883bf2616d67c569eecf8d13323b8a643f9f526bb42af864077efd8d6b71
Instruction ID: 4ab1b1faec54a7a9a43f9bcf8da46ceaf7653e27c473735e5dc08e0e612dde92
Opcode Fuzzy Hash: 36b5883bf2616d67c569eecf8d13323b8a643f9f526bb42af864077efd8d6b71
Instruction Fuzzy Hash: 31E1E974E002198FDB14DFA9C5809AEBBF2FF89305F248169E819AB356D730A941CF65

Function 06C6CD10 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa82ce4f0970a036073b8c4c1a7f08e74f13cbe476c0f7c3bceb64e62e3e5841
Instruction ID: c0085af6fd3761312c5f7f63a1f168454e3a9077f7c061428f87b8a37f4904cf
Opcode Fuzzy Hash: fa82ce4f0970a036073b8c4c1a7f08e74f13cbe476c0f7c3bceb64e62e3e5841
Instruction Fuzzy Hash: DFE13E74E002198FDB14DF99C5809AEFBF2FF89305F248169E859AB356C730A942CF61

Function 06C6C8D8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6b7e11aa7ae6873797798783349c307d0879a15bce3a2e453764f24aeaa676
Instruction ID: 4076283e5d4f3553815aa7fed87f8026c00717299f7176b1c18a2e6715bf0539
Opcode Fuzzy Hash: ec6b7e11aa7ae6873797798783349c307d0879a15bce3a2e453764f24aeaa676
Instruction Fuzzy Hash: 3DE11E74E002198FDB14DF99C580AADFBF2FF89304F248169E859AB356D7309942CFA5

Function 0B6E3E18 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1469250766.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b6e0000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f8f65a2e5e22e919f79965fe3ea8897cd2ae3e6c729e249d6633b0628bea7c
Instruction ID: 7d42eddfdc04c3a118188a9c2af78319acb9c1ddeb942cbd990fa87494d157df
Opcode Fuzzy Hash: b4f8f65a2e5e22e919f79965fe3ea8897cd2ae3e6c729e249d6633b0628bea7c
Instruction Fuzzy Hash: A6D1A174A016088FDB08DF69D598AADB7F1BF8C701F2580A9E419AB371DB31AD41CF60

Function 06C63883 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645f600199bb2479f1b90d1e63e36d6b4d5be4cfb3edb5b0988ccf73e85068d2
Instruction ID: 37a755b11cb1f10906d4bb46b866d695f94e5661a91107391c1eeab6c7dce15f
Opcode Fuzzy Hash: 645f600199bb2479f1b90d1e63e36d6b4d5be4cfb3edb5b0988ccf73e85068d2
Instruction Fuzzy Hash: A4D1F635D1075ACACB11EB64D990699B7B1FFD6300F20C79AE50A3B215EB70AAC4CF91

Function 009BD524 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1461474737.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_9b0000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9dd84fb664cbb7061c6265f27423339c93eccea9e3a29590a22a5c138e8097
Instruction ID: d31cdab2051d847b40f0882436bc57aadeb2868a9dfa72f64cb84f4f1295ddab
Opcode Fuzzy Hash: 9f9dd84fb664cbb7061c6265f27423339c93eccea9e3a29590a22a5c138e8097
Instruction Fuzzy Hash: B7A14D32E00219DFCF05DFA4C9945DEB7B6FF85310B15857AE805AB261DB35E916CB40

Function 06C63888 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ec9fc1680834030e34b0eb0595987780cd6fc54c443c0aed11229acc254ea4
Instruction ID: 50cac43ed89b4138e8b6eb702773a5472c9969ea6522b114f93c18ca70560dfc
Opcode Fuzzy Hash: 29ec9fc1680834030e34b0eb0595987780cd6fc54c443c0aed11229acc254ea4
Instruction Fuzzy Hash: DED1E635D1075ACACB11EB64D990699B7B1FFD6300F20C79AE5093B215EB70AAC4CF91

Function 06C6E53F Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c380d377b4ee670ba3711c44abfcfe0653d55cef162554dd26f2f8d332e198a
Instruction ID: ddf78f62c9bfe69fa5fd46d1edebfedf2ec5d768973156d8b0ed5ce42c9c4dc4
Opcode Fuzzy Hash: 4c380d377b4ee670ba3711c44abfcfe0653d55cef162554dd26f2f8d332e198a
Instruction Fuzzy Hash: 6B511074E042198FDB14CFAAC5805AEFBF2FF89304F2481AAD558AB315D7319A42CF65

Function 06C6CD08 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1467872451.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd5d9e5aac3acd23fd8547319c4950b765e83b832521bb7db7bb6b94234231a
Instruction ID: f3b19f6a77b3d5341517b8e69a09f143ab6e2b5264c70e41f14b810f5147fd53
Opcode Fuzzy Hash: cbd5d9e5aac3acd23fd8547319c4950b765e83b832521bb7db7bb6b94234231a
Instruction Fuzzy Hash: 58511C74E002198FDB14CFAAC5805AEFBF2FF89304F248169D458AB315D7319A42CFA1

Analysis Process: ship's particulars-TBN.pdf.scr.exePID: 7752, Parent PID: 7508COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	118
Total number of Limit Nodes:	17

Executed Functions

Function 06D62AE8 Relevance: .9, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4178868259224fbfe6939c0d3e4582a5decb105edd72735193f101f25ac2236
Instruction ID: 4939c37d1b8dfb22c17b65eede6e92b717d05e98b40b7e3fcdb6b0f2cd4ea80e
Opcode Fuzzy Hash: c4178868259224fbfe6939c0d3e4582a5decb105edd72735193f101f25ac2236
Instruction Fuzzy Hash: A8823B30E00619CFDB54DF65C494A9DB7B2FF89300F55D6AAE409AB260EB35ED85CB80

Function 06D6B248 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4c1c1ffcb2bf0f949f31b60a198819aad685fd1c9900ffa2e986646df6aaf7
Instruction ID: a11f85d0138e13f5570a3454f190d68b605c49fa0bb9ea0b2aa2d45ad16745d1
Opcode Fuzzy Hash: 6e4c1c1ffcb2bf0f949f31b60a198819aad685fd1c9900ffa2e986646df6aaf7
Instruction Fuzzy Hash: 61223030E102098FEFA4DB6AD4907ADB7B6FB89310F648527E405EB391DB35DC918B91

Function 06D52872 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06D528F6
GetCurrentThread.KERNEL32 ref: 06D52933
GetCurrentProcess.KERNEL32 ref: 06D52970
GetCurrentThreadId.KERNEL32 ref: 06D529C9

Strings

B@a, xrefs: 06D52894

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: Current$ProcessThread
String ID: B@a
API String ID: 2063062207-462256014
Opcode ID: 2c272d738638bd771b43c199dbd0d2af0c0b1b940e91d25519573f45f99892c4
Instruction ID: a888389859d1720449f7d72004f084973f24b32bbcdf623943ad2d1c56946c85
Opcode Fuzzy Hash: 2c272d738638bd771b43c199dbd0d2af0c0b1b940e91d25519573f45f99892c4
Instruction Fuzzy Hash: 1E5158B090034ACFDB54DFAAD548B9EBBF1BF88314F248459E809A73A0D7355944CF65

Function 06D52878 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06D528F6
GetCurrentThread.KERNEL32 ref: 06D52933
GetCurrentProcess.KERNEL32 ref: 06D52970
GetCurrentThreadId.KERNEL32 ref: 06D529C9

Strings

B@a, xrefs: 06D52894

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: Current$ProcessThread
String ID: B@a
API String ID: 2063062207-462256014
Opcode ID: 514b3e287c13056ce86fa62b44ec869c46ea4c940b91cb11656bae678812cb0c
Instruction ID: 7695a2512474b0d42fa000a49af28ec7a523bcb4a11b322463f8639a6b36b090
Opcode Fuzzy Hash: 514b3e287c13056ce86fa62b44ec869c46ea4c940b91cb11656bae678812cb0c
Instruction Fuzzy Hash: A85137B090034A8FDB54DFAAD948B9EBBF1BF88310F248459E409A73A0D7755944CF65

Function 06D5D0E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D5D202

Strings

B@a, xrefs: 06D5D11E
B@a, xrefs: 06D5D13E

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: CreateWindow
String ID: B@a$B@a
API String ID: 716092398-212933815
Opcode ID: 0fc06ed91ba3e974ff86b7c57be98a301fdd6fea69741b47a087ed92d3247117
Instruction ID: 0d9f6c030603b052971f7378c2197658ea907b00aa7c32cac19dba7e9b9503f1
Opcode Fuzzy Hash: 0fc06ed91ba3e974ff86b7c57be98a301fdd6fea69741b47a087ed92d3247117
Instruction Fuzzy Hash: A751C0B1D00349DFDF14CF9AC884ADEBBB6BF88310F25812AE819AB250D7759945CF94

Function 06D5D0F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06D5D202

Strings

B@a, xrefs: 06D5D11E
B@a, xrefs: 06D5D13E

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: CreateWindow
String ID: B@a$B@a
API String ID: 716092398-212933815
Opcode ID: 51c1022913e67c37b87bd77aa9ce03208c2a96799cf81ff0b03c9ac2cbd7ecbc
Instruction ID: d6bf6dbbd9bf09bac3035b4accd9cbd22ac0359a09c6d96ba209b2cf9694efaf
Opcode Fuzzy Hash: 51c1022913e67c37b87bd77aa9ce03208c2a96799cf81ff0b03c9ac2cbd7ecbc
Instruction Fuzzy Hash: 1641A0B1D00349DFDF14CF9AC884ADEBBB6BF88310F25812AE819AB250D7759945CF94

Function 06D5AF1F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D5B176

Strings

B@a, xrefs: 06D5B12F

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: HandleModule
String ID: B@a
API String ID: 4139908857-462256014
Opcode ID: 63998a40b0aece5d02ce57b12606a7ab4b767631122d704ac9863b19a0b7adc3
Instruction ID: 6624901d0e731012df9e1837947ea32ae90642532c0c0a069f8b777afde98ff8
Opcode Fuzzy Hash: 63998a40b0aece5d02ce57b12606a7ab4b767631122d704ac9863b19a0b7adc3
Instruction Fuzzy Hash: BE714870A00B058FDBA4DF2AD55175ABBF1FF88200F048A2EE89AD7A50D775E845CB91

Function 06D5A5EC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06D5F8F1

Strings

B@a, xrefs: 06D5F847

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: CallProcWindow
String ID: B@a
API String ID: 2714655100-462256014
Opcode ID: 694cdf86cff34d55a5d8c63cb3f2c03effdb3629cbe4ce47049ed9bd94396d2b
Instruction ID: f2e25606f74b465aa1cda6e34202cc8b25571f87d10b253311338ca4f8ec0c16
Opcode Fuzzy Hash: 694cdf86cff34d55a5d8c63cb3f2c03effdb3629cbe4ce47049ed9bd94396d2b
Instruction Fuzzy Hash: 5A415BB4900309DFDB54DF9AC488BAABBF5FB88314F25C459D919AB361D734A841CFA0

Function 06D52AB8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06D52B47

Strings

B@a, xrefs: 06D52ADF

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: DuplicateHandle
String ID: B@a
API String ID: 3793708945-462256014
Opcode ID: 648d5e2e5ba7630381bbc566f3ac39779561adb41a1ba7dd8c0be2c5cfc08697
Instruction ID: 4ce941ceabcbc1a334a1e7c9e9db0f57c148051a960941c7a6ebd3a6a3579e53
Opcode Fuzzy Hash: 648d5e2e5ba7630381bbc566f3ac39779561adb41a1ba7dd8c0be2c5cfc08697
Instruction Fuzzy Hash: C921E3B59002499FDB10CFAAD884ADEBBF5FB48310F14842AE954A7750D374A955CFA0

Function 06D52AC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06D52B47

Strings

B@a, xrefs: 06D52ADF

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: DuplicateHandle
String ID: B@a
API String ID: 3793708945-462256014
Opcode ID: 4e59145ac5ea02488b59f0f067de86beb9e76c2d7429a3c31217ce4ae11793ca
Instruction ID: 41c244cbaa69f1dc20f79e7aa6942209757a4971f8ef40dee855e09dc821f78d
Opcode Fuzzy Hash: 4e59145ac5ea02488b59f0f067de86beb9e76c2d7429a3c31217ce4ae11793ca
Instruction Fuzzy Hash: 5421E4B59002099FDB10CFAAD884ADEFBF9FB48310F14801AE954A3350D374A954CFA4

Function 015BE1C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,015BEAB2), ref: 015BEB9F

Strings

B@a, xrefs: 015BEB57

Memory Dump Source

Source File: 00000006.00000002.3894917967.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_ship's particulars-TBN.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: B@a
API String ID: 1890195054-462256014
Opcode ID: 52f6380595fd06c16684923e485002029d738731112cf53fabc68ab754d05083
Instruction ID: d06f2b1c31376fc7ed8b45cdb5a45d30cc99b0da9452cb95030a78d7a17affa9
Opcode Fuzzy Hash: 52f6380595fd06c16684923e485002029d738731112cf53fabc68ab754d05083
Instruction Fuzzy Hash: E21136B1C0065A9BDB10DF9AC445BDEFBF4FF48210F14816AE914A7240D778A904CFA1

Function 015BEB33 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,015BEAB2), ref: 015BEB9F

Strings

B@a, xrefs: 015BEB57

Memory Dump Source

Source File: 00000006.00000002.3894917967.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15b0000_ship's particulars-TBN.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: B@a
API String ID: 1890195054-462256014
Opcode ID: 1e800951397fd570bd1241869fff6a706d3a9a9f80c5dec03c6d2cf042328d0d
Instruction ID: 6b7ebe92090bcb9aa3b9ee31dbd9831ab6321d6a2947e80b45ccdc133ad93d79
Opcode Fuzzy Hash: 1e800951397fd570bd1241869fff6a706d3a9a9f80c5dec03c6d2cf042328d0d
Instruction Fuzzy Hash: 4D1114B1C0065A9FDB10DFAAC445BDEFBF5BF48320F14816AD818A7280D778A944CFA1

Function 06D5B110 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06D5B176

Strings

B@a, xrefs: 06D5B12F

Memory Dump Source

Source File: 00000006.00000002.3901419569.0000000006D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d50000_ship's particulars-TBN.jbxd

Similarity

API ID: HandleModule
String ID: B@a
API String ID: 4139908857-462256014
Opcode ID: 00dabf28aa3707cf47c8d001728841ec6acf328af50819efdbc712fbcfa70dec
Instruction ID: a007a36f2def031f32287dc22585812804f7cfd5a775bb4d6556101d116a0db8
Opcode Fuzzy Hash: 00dabf28aa3707cf47c8d001728841ec6acf328af50819efdbc712fbcfa70dec
Instruction Fuzzy Hash: 3411DFB5C006498FDB10DF9AC844B9EFBF4AB88220F15842AD829A7650C779A545CFA5

Function 06D658C0 Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

$, xrefs: 06D6597B

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b05ecdd11a369d1985cb95d1478559c05741298c7faffb5726fa7bc3d8081ab8
Instruction ID: 8b3a8f309cefc8a61b9d904fd2bebc4307be2f4de2d880f251eaf8ae0f8e15d0
Opcode Fuzzy Hash: b05ecdd11a369d1985cb95d1478559c05741298c7faffb5726fa7bc3d8081ab8
Instruction Fuzzy Hash: 7DC1AF75F00219CFDF54DBA5D45069EBBB6FF88310F208169E802AB354DA32AD82CB90

Function 06D63878 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

B@a, xrefs: 06D638A2

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID: B@a
API String ID: 0-462256014
Opcode ID: 59e6bee561715a8278f3247bb70f374de4c1da5eecda3f40b6972cdccaa34edc
Instruction ID: 9128d7d3a9e862bbc115a84dd5b66fa133fc0d31d9a06ed3b4bf041c3b07c9a2
Opcode Fuzzy Hash: 59e6bee561715a8278f3247bb70f374de4c1da5eecda3f40b6972cdccaa34edc
Instruction Fuzzy Hash: 6D21C0B5D01259AFCB00DF9AD885ADEFBB4FB48714F10812AE918A7340C374A954CFA5

Function 06D63880 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

B@a, xrefs: 06D638A2

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID: B@a
API String ID: 0-462256014
Opcode ID: e6f115ebc3885e406811d3069f61d9da1fb1ddd02649879c3232cef3655107c3
Instruction ID: 1c0b5c67a2c393ea355940342663924e52050705d871d12c9c7c5bee32e0e467
Opcode Fuzzy Hash: e6f115ebc3885e406811d3069f61d9da1fb1ddd02649879c3232cef3655107c3
Instruction Fuzzy Hash: DA11CFB5D01259AFCB00DF9AD884ACEFBB4FB48310F10812AE918A7240C374A954CFA5

Function 06D6ACE0 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2471b1d67fe74bd772b26b5c70b41973992d1a9a6b8c2d68bbeb729bff12736
Instruction ID: 40e10078a6d6a3884d263e5ab162324d86a2973429e96f28d8aea26500f4930a
Opcode Fuzzy Hash: b2471b1d67fe74bd772b26b5c70b41973992d1a9a6b8c2d68bbeb729bff12736
Instruction Fuzzy Hash: DCE17D30F1021A9FDB54DB69D8906AEB7B2FFC5201F14852AE806EB354EB35DC46CB91

Function 06D6B243 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dbd9be96c960ea9bf5574a1c8f99a40af8377971cb10cc81e1dd3fa0159a27
Instruction ID: 2fd6c76af31242d6f28d69f30245177bd5300b90ce236730f6f5b67adbbc3c04
Opcode Fuzzy Hash: f3dbd9be96c960ea9bf5574a1c8f99a40af8377971cb10cc81e1dd3fa0159a27
Instruction Fuzzy Hash: 8CA15530F101099BEFA4DBAED4907AEB6A6FBC9310F604426F405EB391DB39DC519B91

Function 06D66D18 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bdd50e8dffeb9619ed9e69e648042dd0bfd502d0e79b5986b7dbca0869fd79
Instruction ID: 247eddb69abbd0d965bccdb751642172db4cefd328c84b80a248cc5f65aeada6
Opcode Fuzzy Hash: 41bdd50e8dffeb9619ed9e69e648042dd0bfd502d0e79b5986b7dbca0869fd79
Instruction Fuzzy Hash: F3A18B30A00209CFDB64DB6AD594B5DBBF2FF84354F148569E81AAB391DB36EC41CB90

Function 06D68078 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6490487601e7cedc59a0cbbcf705f08af13a0273f31c2283fd96a482f6f96851
Instruction ID: 4a850e762f93997de5f00af079ecff2657617eb90daad8d4f54e5a65b9a1c183
Opcode Fuzzy Hash: 6490487601e7cedc59a0cbbcf705f08af13a0273f31c2283fd96a482f6f96851
Instruction Fuzzy Hash: 83915C30B1061ACFDB54DF76D85066EB7A6FFC8214F108529E806DB354EB79EC429BA0

Function 06D69158 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2366ca92b6a1cb1d4998f69449253dbde6b9f2f8d979677d99c84f6e5ead9194
Instruction ID: e67ffeaef4b1bb0b17ca352bab669a942687d356667b3464d66201ab05b8ade3
Opcode Fuzzy Hash: 2366ca92b6a1cb1d4998f69449253dbde6b9f2f8d979677d99c84f6e5ead9194
Instruction Fuzzy Hash: 14913B30B0021A8FDB94DF65D8607AEB7F6EFC9200F108569D80AEB354EA35DD468F91

Function 06D661F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a18e5041c826704e4671bfafabd3ea48925e9e9e1602672f4824ab368cc823
Instruction ID: 729aca8d092b138bd32ed04e0a2bfa5ad509e0a3cd6b3ca91d6fb022db63a09e
Opcode Fuzzy Hash: 23a18e5041c826704e4671bfafabd3ea48925e9e9e1602672f4824ab368cc823
Instruction Fuzzy Hash: 67619671F001214BDF54AB6EC84065EBADBEFD8610B15443AE80ADB3A0DE65ED4287D6

Function 06D642A1 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e86792bf0f6aa99b1ef3cbcc9af8d4410704d5ef13bbf9e20f386554c7252f
Instruction ID: 68d0e4e3cc4d916081f2cb8d459cbf2381d0c9899636a58d062353d91baba1f1
Opcode Fuzzy Hash: f9e86792bf0f6aa99b1ef3cbcc9af8d4410704d5ef13bbf9e20f386554c7252f
Instruction Fuzzy Hash: 74812F30B0121A8FDF94DFA9D45076EBBF2AF89710F108529E80AEB354DB75DC468B51

Function 06D642B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18340a4df8be67caefaa3386ec5169584c2eef054dda72c6c4ff8c9a3a5192c
Instruction ID: eb68cfe876edf1c22ce00990dc90fe3623e609ed6f2daab9507d28d28cb1105b
Opcode Fuzzy Hash: e18340a4df8be67caefaa3386ec5169584c2eef054dda72c6c4ff8c9a3a5192c
Instruction Fuzzy Hash: 58813030B0121A8BDF94DFA9D45076EBBF2EF89710F108529E80AEB354DB75DC468B91

Function 06D645C4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d9b46b60867e4110ca34435a82a3dbc997bd70ac8b2479ea6d09ad0d414e3c
Instruction ID: d7a267ae3aa2c4e4968061036b165484bdd475503df30447c679ded0ffcdb958
Opcode Fuzzy Hash: 25d9b46b60867e4110ca34435a82a3dbc997bd70ac8b2479ea6d09ad0d414e3c
Instruction Fuzzy Hash: C6915D30E0061A8BDF60DF68C890B9DB7B1FF89310F20C699D549AB395DB71A985CF91

Function 06D645D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e8bd48802e68be070a605408ed0410c1e9cf454a719ea77034bd419e2675db
Instruction ID: 55e712b0e11f75ed8e808ec39facfc27a79365ba6bd152d3ed7ce86985c39dc9
Opcode Fuzzy Hash: a0e8bd48802e68be070a605408ed0410c1e9cf454a719ea77034bd419e2675db
Instruction Fuzzy Hash: 5F914C30E1061A8BDF60DF65C890B9DB7B1FF89310F20C699D509AB394DB71A985CF91

Function 06D6EB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4ce8569dd456546acc89ed1ed737d1f7f643c106bc13c05f741b92bae6d2d7
Instruction ID: a3e4bbb63387fda7d965119b06b4475dd31284f0695468484adf66e6fe1dcf47
Opcode Fuzzy Hash: 6e4ce8569dd456546acc89ed1ed737d1f7f643c106bc13c05f741b92bae6d2d7
Instruction Fuzzy Hash: D471F934A002099FDB94DBA9D990A9EBBF6FFC4300F148529E41AEB354DB31ED46CB51

Function 06D6EB27 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe41ef9d6583f6eb29ecf919c776d74e16112166c106044355ff92ae4d8f25d
Instruction ID: 46d1e6c98499393646bbf767f29761c5759c9ce5b323aa19e0edacd215ec60fe
Opcode Fuzzy Hash: 6fe41ef9d6583f6eb29ecf919c776d74e16112166c106044355ff92ae4d8f25d
Instruction Fuzzy Hash: BE711A74A002099FDB94DBA9D990A9EBBF6FFC4300F148529E40AEB254DB31EC46CB50

Function 06D64B70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee95444744d8c20f3a58e16b82e05f271f857ce3d048b8cc8faa003df91beb8
Instruction ID: 6bc260f90a48af8041ddadff2d0395f39831c3876741c6a61f1a27b808d2aad1
Opcode Fuzzy Hash: 5ee95444744d8c20f3a58e16b82e05f271f857ce3d048b8cc8faa003df91beb8
Instruction Fuzzy Hash: A9617370F002099FEB959FA5C8147AEBBF6FBC8740F208529E506AB391DE754C458F90

Function 06D6FBC8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc21218d2a85c5de633090d5ceb1f3e28118881e039b3bbc85629f898bef6a4
Instruction ID: a2b5dfefca0edec5d2897b1afe0b1a18912d18673ca40ee135fe79171797ba1c
Opcode Fuzzy Hash: fdc21218d2a85c5de633090d5ceb1f3e28118881e039b3bbc85629f898bef6a4
Instruction Fuzzy Hash: B551E031E00605CFDB54EFB9F8846ADBBB3FB84311F11886AE506DB250DB359854CB80

Function 06D655A0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61fae5a33a9b1ae2cbf8d69867355e9a8234df51bf6e399ad007160e248f1042
Instruction ID: 8206dea3a670ceab789a0302e4a768e16d8727db8521dabc811454a263a02f21
Opcode Fuzzy Hash: 61fae5a33a9b1ae2cbf8d69867355e9a8234df51bf6e399ad007160e248f1042
Instruction Fuzzy Hash: 26516274E001068FDF64CB9AE480A7EF7B1EB85311F248926E556DB281C635D8C2CB91

Function 06D6F96B Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334a13d0dcbf5594625e142e9d46eac2bd639afd737df84d110e8bb971f85df4
Instruction ID: 0c6c0bb0569728192604f1b21a7e3237dbb28edd0baae351a111ce6c98f87044
Opcode Fuzzy Hash: 334a13d0dcbf5594625e142e9d46eac2bd639afd737df84d110e8bb971f85df4
Instruction Fuzzy Hash: BC519F70B206059BEF609BBDE854B2E6A5BE7C9711F20442AF00BD7791CA7DCC4193A2

Function 06D69153 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805bfab68d14e539921d1a8f54a7f6293b2d3a68795250a6ecd0ac7a2e1cb79d
Instruction ID: 7acf10c4c012f285eeeff21d91638f3102530f371f5ba42631962882b216db11
Opcode Fuzzy Hash: 805bfab68d14e539921d1a8f54a7f6293b2d3a68795250a6ecd0ac7a2e1cb79d
Instruction Fuzzy Hash: CE515030B0120A9FDB94DF65D860B6EB7F6EFC8200F108569D80AEB354EA35DD018F90

Function 06D6F978 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7227959b75afa92800e9afaacc052dbe2184c7568999004f20c8aaacd23ec033
Instruction ID: e89cfbc1710bd7bc0c46b6c1b3d9cc7a21cfd0de6d7a4a782b927a0ad47395bf
Opcode Fuzzy Hash: 7227959b75afa92800e9afaacc052dbe2184c7568999004f20c8aaacd23ec033
Instruction Fuzzy Hash: E9519D70B202049BEF609BBDE854B2E6A5BE7C9711F20443AF00BD7790CE79CC4193A2

Function 06D6C7D8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e92f2ff119e06fec387c01f99f234d3011ccc897b67d7968198a01cadcbac8
Instruction ID: 1aff81ba44d1405ffbe57d18cf915954762870588274b0ce2de37c154b5158e0
Opcode Fuzzy Hash: e6e92f2ff119e06fec387c01f99f234d3011ccc897b67d7968198a01cadcbac8
Instruction Fuzzy Hash: AD515E30B10319CFDB54EB69D490A9EBBB2FBC8315B108569E846EB354DB35EC06CB91

Function 06D64B63 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c37dfae50b5bc20ae5aa99b21f85e348bbae84508acdb6f6d8cbbf1bfac131
Instruction ID: af2d89d1c3e256d958facb099163e6a8070cb2210805ddcae15371f9a385c19b
Opcode Fuzzy Hash: f5c37dfae50b5bc20ae5aa99b21f85e348bbae84508acdb6f6d8cbbf1bfac131
Instruction Fuzzy Hash: B1419170F002099FEB449FA5C814B9EBAF6FFC8700F20852AE506AB394DE759C05CB90

Function 06D65428 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8542ac9bb6081b4b7e959f9d4999fbe3fc5d3364f02b50395876969dcc1f770a
Instruction ID: 23d73f90cc5efe016cd0dbe2be2f7cb06b30c8c6de30c7fe9cc12cead818d24e
Opcode Fuzzy Hash: 8542ac9bb6081b4b7e959f9d4999fbe3fc5d3364f02b50395876969dcc1f770a
Instruction Fuzzy Hash: 0B413071E0060A8FDF70CF9AE8806AFF7B6FB88310F10492AE116D7650D771E9958B91

Function 06D6DAD0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e713f78cf31a50b4b068bd96ed63a0e06b34ae1f3594ac149e72a7f4c3f8638c
Instruction ID: 61a8f52a7d8666a46b378ea74dbc62312939cbc89a3096ffa6630e0445e80b77
Opcode Fuzzy Hash: e713f78cf31a50b4b068bd96ed63a0e06b34ae1f3594ac149e72a7f4c3f8638c
Instruction Fuzzy Hash: 87416E70F0030ADFDB65DF6AE49469EBBB2BF85700F204429E806EB244DB71D845CB81

Function 06D6DACD Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cf83e46d8309e1ac4e098a7fe57b218319f0b68b85c11651cc1cd01b944f0b
Instruction ID: 8eda30e006e5341625a2cf0c660c70be089e7dbcf5f4e95ad93a69d3a922684b
Opcode Fuzzy Hash: 98cf83e46d8309e1ac4e098a7fe57b218319f0b68b85c11651cc1cd01b944f0b
Instruction Fuzzy Hash: 23416D70F0031A9FDB65DF6AE59469EBBB2BF85200F104529E806EB244EB70D845CB81

Function 06D621C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f4e86a050cc2d391ed6a30f0ef46997d91d41f26692e4dcd2d96a51923090f
Instruction ID: 1a6c78656f8675539f7defae690cd6ae8596990814c8a9378a9dff277c63fa2b
Opcode Fuzzy Hash: 36f4e86a050cc2d391ed6a30f0ef46997d91d41f26692e4dcd2d96a51923090f
Instruction Fuzzy Hash: 6131AD30B0020A8FDBA99B76D45476E7BE2BB89710F248529E806EB394DF35CD05CB91

Function 06D621BB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979097da1efd51fe3cc462d5e21a6d221fcbce8f261ed268011f8f6d7823037d
Instruction ID: 6ae44af93ce198c2e81a60edf1a28610cf6f79f3c88a4f9fbee96e2f0be6f7c6
Opcode Fuzzy Hash: 979097da1efd51fe3cc462d5e21a6d221fcbce8f261ed268011f8f6d7823037d
Instruction Fuzzy Hash: 7531E330B002068FDBA59F75D45466E7BF2BB89710F108528E806DB390DF35CD05CB91

Function 06D6FBC7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f129e1c4901e6bba84a2070118d6b8c0e7a6eebeed00345776fe40950a488eda
Instruction ID: cea093c14db86e3d9990a1671484b24b2daeafa276f9845b6bc7bb02f378fbf7
Opcode Fuzzy Hash: f129e1c4901e6bba84a2070118d6b8c0e7a6eebeed00345776fe40950a488eda
Instruction Fuzzy Hash: 6531DE32A00605CBCB58ABB8F8442ADBBB3FF84205F118879E50ADB251DF369865C790

Function 06D6207B Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22543a83df76ee1e1356c7b04b5a95908391aa09c5318601d5b6862896fd5f4d
Instruction ID: a9593675a3330287efed3a8931d031bf2f44d3a4efe566b9c78dd8ede4cf3310
Opcode Fuzzy Hash: 22543a83df76ee1e1356c7b04b5a95908391aa09c5318601d5b6862896fd5f4d
Instruction Fuzzy Hash: 91318D30E102169FDB45CFA5D89469EBBB2FF89304F108429F906EB351DB75AD82CB90

Function 06D6D977 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f8978506ad60c4968c4d6c87364f87f291d8df73aa8db3a4ae6f023377af45
Instruction ID: c759f5ee400afc3f0eeea7950c947632c2554855efd4718c46b1bfac71fb00a4
Opcode Fuzzy Hash: 25f8978506ad60c4968c4d6c87364f87f291d8df73aa8db3a4ae6f023377af45
Instruction Fuzzy Hash: A0318330F1431A8BDF55DF69D89069EBBB2FF85204F148929E805EB304EB74E9468B91

Function 06D6D980 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131ca212fdd8c61381210f2e961a09e4d433814279fd67e124065e03e28fddb8
Instruction ID: 76fa3243304272d2627c0819664a55d09f6278f502d3d842be334f35115ac8ce
Opcode Fuzzy Hash: 131ca212fdd8c61381210f2e961a09e4d433814279fd67e124065e03e28fddb8
Instruction Fuzzy Hash: 3931B430E1431A8BDF14DF69D880A9EBBB2FF84304F108529E805EB304EB70E945CB81

Function 06D62088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492c9381790be19f247b633a16cfb15954b763e261a4b06fae51b10c4d2753b5
Instruction ID: 3585bc5f4a0a973bd949a06616980ac6ed0e73bfe2d5c121b1520490058976f2
Opcode Fuzzy Hash: 492c9381790be19f247b633a16cfb15954b763e261a4b06fae51b10c4d2753b5
Instruction Fuzzy Hash: 28318F34E106169FCB54CFA5D89469EBBB2FF89300F108529F906EB350DB75AD82CB80

Function 06D63AA1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8ae7165fd6a999b43ddc7f8bd63219c00ff43db2f454bf685a359205d06c84
Instruction ID: 8cb379b84fb01db508831e3d368bdb67e0b2ceb375350a01f21943a4a641894d
Opcode Fuzzy Hash: 1f8ae7165fd6a999b43ddc7f8bd63219c00ff43db2f454bf685a359205d06c84
Instruction Fuzzy Hash: BE215A71F016199FDB40CF6DE881AAEBBF5EB48710F118025E905E7381E739DD418B94

Function 06D63AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628219eaa758f0d8087a47afc58092c5fa2c2d5652dddf6de4c82236e8fae4aa
Instruction ID: 765b9dffe1347e8b4deedc217674ebbf197435355bcb1a08b74ae1bec1f93677
Opcode Fuzzy Hash: 628219eaa758f0d8087a47afc58092c5fa2c2d5652dddf6de4c82236e8fae4aa
Instruction Fuzzy Hash: C4212A75F01619DFDB50CFAED880AAEB7F5EB48710F158029E905E7241E739DC418B94

Function 0156D006 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3894632577.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_156d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75ab2bf0666c4dd96f55eb14b4bfb0b8ca24186ad2696024bb0ecd04c000da6
Instruction ID: 2c70796b9469e08eb494d9a1a30dd517b37ca10acd4615f2882f195a4d0ceb9b
Opcode Fuzzy Hash: c75ab2bf0666c4dd96f55eb14b4bfb0b8ca24186ad2696024bb0ecd04c000da6
Instruction Fuzzy Hash: B0214D755093C09FC703CB64D9A0715BF75AB46224F29C5DBD8858F2A7D23A980ACB62

Function 0156D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3894632577.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_156d000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528779969379824301d825ccd00fd6f59d6917c8bc2c7d7d3d440c34be1a953a
Instruction ID: 59c729c4692fd8410e4aa4447c18e87cdc2d6c556a36e72416f637e02d163fa9
Opcode Fuzzy Hash: 528779969379824301d825ccd00fd6f59d6917c8bc2c7d7d3d440c34be1a953a
Instruction Fuzzy Hash: 33210075608304DFDB11DF54D980B26BBB9FB84324F20CA6DD8894F282D37AD446CBA2

Function 06D66D13 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01213a01a7d7760d909c062a18a110c3fe38392f37a532fb78f534a2744d867e
Instruction ID: 1554c475602da00e23d0a9c1062f535316fab50313c4563bf85f6eefa0603322
Opcode Fuzzy Hash: 01213a01a7d7760d909c062a18a110c3fe38392f37a532fb78f534a2744d867e
Instruction Fuzzy Hash: 8D21A230B001199BDF94EB6AE95479EB7B6EFC4350F248429E805E7340DB36ED418B91

Function 06D63060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecc7964e2336732c860697c0644738df63f7d28c99357d583dccaafb0fdb3db
Instruction ID: e8b24862bf32732a50b6edc145107a75d752614735c789a3b53caa1d44a81c19
Opcode Fuzzy Hash: cecc7964e2336732c860697c0644738df63f7d28c99357d583dccaafb0fdb3db
Instruction Fuzzy Hash: 50118E71E002299BCF54DB6AD8805DEF7B5FFC9310F11956AE50AEB200DA31D944CB90

Function 06D63BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a88e06d62d6f3c67fd698b6aeea77c21b4ede9d7df4eb02942f23e86f798e3
Instruction ID: 785c04644bdb889fc25bfe0ec38b7975fa092d2008bd27ba08a4f8d0bf1b2426
Opcode Fuzzy Hash: 92a88e06d62d6f3c67fd698b6aeea77c21b4ede9d7df4eb02942f23e86f798e3
Instruction Fuzzy Hash: 2E116135B145298FDB949B69D8146AE7BBAEBC8350F018539E80BE7340EE35DC028BD1

Function 06D6420B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f75e3ca745c31590e1bbf15abab2c12fe172c50040841cee6fc6e75f17f81d
Instruction ID: b2d0ef93a2f5d451c6676478e1a81b8686794d768ae538e4be0cdd1b594f63e1
Opcode Fuzzy Hash: 11f75e3ca745c31590e1bbf15abab2c12fe172c50040841cee6fc6e75f17f81d
Instruction Fuzzy Hash: 37018B31B101210BDBA096AED454B2FB7EAEBC9A50F20883AF50AD7344ED25DC424391

Function 06D64210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52475d884dfd1706ff7c384e22cfdd2f9dd1cae68e57402ac266e794a3d39c22
Instruction ID: 37cd4e4b66a15f934468973b6fd9227d2e479f44e6b81c92b8b21db41f8e869f
Opcode Fuzzy Hash: 52475d884dfd1706ff7c384e22cfdd2f9dd1cae68e57402ac266e794a3d39c22
Instruction Fuzzy Hash: E6014B31B101214BDBA496AE9454B2FB7DAEBC9A50F20843AF50AD7344ED65DC424391

Function 06D66D0B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec63ed4181b28f03a7476d0a5a0d639a51e9b61a12745aeaaa18c84be7d6e2e6
Instruction ID: 4f80d2667139ec9f2beb08af781d2f08104ac9942fd50a7a7dfa4224e4bc279e
Opcode Fuzzy Hash: ec63ed4181b28f03a7476d0a5a0d639a51e9b61a12745aeaaa18c84be7d6e2e6
Instruction Fuzzy Hash: 3A11C430B001498FDF94EB6AE95479DB7B2EF84364F258468E805EB281D736ED418B80

Function 06D63BB7 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f398497bdd3a40dbb59bc11231a6f0a1e12ec0247f1244594b0ea076ed71610c
Instruction ID: 751c46070aa56f609409a4f1b072e0914b48ad2ee85e1ed5a4de9cf780ebbb83
Opcode Fuzzy Hash: f398497bdd3a40dbb59bc11231a6f0a1e12ec0247f1244594b0ea076ed71610c
Instruction Fuzzy Hash: 6501A232B100288BDB948669EC147EF37AADBC8350F01413AE40AE3280EE25CC0247D1

Function 06D6A313 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa90621a0fd88f7a4d30fa9baf5879d91c6ccad1abbd2ce439776a480b9e9f25
Instruction ID: 20d4777d55c9835c408fe6131a1797d10b81424468d10a018240f03f9ae48814
Opcode Fuzzy Hash: aa90621a0fd88f7a4d30fa9baf5879d91c6ccad1abbd2ce439776a480b9e9f25
Instruction Fuzzy Hash: F001A231B101154BDB50DBB9E85572EB7E5EB8A654F144839F54AE7380EA19DC018781

Function 06D6EDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7ada15f853555da63e548293d8066c0acca525266bc1de5b5d9f7f7605c205
Instruction ID: 47f0b1a084f523c1acad4a8a2509538b5c69d4e8fd490b91348fa45052bb9a3c
Opcode Fuzzy Hash: 3f7ada15f853555da63e548293d8066c0acca525266bc1de5b5d9f7f7605c205
Instruction Fuzzy Hash: BE01AF35B141118BDBA5DA7EA45472FB7DAEBC9A21F10883AF50EC7341EE66DC0247C1

Function 06D6EDA7 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a59b3c07c5c48491531869efcf5ec625d340561f9707d639d375a3c165f24a4
Instruction ID: d6c6a434897b56dce5cc938916a4668dbd1214c6ecc3ebbd0ff435ff87484d99
Opcode Fuzzy Hash: 9a59b3c07c5c48491531869efcf5ec625d340561f9707d639d375a3c165f24a4
Instruction Fuzzy Hash: 6701FF39F140118BDBA1DABDA45472EB3D6EBC9611F10883AF10ED7340EE65DC024781

Function 06D6A320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab2ecbec3c0d829b22a212f6279636fa87a5a51b38091c1123fbcea1d5be33a
Instruction ID: 3214861e9c0ee9fbbb8692c1798919c62780924f4bb6dfbe9ef29583c1a19a27
Opcode Fuzzy Hash: dab2ecbec3c0d829b22a212f6279636fa87a5a51b38091c1123fbcea1d5be33a
Instruction Fuzzy Hash: D7018130B101158BDB90DBBDE45472E77E5EBCA650F148839F54AE7390EA29DC018781

Function 06D682D0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a203f6a78a003c9eb163bf10e48573265b45ac659b23820fc1287f74d4e679
Instruction ID: 7e1033c04359201dac04e0e22497caa8060b107055dd3b2eb56e05ba8085b971
Opcode Fuzzy Hash: 32a203f6a78a003c9eb163bf10e48573265b45ac659b23820fc1287f74d4e679
Instruction Fuzzy Hash: 50F0AF31B00215DFEFA49F9AE99066CB3B5EB84350F144076F905DB254D739DE02E7A1

Function 06D6C7D3 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e1ad7522b1dc6fa146936418377b9615e2d0ad4fc837d91c4beca73becc45c
Instruction ID: 48a48d1351d549d453c4d33b63ccc70df10fee40fa83c032b0d6a02a00d3bd22
Opcode Fuzzy Hash: 31e1ad7522b1dc6fa146936418377b9615e2d0ad4fc837d91c4beca73becc45c
Instruction Fuzzy Hash: 07F08232E20224A7DB546A66EC45A9AB73AF794259F004536E941F7240D675A80487D0

Function 06D66470 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133edd55a213054e9c96f3a543676fec48c7d98a442a47e177529e28ea66ff55
Instruction ID: 2dc0864692e2ef3e868b573a7ea718929c51ba5a5a7cfe631cef8098196aed64
Opcode Fuzzy Hash: 133edd55a213054e9c96f3a543676fec48c7d98a442a47e177529e28ea66ff55
Instruction Fuzzy Hash: 54E0D871E182886FEF50CFB1CD6274A7BACD705205F1148A5E804C7142E176EE058351

Function 06D66480 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3901465771.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6d60000_ship's particulars-TBN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: e35a5086820582aef4aca4646458d5a5ba7a4bf1abdccf2e64b5a022044d9c37
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: CAE02B70E1410CABDF50CFB2CA5575F73ADD705214F2089A4F408C7201E1B3EE018391

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ship's particulars-TBN.pdf.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ship's particulars-TBN.pdf.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wdfubv3.lum.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arfndbq2.hui.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
ship's particulars-TBN.pdf.scr.exe

Function 06C60040 Relevance: 2.3, Strings: 1, Instructions: 1022
COMMON

Function 06C6F2F8 Relevance: 3.1, APIs: 2, Instructions: 82
memorythreadCOMMON

Function 06C6F63C Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 06C6F648 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 009BAEB7 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 009B590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 009B44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 06C6F3B9 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 06C6F3C0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 06C6F4A8 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Function 06C6F220 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 009BBC40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 009BD7A9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 06C6F4B0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 06C6F228 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre