Windows Analysis Report
Login_msifar.txt.exe

Overview

General Information

Sample name: Login_msifar.txt.exe
Analysis ID: 1580459
MD5: 13dd101017041158be942e586719cdf1
SHA1: d917ed7a07cc1ffabd5dfb65f975dc0eedd1bdb0
SHA256: 2d1c88afa341777d212d56763f07c87c3b06e14fc15bf88792e6f906d79a2e9e
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: Suspicious Double Extension File Execution
AI detected suspicious sample
Contains functionality to register a low level keyboard hook
Sample or dropped binary is a compiled AutoHotkey binary
Uses an obfuscated file name to hide its real file extension (double extension)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
Potential key logger detected (key state polling based)
Program does not show much activity (idle)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 94.0% probability
Uses 32bit PE files
Source: Login_msifar.txt.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00482870 FindFirstFileW,FindFirstFileW,FindClose,FindFirstFileW,FindFirstFileW,FindClose, 0_2_00482870
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00458060 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,CopyFileW,GetLastError,FindNextFileW,FindClose, 0_2_00458060
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421100 FindFirstFileW,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetTickCount,FindNextFileW,FindClose, 0_2_00421100
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004213A0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime, 0_2_004213A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421700 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose, 0_2_00421700
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421850 GetFileAttributesW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,FindClose, 0_2_00421850
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004ADB1B FindFirstFileExW, 0_2_004ADB1B
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044AC00 FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose, 0_2_0044AC00
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004570C0 InternetOpenW,InternetOpenUrlW,InternetOpenUrlW,GetLastError,InternetOpenUrlW,GetLastError,InternetCloseHandle,CreateFileW,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,WriteFile,InternetReadFile,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CloseHandle,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CloseHandle,InternetReadFileExA,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,WriteFile,InternetReadFileExA,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CloseHandle,DeleteFileW, 0_2_004570C0
Source: Login_msifar.txt.exe String found in binary or memory: https://autohotkey.com
Source: Login_msifar.txt.exe String found in binary or memory: https://autohotkey.comCould

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00413060 SetWindowsHookExW 0000000D,Function_0000E970,00000000 0_2_00413060
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00406D40 IsClipboardFormatAvailable,GetTickCount,GetTickCount,OpenClipboard,OpenClipboard,GetTickCount,OpenClipboard, 0_2_00406D40
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004067A0 GlobalAlloc,GlobalLock,GlobalFree,EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard, 0_2_004067A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00484C60 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard, 0_2_00484C60
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00406C20 IsClipboardFormatAvailable,GetClipboardFormatNameW,GetClipboardData, 0_2_00406C20
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004281B0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDC,GetLastError,DestroyIcon,DeleteObject,CreateCompatibleDC,GetIconInfo,DeleteObject,DeleteObject,DeleteObject,GetDC,CreateCompatibleDC,GetIconInfo,GetObjectW,CreateCompatibleBitmap,SelectObject,CreateSolidBrush,FillRect,DeleteObject,DrawIconEx,SelectObject,DeleteObject,DeleteObject,DeleteDC,ReleaseDC,DestroyIcon,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetLastError,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject, 0_2_004281B0
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041C240 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount, 0_2_0041C240
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004191D8 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004191D8
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004191EC GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004191EC
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00418248 CloseHandle,CloseHandle,CreateMutexW,GetLastError,GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,SendMessageTimeoutW,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,PostMessageW,PostMessageW,GetTickCount,PeekMessageW,GetTickCount,PostMessageW,PostMessageW,PostMessageW,PostMessageW,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetForegroundWindow,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount,GetForegroundWindow,GetWindowThreadProcessId, 0_2_00418248
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041828D CloseHandle,CloseHandle,CreateMutexW,GetLastError,GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_0041828D
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00418296 CloseHandle,CloseHandle,CreateMutexW,GetLastError,GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_00418296
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041829F CloseHandle,CloseHandle,CreateMutexW,GetLastError,GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_0041829F
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004182A8 CloseHandle,CloseHandle,CreateMutexW,GetLastError,GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004182A8
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00418356 GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_00418356
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004183BF GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,AttachThreadInput,GetKeyboardLayout,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004183BF
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00418495 GetTickCount,GetCurrentThreadId,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetKeyboardLayout,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,__alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_00418495
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004186B2 __alloca_probe_16,BlockInput,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004186B2
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00450960 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetWindowThreadProcessId,GetKeyState, 0_2_00450960

System Summary
barindex
Sample or dropped binary is a compiled AutoHotkey binary
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Window found: window name: AutoHotkey Jump to behavior
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041F62A: GetDriveTypeW,GetDriveTypeW,CreateFileW,DeviceIoControl,CloseHandle, 0_2_0041F62A
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044D360 GetFileAttributesW,__alloca_probe_16,__alloca_probe_16,__alloca_probe_16,CreateProcessWithLogonW,GetLastError,CreateProcessW,CloseHandle,CloseHandle,GetLastError,__alloca_probe_16,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,CloseHandle,CloseHandle,SetCurrentDirectoryW,GetLastError,FormatMessageW, 0_2_0044D360
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004585C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_004585C0
Detected potential crypto function
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B6062 0_2_004B6062
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0043D0A0 0_2_0043D0A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0045D170 0_2_0045D170
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0048B100 0_2_0048B100
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00481110 0_2_00481110
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004271F0 0_2_004271F0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004281B0 0_2_004281B0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00418248 0_2_00418248
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0042B274 0_2_0042B274
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004A2344 0_2_004A2344
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0042D320 0_2_0042D320
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B03F6 0_2_004B03F6
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004415F0 0_2_004415F0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00465640 0_2_00465640
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00401623 0_2_00401623
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0048B6DE 0_2_0048B6DE
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0048E6AC 0_2_0048E6AC
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00425700 0_2_00425700
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0047D7A0 0_2_0047D7A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004698E0 0_2_004698E0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004A69CE 0_2_004A69CE
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004A8A00 0_2_004A8A00
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00454AD0 0_2_00454AD0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0042BAE0 0_2_0042BAE0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00427BC0 0_2_00427BC0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00499B90 0_2_00499B90
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0043EBB0 0_2_0043EBB0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0040EC50 0_2_0040EC50
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B4C6A 0_2_004B4C6A
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0045FC20 0_2_0045FC20
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00411D80 0_2_00411D80
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00423E00 0_2_00423E00
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004A1FE5 0_2_004A1FE5
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B5FA8 0_2_004B5FA8
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0049BFA0 appears 34 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0049CA21 appears 32 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0040E150 appears 40 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 004B57A0 appears 35 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0049EE91 appears 159 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0040C830 appears 102 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0049F012 appears 48 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0040D460 appears 54 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 00481800 appears 37 times
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: String function: 0040D660 appears 65 times
PE file contains executable resources (Code or Archives)
Source: Login_msifar.txt.exe Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Uses 32bit PE files
Source: Login_msifar.txt.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal64.spyw.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044D360 GetFileAttributesW,__alloca_probe_16,__alloca_probe_16,__alloca_probe_16,CreateProcessWithLogonW,GetLastError,CreateProcessW,CloseHandle,CloseHandle,GetLastError,__alloca_probe_16,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,CloseHandle,CloseHandle,SetCurrentDirectoryW,GetLastError,FormatMessageW, 0_2_0044D360
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004585C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_004585C0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041F550 GetDiskFreeSpaceExW, 0_2_0041F550
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00458650 OpenProcess,GetProcessId,WaitForSingleObject,CloseHandle,GetLastError,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,CloseHandle, 0_2_00458650
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00450310 GetFileAttributesW,__alloca_probe_16,CoCreateInstance,SHCreateItemFromParsingName,PostMessageW,IsWindow,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree, 0_2_00450310
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004837A0 LoadLibraryExW,EnumResourceNamesW,FindResourceW,LoadResource,LockResource,GetSystemMetrics,FindResourceW,LoadResource,LockResource,SizeofResource,CreateIconFromResourceEx,FreeLibrary,ExtractIconW,ExtractIconW, 0_2_004837A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Command line argument: AutoHotkey 0_2_00404660
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Command line argument: AutoHotkey 0_2_00404660
Source: Login_msifar.txt.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Login_msifar.txt.exe String found in binary or memory: HG@Q@Can't open clipboard for reading.GlobalLockAn internal function call failed.Can't open clipboard for writing.EmptyClipboardSetClipboardDataLink SourceObjectLinkOwnerLinkNativeEmbed SourceMSDEVColumnSelectMSDEVLineSelectudptcp65535%ugetaddrinfogetnameinfofreeaddrinfo\ws2_32\wship6Auto-executerunstep_intostep_overstep_outbreakstopdetachstatusstack_getstack_depthcontext_getcontext_namesproperty_getproperty_setproperty_valuefeature_getfeature_setbreakpoint_setbreakpoint_getbreakpoint_updatebreakpoint_removebreakpoint_liststdoutstderrtypemap_getsourceexceptionerror -startingrunning<response command="status" status="%s" reason="ok" transaction_id="%e"/>language_supports_threads0nameAutoHotkeyversionencodingUTF-8protocol_versionsupports_async1breakpoint_typesline exceptionmultiple_sessionsmax_datamax_childrenmax_depth<response command="feature_get" feature_name="%e" supported="%i" transaction_id="%e">%s</response><response command="feature_set" feature="%e" success="%i" transaction_id="%e"/>enableddisabledAnyline<response command="breakpoint_set" transaction_id="%e" state="%s" id="%i"/><breakpoint id="%i" type="line" state="%s" filename="%r" lineno="%u"/><breakpoint id="%i" type="exception" state="%s" exception="Any"/><response command="breakpoint_get" transaction_id="%e"></response><response command="breakpoint_list" transaction_id="%e"><response command="stack_depth" depth="%i" transaction_id="%e"/><response command="stack_get" transaction_id="%e"><stack level="%i" type="file" filename="%r" lineno="%u" where="%e thread%e()"/><response command="context_names" transaction_id="%e"><context name="Local" id="0"/><context name="Global" id="1"/></response><response command="context_get" context="%i" transaction_id="%e"><response command="typemap_get" transaction_id="%e" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><map type="string" name="string" xsi:type="xsd:string"/><map type="int" name="integer" xsi:type="xsd:long"/><map type="float" name="float" xsi:type="xsd:double"/><map type="object" name="object"/></response>__Enumobject<enum> Alias Builtin Staticstringintegerfloatundefined<property name="%e" fullname="%e" type="%s" facet="%s" children="0" encoding="base64" size="</property>.%s%u">.[(<exception>Object(<base><enum><response command="property_get" transaction_id="%e"><response command="property_value" transaction_id="%e" encoding="base64" size="<response command="property_set" success="%i" transaction_id="%e"/><response command="source" success="1" transaction_id="%e" encoding="base64"><response command="source" success="0" transaction_id="%e"/><response command="%s" success="1" transaction_id="%e"/><stream type="%s"></stream><response command="%s" transaction_id="%e"><error code="%i"/></response><response command="%s" transaction_id="%e"/><response command="%s" status="%s" reason="%s" transaction_id="%e"/>An internal error has occurred in the debugger engine.
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Section loaded: wldp.dll Jump to behavior
Source: Login_msifar.txt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041E270 GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,WideCharToMultiByte,GetProcAddress,GetProcAddress,GetProcAddress,WideCharToMultiByte,GetModuleHandleW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_0041E270
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B5381 push ecx; ret 0_2_004B5394
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0047E750 push ecx; mov dword ptr [esp], ecx 0_2_0047E751
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004B5980 push eax; ret 0_2_004B599E

Hooking and other Techniques for Hiding and Protection
barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: txt.exe Static PE information: Login_msifar.txt.exe
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00469060 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowPos,IsWindow,SetParent,EnableWindow,IsWindowVisible,IsIconic,InvalidateRect, 0_2_00469060
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044F140 SendMessageW,IsWindowVisible,ShowWindow,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW, 0_2_0044F140
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00455440 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC, 0_2_00455440
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004704C0 SendMessageW,SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,SetFocus,SendMessageW,ShowWindow,SetFocus,InvalidateRect,InvalidateRect,InvalidateRect,MapWindowPoints,InvalidateRect, 0_2_004704C0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0046C5B0 IsZoomed,IsIconic,MulDiv,MulDiv,ShowWindow,MulDiv,MulDiv,MulDiv,IsIconic,GetWindowLongW,GetWindowRect,GetParent,GetWindowLongW,GetWindowRect,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowLongW,GetWindowRect,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,ScreenToClient,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,IsWindowVisible,GetAncestor,GetForegroundWindow,GetFocus,UpdateWindow,SetFocus, 0_2_0046C5B0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0046C5B0 IsZoomed,IsIconic,MulDiv,MulDiv,ShowWindow,MulDiv,MulDiv,MulDiv,IsIconic,GetWindowLongW,GetWindowRect,GetParent,GetWindowLongW,GetWindowRect,GetWindowRect,MapWindowPoints,GetWindowLongW,GetWindowLongW,GetWindowRect,GetWindowRect,GetClientRect,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,ScreenToClient,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,IsWindowVisible,GetAncestor,GetForegroundWindow,GetFocus,UpdateWindow,SetFocus, 0_2_0046C5B0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00465640 MulDiv,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,MulDiv,MulDiv,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,MapWindowPoints,GetPropW,SendMessageW,GetWindowLongW,SendMessageW,MoveWindow,SetWindowLongW,GetWindowRect,SetWindowTheme,InvalidateRect,CreateWindowExW,CreateWindowExW,DestroyWindow,CreateWindowExW,CreateWindowExW,CreateWindowExW,CreateWindowExW,MulDiv,MulDiv,SelectObject,ReleaseDC,SendMessageW,SendMessageW,SendMessageW,GetClientRect,SendMessageW,SendMessageW,SendMessageW,SetWindowPos,SetWindowPos,SetWindowPos, 0_2_00465640
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00485B00 GetWindowThreadProcessId,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,SendMessageTimeoutW,GetForegroundWindow,GetForegroundWindow,IsIconic,ShowWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,GetWindowThreadProcessId,GetModuleHandleW,GetProcAddress,SendMessageTimeoutW,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,GetForegroundWindow,GetWindow,SetForegroundWindow,GetForegroundWindow,GetWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,BringWindowToTop, 0_2_00485B00
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00482D40 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen, 0_2_00482D40
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00436D00 IsZoomed,IsIconic, 0_2_00436D00
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Window / User API: foregroundWindowGot 1023 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Login_msifar.txt.exe API coverage: 1.6 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041C900 GetKeyboardLayout followed by cmp: cmp cl, 00000019h and CTI: ja 0041CA11h country: Russian (ru) 0_2_0041C900
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00410C90 GetKeyboardLayout followed by cmp: cmp dword ptr [004ea8c4h], ebp and CTI: je 00410E7Fh 0_2_00410C90
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0042BAE0 GetLocalTime followed by cmp: cmp eax, 09h and CTI: jne 0042BC08h 0_2_0042BAE0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0042BAE0 GetLocalTime followed by cmp: cmp di, dx and CTI: je 0042BDA8h 0_2_0042BAE0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00482870 FindFirstFileW,FindFirstFileW,FindClose,FindFirstFileW,FindFirstFileW,FindClose, 0_2_00482870
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00458060 GetFullPathNameW,GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,GetTickCount,PeekMessageW,GetTickCount,MoveFileW,DeleteFileW,MoveFileW,CopyFileW,GetLastError,FindNextFileW,FindClose, 0_2_00458060
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421100 FindFirstFileW,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindFirstFileW,GetTickCount,GetTickCount,PeekMessageW,GetTickCount,GetTickCount,FindNextFileW,FindClose, 0_2_00421100
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004213A0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime, 0_2_004213A0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421700 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose, 0_2_00421700
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00421850 GetFileAttributesW,FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,FindClose, 0_2_00421850
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004ADB1B FindFirstFileExW, 0_2_004ADB1B
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044AC00 FindFirstFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose, 0_2_0044AC00
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004191D8 GetKeyState,GetKeyState,GetKeyState,GetForegroundWindow,GetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,AttachThreadInput,BlockInput,GetTickCount, 0_2_004191D8
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004AB58B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004AB58B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041E270 GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,GetModuleHandleW,WideCharToMultiByte,GetProcAddress,GetProcAddress,GetProcAddress,WideCharToMultiByte,GetModuleHandleW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_0041E270
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004AD930 GetProcessHeap, 0_2_004AD930
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0049C151 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0049C151
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004AB58B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004AB58B
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0049BD9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0049BD9E
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0049BF2B SetUnhandledExceptionFilter, 0_2_0049BF2B
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0044D360 GetFileAttributesW,__alloca_probe_16,__alloca_probe_16,__alloca_probe_16,CreateProcessWithLogonW,GetLastError,CreateProcessW,CloseHandle,CloseHandle,GetLastError,__alloca_probe_16,SetCurrentDirectoryW,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,SetCurrentDirectoryW,ShellExecuteExW,CloseHandle,CloseHandle,SetCurrentDirectoryW,GetLastError,FormatMessageW, 0_2_0044D360
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00419AF0 PeekMessageW,GetCurrentThreadId,MapVirtualKeyW,GetKeyboardState,SetKeyboardState,SetKeyboardState,SetKeyboardState,SetKeyboardState,SetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,GetForegroundWindow,GetWindowThreadProcessId,GetGUIThreadInfo,GetWindowThreadProcessId,GetKeyboardLayout,keybd_event,keybd_event, 0_2_00419AF0
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0041A7A0 GetSystemMetrics,mouse_event,mouse_event,mouse_event,mouse_event, 0_2_0041A7A0
Source: Login_msifar.txt.exe Binary or memory string: Program Manager
Source: Login_msifar.txt.exe Binary or memory string: Shell_TrayWnd
Source: Login_msifar.txt.exe Binary or memory string: WMahk_groupTarget window not found.PosTarget control not found.%uCountSelectedFocusedind+-^HwndShell_TrayWndRtlGetVersionntdll.dll%u.%u.%u%s: %s...%s[%Iu of %Iu]: %-1.60s%sMinHide<object>AltTabShiftAltTabAltTabMenuAltTabAndMenuAltTabMenuDismissAbsACosASinATanCaretGetPosCeilChrComCallComObjActiveComObjConnectComObjFlagsComObjFromPtrComObjGetComObjQueryComObjTypeComObjValueCosDllCallExpFileOpenFloorFormatFormatTimeGetMethodHasBaseHasMethodHasPropInStrIsAlnumIsAlphaIsDigitIsFloatIsIntegerIsLowerIsNumberIsObjectIsSetRefIsSpaceIsTimeIsUpperIsXDigitLnLogLTrimModNumGetNumPutObjAddRefObjBindMethodObjFromPtrObjFromPtrAddRefObjGetBaseObjGetCapacityObjHasOwnPropObjOwnPropCountObjOwnPropsObjPtrObjPtrAddRefObjReleaseObjSetBaseObjSetCapacityOrdRegCreateKeyRegDeleteRegDeleteKeyRegExMatchRegExReplaceRegReadRegWriteRoundRTrimRunWaitSinSoundGetInterfaceSoundGetMuteSoundGetNameSoundGetVolumeSoundSetMuteSoundSetVolumeSplitPathSqrtStrCompareStrGetStrLenStrLowerStrPtrStrPutStrReplaceStrTitleStrUpperSubStrTanTrimTypeVarSetStrCapacityVerCompareWinActiveWinExistAhkPathAhkVersionAllowMainWindowAppDataAppDataCommonClipboardComputerNameControlDelayCoordModeCaretCoordModeMenuCoordModeMouseCoordModePixelCoordModeToolTipCursorDDDDDDDDDDefaultMouseSpeedDesktopDesktopCommonEndCharEventInfoHotkeyIntervalHotkeyModifierTimeoutHourIconFileIconHiddenIconNumberIconTipIndexInitialWorkingDirIs64bitOSIsAdminIsCompiledIsCriticalIsPausedIsSuspendedKeyDelayKeyDelayPlayKeyDurationKeyDurationPlayLanguageLastErrorLineFileLineNumberLoopFieldLoopFileAttribLoopFileDirLoopFileExtLoopFileFullPathLoopFileNameLoopFilePathLoopFileShortNameLoopFileShortPathLoopFileSizeLoopFileSizeKBLoopFileSizeMBLoopFileTimeAccessedLoopFileTimeCreatedLoopFileTimeModifiedLoopReadLineLoopRegKeyLoopRegNameLoopRegTimeModifiedLoopRegTypeMaxHotkeysPerIntervalMDayMenuMaskKeyMMMonMouseDelayMouseDelayPlayMyDocumentsNowNowUTCOSVersionPriorHotkeyPriorKeyProgramFilesProgramsProgramsCommonPtrSizeRegViewScreenDPIScreenHeightScreenWidthScriptDirScriptFullPathScriptHwndScriptNameSecStartMenuStartMenuCommonStartupStartupCommonStoreCapsLockModeThisFuncThisHotkeyTickCountTimeIdleTimeIdleKeyboardTimeIdleMouseTimeIdlePhysicalTimeSincePriorHotkeyTimeSinceThisHotkeyTitleMatchModeTitleMatchModeSpeedTrayMenuUserNameWinDelayWinDirWorkingDirYearYYYY.ahk - %sRegClassCreateWindowConsolasHICON:"%s"notepad.exeCould not open script./include "%s" /restart /script "%s"Script file not found.%s
Source: Login_msifar.txt.exe Binary or memory string: 'Mmsctls_statusbar321No StatusBar.Press OK to continue.IsHungAppWindowahk_idpidProgram ManagerError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_0049BBBA cpuid 0_2_0049BBBA
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_004214F0 SystemTimeToFileTime,LocalFileTimeToFileTime,GetSystemTimeAsFileTime, 0_2_004214F0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00431820 GetComputerNameW,GetUserNameW, 0_2_00431820
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00401090 GetModuleHandleW,GetProcAddress,RtlGetVersion,GetVersionExW, 0_2_00401090
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00452AE0 AddClipboardFormatListener,RemoveClipboardFormatListener, 0_2_00452AE0
Source: C:\Users\user\Desktop\Login_msifar.txt.exe Code function: 0_2_00438B70 UnhookWindowsHookEx,UnregisterHotKey,Shell_NotifyIconW,RemoveClipboardFormatListener,OleFlushClipboard,DestroyWindow,DeleteObject,DestroyIcon,DestroyIcon,DestroyIcon,RemoveMenu,RemoveMenu,DestroyMenu,DeleteObject,IsWindow,IsWindow,DestroyWindow,mciSendStringW,mciSendStringW,mciSendStringW,DeleteCriticalSection,OleUninitialize, 0_2_00438B70
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1580459 Sample: Login_msifar.txt.exe Startdate: 24/12/2024 Architecture: WINDOWS Score: 64 8 Sigma detected: Suspicious Double Extension File Execution 2->8 10 Uses an obfuscated file name to hide its real file extension (double extension) 2->10 12 AI detected suspicious sample 2->12 5 Login_msifar.txt.exe 2->5         started        process3 signatures4 14 Contains functionality to register a low level keyboard hook 5->14 16 Sample or dropped binary is a compiled AutoHotkey binary 5->16
⊘No contacted IP infos