Edit tour
Windows
Analysis Report
_____.exe
Overview
General Information
| Sample name: | _____.exe |
| Analysis ID: | 1580627 |
| MD5: | b620f1561ef43fdc7132375a63dd3e8d |
| SHA1: | 097594e519e510a5e7b69e2f8d367cc97c01c7e6 |
| SHA256: | 424e8d889288010e58a66fa8c9008c22cef78dced0e46b59ee417cc9e746c23f |
| Tags: | exeuser-zhuzhu0009 |
| Infos: |  |
 | |
Detection
DarkComet
| Score: | 92 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected DarkComet
AI detected suspicious sample
Installs a global keyboard hook
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enables debug privileges
Enables driver privileges
Enables security privileges
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
_____.exe (PID: 6156 cmdline: "C:\Users\ user\Deskt op\_____.e xe" MD5: B620F1561EF43FDC7132375A63DD3E8D)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| DarkComet | DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008. After being used in the Syrian civil war in 2011, Lesuer decided to stop developing the trojan. Indeed, DarkComet is able to enable control over a compromised system through use of a simple graphic user interface. Experts think that this user friendliness is the key of its mass success. |
{"MUTEX": "DC_MUTEX-5VE3E85", "SID": "Guest16", "FWB": "0", "NETDATA": ["king-hit.gl.at.ply.gg:25737"], "GENCODE": "rcJPlzKijYD9", "OFFLINEK": "1"}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security | ||
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_DarkCometRat | Yara detected DarkComet | Kevin Breen <kevin@techanarchy.net> | ||
| Windows_Trojan_Darkcomet_1df27bcc | unknown | unknown |
| |
| RAT_DarkComet | Detects DarkComet RAT | Kevin Breen <kevin@techanarchy.net> |
| |
| Click to see the 4 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security | ||
| DarkComet_2 | DarkComet | Jean-Philippe Teissier / @Jipe_ |
| |
| DarkComet_2 | DarkComet | Jean-Philippe Teissier / @Jipe_ |
| |
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_DarkCometRat | Yara detected DarkComet | Kevin Breen <kevin@techanarchy.net> | ||
| Click to see the 13 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security | ||
| JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security | ||
| JoeSecurity_DarkCometRat | Yara detected DarkComet | Kevin Breen <kevin@techanarchy.net> | ||
| Windows_Trojan_Darkcomet_1df27bcc | unknown | unknown |
| |
| RAT_DarkComet | Detects DarkComet RAT | Kevin Breen <kevin@techanarchy.net> |
| |
| Click to see the 4 entries | ||||
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | TCP traffic: | ||
| Source: | IP Address: | ||
| Source: | ASN Name: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | DNS traffic detected: | ||
Key, Mouse, Clipboard, Microphone and Screen Capturing | |
|---|
| Source: | Windows user hook set: | Jump to behavior | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_02AFD3B5 | |
| Source: | Code function: | 0_2_02AFD3BD | |
| Source: | Code function: | 0_2_02AFCFC9 | |
| Source: | Code function: | 0_2_02AFE315 | |
| Source: | Code function: | 0_2_02AFD2E1 | |
| Source: | Code function: | 0_2_02AFD3CD | |
| Source: | Code function: | 0_2_02AFD2D9 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 LSASS Driver | 1 Process Injection | 1 Masquerading | 11 Input Capture | 1 Security Software Discovery | Remote Services | 11 Input Capture | 1 Non-Standard Port | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | 1 DLL Side-Loading | 1 LSASS Driver | 1 Process Injection | LSASS Memory | 1 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Non-Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Obfuscated Files or Information | Security Account Manager | 1 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 1 Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | 11 System Information Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 93% | Virustotal | Browse | ||
| 100% | Avira | BDS/DarkKomet.GS | ||
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| king-hit.gl.at.ply.gg | 147.185.221.23 | true | true | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 147.185.221.23 | king-hit.gl.at.ply.gg | United States | 12087 | SALSGIVERUS | true |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1580627 |
| Start date and time: | 2024-12-25 13:14:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 3m 46s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 4 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | _____.exe |
| Detection: | MAL |
| Classification: | mal92.troj.spyw.winEXE@1/0@1/1 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target _____.exe, PID 6156 because there are no executed function
- Report size getting too big, too many NtQueryValueKey calls found.
⊘No simulations
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 147.185.221.23 | Get hash | malicious | Metasploit | Browse | ||
| Get hash | malicious | Metasploit | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | S400 RAT | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | SheetRat | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | XWorm | Browse | |||
| Get hash | malicious | Blank Grabber, Skuld Stealer, XWorm | Browse |
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| SALSGIVERUS | Get hash | malicious | DarkComet | Browse |
| |
| Get hash | malicious | Njrat | Browse |
| ||
| Get hash | malicious | Metasploit | Browse |
| ||
| Get hash | malicious | Metasploit | Browse |
| ||
| Get hash | malicious | Mirai | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | XWorm | Browse |
| ||
| Get hash | malicious | AsyncRAT, XWorm | Browse |
|
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 6.616970366410712 |
| TrID: |
|
| File name: | _____.exe |
| File size: | 673'792 bytes |
| MD5: | b620f1561ef43fdc7132375a63dd3e8d |
| SHA1: | 097594e519e510a5e7b69e2f8d367cc97c01c7e6 |
| SHA256: | 424e8d889288010e58a66fa8c9008c22cef78dced0e46b59ee417cc9e746c23f |
| SHA512: | 186e292d6b142660930f93522ab37f70b3aefd3d8c594141de2912ddba4208b390d4e69da3478f8a470e546fc9cdeca3551971affb96a855eb382d40c0f0401f |
| SSDEEP: | 12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h1:uZ1xuVVjfFoynPaVBUR8f+kN10EBX |
| TLSH: | 0EE48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7 |
| File Content Preview: | MZP.....................@...............................................!..L.!..This program must be run under Win32..$7....................................................................................................................................... |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x48f888 |
| Entrypoint Section: | .itext |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI |
| DLL Characteristics: | |
| Time Stamp: | 0x4FD0CFF9 [Thu Jun 7 15:59:53 2012 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | e5b4359a3773764a372173074ae9b6bd |
| Instruction |
|---|
| push ebp |
| mov ebp, esp |
| mov ecx, 00000030h |
| push 00000000h |
| push 00000000h |
| dec ecx |
| jne 00007F44E153E78Bh |
| push ecx |
| push ebx |
| push esi |
| push edi |
| mov eax, 0048E3E0h |
| call 00007F44E14B65C4h |
| xor eax, eax |
| push ebp |
| push 00490656h |
| push dword ptr fs:[eax] |
| mov dword ptr fs:[eax], esp |
| push 00000000h |
| call 00007F44E14BEEBFh |
| mov eax, dword ptr [004948B0h] |
| mov byte ptr [eax], 00000001h |
| call 00007F44E1539EB6h |
| mov dl, 01h |
| mov eax, dword ptr [0048DE80h] |
| call 00007F44E153CDAEh |
| mov dword ptr [0049C3E8h], eax |
| xor edx, edx |
| push ebp |
| push 0048FA09h |
| push dword ptr fs:[edx] |
| mov dword ptr fs:[edx], esp |
| lea ecx, dword ptr [ebp-14h] |
| mov edx, 00490670h |
| mov eax, dword ptr [0049C3E8h] |
| call 00007F44E153CDFDh |
| mov edx, dword ptr [ebp-14h] |
| mov eax, dword ptr [00494B38h] |
| call 00007F44E14B4414h |
| lea edx, dword ptr [ebp-20h] |
| xor eax, eax |
| call 00007F44E14BE0BAh |
| mov eax, dword ptr [ebp-20h] |
| lea edx, dword ptr [ebp-1Ch] |
| call 00007F44E14B941Bh |
| push dword ptr [ebp-1Ch] |
| lea edx, dword ptr [ebp-24h] |
| mov eax, 00490680h |
| call 00007F44E1522453h |
| push dword ptr [ebp-24h] |
| push 00490690h |
| lea eax, dword ptr [ebp-18h] |
| mov edx, 00000003h |
| call 00007F44E14B4736h |
| mov eax, dword ptr [ebp-18h] |
| call 00007F44E14B90BAh |
| test al, al |
| je 00007F44E153E838h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x9d000 | 0x4140 | .idata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0xad000 | 0x4188 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0xa4000 | 0x8adc | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0xa3000 | 0x18 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x9dca4 | 0x9e8 | .idata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x8d8f0 | 0x8da00 | 8067456c5dc713997e61924c501c8cb2 | False | 0.514571726059135 | data | 6.553417346138988 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .itext | 0x8f000 | 0x1954 | 0x1a00 | 3f63b5c2974302201afb8afa01b8ac10 | False | 0.5345552884615384 | data | 5.953748187744434 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .data | 0x91000 | 0x3d3c | 0x3e00 | 81fa247370ecc3476b5c17086c0f2024 | False | 0.42357610887096775 | data | 4.834870765212306 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .bss | 0x95000 | 0x7404 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .idata | 0x9d000 | 0x4140 | 0x4200 | cd30ca2b6ff5111155dec94ee29ec186 | False | 0.3171756628787879 | data | 5.268136117677001 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .tls | 0xa2000 | 0x38 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rdata | 0xa3000 | 0x18 | 0x200 | c1788dfeb92bbf0cff5aeaeaf1270ff8 | False | 0.05078125 | MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J" | 0.2108262677871819 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0xa4000 | 0x8adc | 0x8c00 | e55564594dad16a2ca19fb85903b9300 | False | 0.6743024553571428 | data | 6.725005245595376 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| .rsrc | 0xad000 | 0x4188 | 0x4200 | f1e0ba01d3bce7333b73bde2aa0327fb | False | 0.3484256628787879 | data | 4.233015672100186 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_CURSOR | 0xad6bc | 0x134 | Targa image data - Map 64 x 65536 x 1 +32 "\001" | English | United States | 0.38636363636363635 |
| RT_CURSOR | 0xad7f0 | 0x134 | data | English | United States | 0.4642857142857143 |
| RT_CURSOR | 0xad924 | 0x134 | data | English | United States | 0.4805194805194805 |
| RT_CURSOR | 0xada58 | 0x134 | data | English | United States | 0.38311688311688313 |
| RT_CURSOR | 0xadb8c | 0x134 | data | English | United States | 0.36038961038961037 |
| RT_CURSOR | 0xadcc0 | 0x134 | data | English | United States | 0.4090909090909091 |
| RT_CURSOR | 0xaddf4 | 0x134 | Targa image data - RGB 64 x 65536 x 1 +32 "\001" | English | United States | 0.4967532467532468 |
| RT_STRING | 0xadf28 | 0x20c | data | 0.42366412213740456 | ||
| RT_STRING | 0xae134 | 0x3fc | data | 0.4 | ||
| RT_STRING | 0xae530 | 0xa8 | data | 0.7202380952380952 | ||
| RT_STRING | 0xae5d8 | 0x140 | data | 0.584375 | ||
| RT_STRING | 0xae718 | 0x478 | data | 0.38636363636363635 | ||
| RT_STRING | 0xaeb90 | 0x330 | data | 0.41421568627450983 | ||
| RT_STRING | 0xaeec0 | 0x36c | data | 0.3687214611872146 | ||
| RT_STRING | 0xaf22c | 0x3f0 | data | 0.3898809523809524 | ||
| RT_STRING | 0xaf61c | 0xcc | data | 0.5392156862745098 | ||
| RT_STRING | 0xaf6e8 | 0xb0 | data | 0.6534090909090909 | ||
| RT_STRING | 0xaf798 | 0x2ac | data | 0.4766081871345029 | ||
| RT_STRING | 0xafa44 | 0x3b8 | data | 0.32668067226890757 | ||
| RT_STRING | 0xafdfc | 0x354 | data | 0.3884976525821596 | ||
| RT_STRING | 0xb0150 | 0x2f0 | data | 0.3829787234042553 | ||
| RT_RCDATA | 0xb0440 | 0x15e | ASCII text, with very long lines (350), with no line terminators | 0.5914285714285714 | ||
| RT_RCDATA | 0xb05a0 | 0x10 | data | 1.5 | ||
| RT_RCDATA | 0xb05b0 | 0x7f4 | data | 0.6360510805500982 | ||
| RT_GROUP_CURSOR | 0xb0da4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.25 |
| RT_GROUP_CURSOR | 0xb0db8 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.25 |
| RT_GROUP_CURSOR | 0xb0dcc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.3 |
| RT_GROUP_CURSOR | 0xb0de0 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.3 |
| RT_GROUP_CURSOR | 0xb0df4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.3 |
| RT_GROUP_CURSOR | 0xb0e08 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.3 |
| RT_GROUP_CURSOR | 0xb0e1c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States | 1.3 |
| RT_VERSION | 0xb0e30 | 0x358 | data | French | France | 0.42406542056074764 |
| DLL | Import |
|---|---|
| oleaut32.dll | SysFreeString, SysReAllocStringLen, SysAllocStringLen |
| advapi32.dll | RegQueryValueExA, RegOpenKeyExA, RegCloseKey |
| user32.dll | GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA |
| kernel32.dll | GetACP, Sleep, VirtualFree, VirtualAlloc, GetTickCount, QueryPerformanceCounter, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, CompareStringA, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle |
| kernel32.dll | TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA |
| user32.dll | CreateWindowExA, mouse_event, keybd_event, WindowFromPoint, WaitMessage, VkKeyScanA, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAscii, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LockWorkStation, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsClipboardFormatAvailable, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMessageA, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastInputInfo, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowExA, FindWindowA, FillRect, ExitWindowsEx, EqualRect, EnumWindows, EnumThreadWindows, EnumDisplayDevicesA, EnumClipboardFormats, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout |
| gdi32.dll | UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateDCA, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt |
| version.dll | VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA |
| kernel32.dll | lstrcpyA, WriteProcessMemory, WriteFile, WinExec, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQuery, VirtualProtectEx, VirtualProtect, VirtualFreeEx, VirtualFree, VirtualAllocEx, VirtualAlloc, VerLanguageNameA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetThreadContext, SetLastError, SetFileTime, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, ReadProcessMemory, ReadFile, PeekNamedPipe, OpenProcess, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LocalFileTimeToFileTime, LocalAlloc, LoadResource, LoadLibraryA, LeaveCriticalSection, IsBadReadPtr, InitializeCriticalSection, HeapFree, HeapAlloc, GlobalUnlock, GlobalMemoryStatus, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetWindowsDirectoryA, GetVolumeInformationA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetTickCount, GetThreadLocale, GetThreadContext, GetTempPathA, GetSystemPowerStatus, GetSystemDirectoryA, GetStdHandle, GetProcessHeap, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileTime, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetExitCodeProcess, GetEnvironmentVariableA, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitThread, ExitProcess, EnumResourceNamesA, EnumCalendarInfoA, EnterCriticalSection, DosDateTimeToFileTime, DeleteFileA, DeleteCriticalSection, CreateThread, CreateRemoteThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, Beep |
| advapi32.dll | RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegOpenKeyA, RegFlushKey, RegEnumValueA, RegEnumKeyExA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegCreateKeyA, RegCloseKey, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueA, LookupPrivilegeNameA, LookupPrivilegeDisplayNameA, LookupAccountSidA, IsValidSid, GetUserNameA, GetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, GetSidIdentifierAuthority, GetCurrentHwProfileA, AdjustTokenPrivileges |
| wsock32.dll | __WSAFDIsSet, WSACleanup, WSAStartup, WSAGetLastError, gethostname, getservbyname, gethostbyname, gethostbyaddr, socket, shutdown, sendto, send, select, recv, ntohs, listen, ioctlsocket, inet_ntoa, inet_addr, htons, getsockname, connect, closesocket, bind, accept |
| kernel32.dll | Sleep |
| ole32.dll | CoTaskMemFree, StringFromCLSID |
| shell32.dll | ShellExecuteExA, ShellExecuteA, SHGetFileInfoA, SHFileOperationA, DragQueryFileA |
| oleaut32.dll | GetErrorInfo, GetActiveObject, SysFreeString |
| ole32.dll | CoTaskMemFree, CLSIDFromProgID, ProgIDFromCLSID, StringFromCLSID, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID |
| URLMON.DLL | URLDownloadToFileA |
| oleaut32.dll | SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit |
| comctl32.dll | _TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create |
| wininet.dll | InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetConnectA, InternetCloseHandle, HttpQueryInfoA, FtpPutFileA |
| shell32.dll | SHGetSpecialFolderLocation, SHGetPathFromIDListA |
| winmm.dll | waveInUnprepareHeader, waveInStart, waveInReset, waveInPrepareHeader, waveInOpen, waveInClose, waveInAddBuffer, PlaySoundA, mciSendStringA |
| netapi32.dll | Netbios |
| gdiplus.dll | GdipGetImageEncoders, GdipGetImageEncodersSize, GdipDrawImageRectI, GdipSetInterpolationMode, GdipDeleteGraphics, GdipCreateBitmapFromHBITMAP, GdipCreateBitmapFromScan0, GdipGetImagePixelFormat, GdipGetImageGraphicsContext, GdipSaveImageToStream, GdipDisposeImage, GdiplusShutdown, GdiplusStartup, GdipFree, GdipAlloc |
| advapi32.dll | StartServiceA, QueryServiceStatus, OpenServiceA, OpenSCManagerA, EnumServicesStatusA, DeleteService, CreateServiceA, ControlService, CloseServiceHandle |
| msacm32.dll | acmStreamUnprepareHeader, acmStreamPrepareHeader, acmStreamConvert, acmStreamReset, acmStreamSize, acmStreamClose, acmStreamOpen |
| ntdll.dll | NtQuerySystemInformation |
| netapi32.dll | NetApiBufferFree, NetShareGetInfo, NetShareEnum |
| WS2_32.DLL | WSAIoctl |
| SHFolder.dll | SHGetFolderPathA |
| ntdll | NtUnmapViewOfSection |
| user32.dll | EnumDisplayMonitors, GetMonitorInfoA |
| SHELL32.DLL | SHEmptyRecycleBinA |
| AVICAP32.DLL | capGetDriverDescriptionA |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
| French | France |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 25, 2024 13:14:58.571346045 CET | 49704 | 25737 | 192.168.2.5 | 147.185.221.23 |
| Dec 25, 2024 13:14:58.691056013 CET | 25737 | 49704 | 147.185.221.23 | 192.168.2.5 |
| Dec 25, 2024 13:14:58.691185951 CET | 49704 | 25737 | 192.168.2.5 | 147.185.221.23 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 25, 2024 13:14:58.326690912 CET | 62199 | 53 | 192.168.2.5 | 1.1.1.1 |
| Dec 25, 2024 13:14:58.568438053 CET | 53 | 62199 | 1.1.1.1 | 192.168.2.5 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 25, 2024 13:14:58.326690912 CET | 192.168.2.5 | 1.1.1.1 | 0xbfae | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 25, 2024 13:14:58.568438053 CET | 1.1.1.1 | 192.168.2.5 | 0xbfae | No error (0) | 147.185.221.23 | A (IP address) | IN (0x0001) | false |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 07:14:56 |
| Start date: | 25/12/2024 |
| Path: | C:\Users\user\Desktop\_____.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 673'792 bytes |
| MD5 hash: | B620F1561EF43FDC7132375A63DD3E8D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Borland Delphi |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
⊘No disassembly