Edit tour

Windows Analysis Report
QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Overview

General Information

Sample name:	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Analysis ID:	1585887
MD5:	9b3c35a49dd56d6282a2a89832046ffc
SHA1:	0cb9124335747f5dd253744a828d5e30ca7d06f3
SHA256:	2234c3a3350dbeba11b7564dc52d5aa1252777f9ffe8dcf4027dcb54fc4542aa
Tags:	exeQuasarRATuser-TeamDreier
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Quasar RAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe (PID: 6648 cmdline: "C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe (PID: 4940 cmdline: "C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

schtasks.exe (PID: 7104 cmdline: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Exccelworkbook.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 6404 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 6696 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 6724 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

schtasks.exe (PID: 5324 cmdline: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Exccelworkbook.exe (PID: 3060 cmdline: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 5664 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 5016 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 6744 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 6696 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

Exccelworkbook.exe (PID: 1816 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 9B3C35A49DD56D6282A2A89832046FFC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;rency.ydns.eu:5287;wqo9.firewall-gateway.de:8841;code1.ydns.eu:5287;wqo9.firewall-gateway.de:9792;", "SubDirectory": "SubDir", "InstallName": "Exccelworkbook.exe", "MutexName": "025351e291-5d1041-4fa37-932c7-869aeiQec514992", "StartupKey": "pdfdocument", "Tag": "CODE", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 4940	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 6576	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 6576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 3060	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 3060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 6724	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.Exccelworkbook.exe.4299990.2.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.Exccelworkbook.exe.4299990.2.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
5.2.Exccelworkbook.exe.4299990.2.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
5.2.Exccelworkbook.exe.4299990.2.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
5.2.Exccelworkbook.exe.45b6fb0.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.Exccelworkbook.exe.45b6fb0.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
5.2.Exccelworkbook.exe.45b6fb0.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
5.2.Exccelworkbook.exe.45b6fb0.1.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
5.2.Exccelworkbook.exe.4299990.2.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.Exccelworkbook.exe.4299990.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.Exccelworkbook.exe.4299990.2.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x5ac4f8:$x1: Quasar.Common.Messages 0x5bc85b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x5c8e12:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ... 0x5ca607:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
5.2.Exccelworkbook.exe.4299990.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x5c83c4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x5c8404:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5c8446:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x5c8692:$b1: Chrome\User Data\ 0x5c86e8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x5c89c0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5c8abc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x61ab40:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x5c8c14:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x5c8cce:$b5: YandexBrowser\User Data\
5.2.Exccelworkbook.exe.4299990.2.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x482536:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x5c8efc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x5ac1f7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x596278:$s5: GetKeyloggerLogsDirectory 0x5bbfba:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x5ac21a:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x61c16e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 28 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe, ParentProcessId: 6724, ParentProcessName: Exccelworkbook.exe, ProcessCommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, ProcessId: 5324, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe", ParentImage: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, ParentProcessId: 4940, ParentProcessName: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, ProcessCommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, ProcessId: 7104, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T12:48:15.586054+0100	2035595	1	Domain Observed Used for C2 Detected	94.156.177.117	5287	192.168.2.4	49736	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T12:48:15.586054+0100	2027619	1	Domain Observed Used for C2 Detected	94.156.177.117	5287	192.168.2.4	49736	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;rency.ydns.eu:5287;wqo9.firewall-gateway.de:8841;code1.ydns.eu:5287;wqo9.firewall-gateway.de:9792;", "SubDirectory": "SubDir", "InstallName": "Exccelworkbook.exe", "MutexName": "025351e291-5d1041-4fa37-932c7-869aeiQec514992", "StartupKey": "pdfdocument", "Tag": "CODE", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Virustotal: Detection: 29%			Perma Link
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	ReversingLabs: Detection: 34%

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 4940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6724, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Joe Sandbox ML: detected

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: YgrU.pdb source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, Exccelworkbook.exe.2.dr
Source:	Binary string: YgrU.pdbSHA256 source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, Exccelworkbook.exe.2.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 94.156.177.117:5287 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 94.156.177.117:5287 -> 192.168.2.4:49736

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: twart.myfirewall.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 94.156.177.117:5287

Source: global traffic

TCP traffic: 192.168.2.4:63837 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: NET1-ASBG NET1-ASBG

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: twart.myfirewall.org
Source: global traffic	DNS traffic detected: DNS query: rency.ydns.eu
Source: global traffic	DNS traffic detected: DNS query: ipwho.is

Source: 77EC63BDA74BD0D0E0426DC8F8008506.9.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Exccelworkbook.exe, 00000009.00000002.4180585071.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabI
Source: Exccelworkbook.exe, 00000009.00000002.4180585071.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en2
Source: Exccelworkbook.exe, 00000009.00000002.4182925533.0000000003140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: Exccelworkbook.exe, 00000009.00000002.4182925533.0000000003140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: Exccelworkbook.exe, 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Exccelworkbook.exe, 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1787337073.0000000003461000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000009.00000002.4182925533.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Exccelworkbook.exe, 00000009.00000002.4182925533.000000000312E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000009.00000002.4182925533.000000000312E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000009.00000002.4182925533.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49738 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 4940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6724, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

.NET source code contains very large array initializations

Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, .cs	Large array initialization: : array initializer size 37142
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.5970000.1.raw.unpack, .cs	Large array initialization: : array initializer size 37142

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: initial sample	Static PE information: Filename: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_0121D5BC	0_2_0121D5BC
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_02C51560	0_2_02C51560
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_02C53330	0_2_02C53330
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_02C5155B	0_2_02C5155B
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 2_2_0185F03C	2_2_0185F03C
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 5_2_00C3D5BC	5_2_00C3D5BC
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 5_2_028C1560	5_2_028C1560
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 5_2_028C3430	5_2_028C3430
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 5_2_028C1550	5_2_028C1550
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0187D5BC	6_2_0187D5BC
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_051B1560	6_2_051B1560
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_051B1554	6_2_051B1554
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_051B3430	6_2_051B3430
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05746F40	6_2_05746F40
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0574782C	6_2_0574782C
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05740040	6_2_05740040
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05740007	6_2_05740007
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05746F1F	6_2_05746F1F
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07683698	6_2_07683698
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07684548	6_2_07684548
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07684210	6_2_07684210
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07680040	6_2_07680040
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07680F00	6_2_07680F00
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07686DE0	6_2_07686DE0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768D778	6_2_0768D778
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07685740	6_2_07685740
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768368A	6_2_0768368A
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768F690	6_2_0768F690
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07684538	6_2_07684538
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07685508	6_2_07685508
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_076854F8	6_2_076854F8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07684201	6_2_07684201
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_076832E0	6_2_076832E0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_076832D0	6_2_076832D0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07683070	6_2_07683070
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07680006	6_2_07680006
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07683080	6_2_07683080
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768DFE8	6_2_0768DFE8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768DFDB	6_2_0768DFDB
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07681E00	6_2_07681E00
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07680E10	6_2_07680E10
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07681E10	6_2_07681E10
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07686DD1	6_2_07686DD1
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07680D8A	6_2_07680D8A
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07682CC9	6_2_07682CC9
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_07682CD8	6_2_07682CD8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768DBB0	6_2_0768DBB0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_0768FAC8	6_2_0768FAC8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 9_2_0141F03C	9_2_0141F03C
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 16_2_0330F03C	16_2_0330F03C

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1760767787.0000000005970000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameFGMaker.dll2 vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFGMaker.dll2 vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000000.1706522041.0000000000ACC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYgrU.exeD vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Binary or memory string: OriginalFilenameYgrU.exeD vs QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1749530263.0000000001207000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: tional Typeface Corporation.slntyd"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@27/5@3/3

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2080:120:WilError_03
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\025351e291-5d1041-4fa37-932c7-869aeiQec514992

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Virustotal: Detection: 29%
Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

File read: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static file information: File size 3773952 > 1048576

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x398a00

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: YgrU.pdb source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, Exccelworkbook.exe.2.dr
Source:	Binary string: YgrU.pdbSHA256 source: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, Exccelworkbook.exe.2.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.5970000.1.raw.unpack, .cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_01214779 push esi; iretd	0_2_0121477A
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_0121477B push esi; iretd	0_2_01214782
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_012147B0 push esi; iretd	0_2_012147B2
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_01214658 push edx; iretd	0_2_0121465A
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_012146BB push edx; iretd	0_2_012146BE
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_012146BF push edx; iretd	0_2_012146C2
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_0121AC79 pushfd ; iretd	0_2_0121AC7A
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_0121AC7B pushfd ; iretd	0_2_0121AC82
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Code function: 0_2_01215F28 push esp; iretw	0_2_01216109
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 5_2_05027BB8 push eax; mov dword ptr [esp], ecx	5_2_05027BBC
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05827BB8 push eax; mov dword ptr [esp], ecx	6_2_05827BBC

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

File created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	File opened: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 3060, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 1210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 8F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 7820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 9F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: AF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: B690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: CA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: DA00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 1850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 3460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory allocated: 1AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 8660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 7000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 9660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: A660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: AA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 8660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 5190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 8D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 9D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 9F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: AF00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: B640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: C9B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: D9B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1960000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 3500000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1960000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Window / User API: threadDelayed 5694			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Window / User API: threadDelayed 3988			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe TID: 6724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe TID: 2364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 5664	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 6692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 3848	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 4584	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 1136	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477

Source: Exccelworkbook.exe, 00000009.00000002.4180585071.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Exccelworkbook.exe, 00000009.00000002.4199691518.00000000060FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Exccelworkbook.exe, 00000009.00000002.4199422613.00000000060D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~s~

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Memory written: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process created: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe "C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 4940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6724, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.2f15048.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.45b6fb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.c1f2a58.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Exccelworkbook.exe.4299990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe PID: 4940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6724, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	29%	Virustotal		Browse
QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Perseus
QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Perseus

Source	Detection	Scanner	Label	Link
http://schemas.datacontract.org/2004/07/d	0%	Avira URL Cloud	safe
http://ipwho.isd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
rency.ydns.eu	94.156.177.117	true	true	unknown
ipwho.is	195.201.57.90	true	false	high
twart.myfirewall.org	127.0.0.4	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
twart.myfirewall.org	false		high
https://ipwho.is/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000009.00000002.4182925533.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	Exccelworkbook.exe, 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipwho.isd	Exccelworkbook.exe, 00000009.00000002.4182925533.0000000003140000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/d	Exccelworkbook.exe, 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipwho.is	Exccelworkbook.exe, 00000009.00000002.4182925533.000000000312E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354sCannot	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000002.00000002.1787337073.0000000003461000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 00000009.00000002.4182925533.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe, 00000000.00000002.1761027373.0000000007102000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipwho.is	Exccelworkbook.exe, 00000009.00000002.4182925533.0000000003140000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.177.117	rency.ydns.eu	Bulgaria		43561	NET1-ASBG	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

Private

IP
127.0.0.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585887
Start date and time:	2025-01-08 12:47:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@27/5@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 204 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.144, 2.22.50.131, 23.56.254.164, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:48:01	API Interceptor	1x Sleep call for process: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe modified
06:48:07	API Interceptor	11825234x Sleep call for process: Exccelworkbook.exe modified
11:48:06	Task Scheduler	Run new task: pdfdocument path: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	UXxZ4m65ro.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	108.181.61.49
	msgde.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	6ee7HCp9cD.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	108.181.61.49
rency.ydns.eu	Zam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exe	Get hash	malicious	Quasar	Browse	93.123.85.234

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	YOUR TV LICENCE STATEMENT.pdf	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	https://mrohailkhan.com/energyaustralia/auth/auhs1	Get hash	malicious	Unknown	Browse	138.201.222.163
	file.exe	Get hash	malicious	AsyncRAT	Browse	116.203.56.216
	UXxZ4m65ro.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	148.251.133.221
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse	116.202.167.133
	1.exe	Get hash	malicious	Unknown	Browse	144.76.136.153
	1.exe	Get hash	malicious	Unknown	Browse	144.76.136.153
	miori.x86.elf	Get hash	malicious	Unknown	Browse	144.79.65.29
	sfqbr.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	94.130.22.61
NET1-ASBG	Quotation2025-0107pdf.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	94.156.177.41
	Kloki.m68k.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.arm7.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.mpsl.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.ppc.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.mips.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.arm5.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	Kloki.arm4.elf	Get hash	malicious	Mirai	Browse	83.222.191.90
	mips.elf	Get hash	malicious	Unknown	Browse	83.222.191.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.201.57.90
	174.exe	Get hash	malicious	Xmrig	Browse	195.201.57.90
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	195.201.57.90
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	195.201.57.90
	invoice-1623385214 pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	195.201.57.90
	0a0#U00a0.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	195.201.57.90
	c2.hta	Get hash	malicious	Remcos	Browse	195.201.57.90
	http://xyft.zmdusdxj.ru	Get hash	malicious	Unknown	Browse	195.201.57.90
	Globalfoundries eCHECK- Payment Advice.html	Get hash	malicious	Unknown	Browse	195.201.57.90

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1302776811683923
Encrypted:	false
SSDEEP:	6:kKgn9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5DnLNkPlE99SNxAhUe/3
MD5:	1760A2968E08479BCF221E793CC6E097
SHA1:	D5008DA1F6138DB58A698914F8D7974E81103D21
SHA-256:	A67544BF733E1714AAF428F65A3F97CC18145958A76134439D08FD359FC09C4C
SHA-512:	1F8B5C9512ADCD77E8868A06E8BF215C82FF407CAD36EFAB1A7DC218E3B7DC56DFAB03ED7F1CCCC771FAA946380F8BD52555D5EB9DFD87944978DCD2D0E74C73
Malicious:	false
Preview:	p...... ........\|@-..a..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Exccelworkbook.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.log

Download File

Process:	C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Download File

Process:	C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3773952
Entropy (8bit):	7.995193019666378
Encrypted:	true
SSDEEP:	98304:Xd36tNUGXT/1LirUtZDS7uJTtTD+ukiR+erm7fr2:X8tNFNLgQA7E9DtkoK7fK
MD5:	9B3C35A49DD56D6282A2A89832046FFC
SHA1:	0CB9124335747F5DD253744A828D5E30CA7D06F3
SHA-256:	2234C3A3350DBEBA11B7564DC52D5AA1252777F9FFE8DCF4027DCB54FC4542AA
SHA-512:	33B45162D1C4E1F6AB103B92921E5FE1754EB3EC1B062298B5B976BC887EF2D559102A2CE8C758C5F7E12E33973C46326A126599226250F941251553BE4F2854
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.~g..............0...9..........9.. ....9...@.. ........................:...........@...................................9.O.....9.......................9.......9.T............................................ ............... ..H............text.....9.. ....9................. ..`.rsrc.........9.......9.............@..@.reloc........9.......9.............@..B..................9.....H........H..............\....t8.........................................^..}.....(.......(......0..V........s...... =...}......{....o....}......{....o....}.....r...p}......{....o....}......+.....0..+.........,..{.......+....,...{....o........(.....*..0............s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....s....}.....(......{.....o .....{........s!...o".....{....r...po#.....{.....:..s$...o%.....{.....o&.....{....r...po'.....{.....o .....{.......;s!...o

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995193019666378
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
File size:	3'773'952 bytes
MD5:	9b3c35a49dd56d6282a2a89832046ffc
SHA1:	0cb9124335747f5dd253744a828d5e30ca7d06f3
SHA256:	2234c3a3350dbeba11b7564dc52d5aa1252777f9ffe8dcf4027dcb54fc4542aa
SHA512:	33b45162d1c4e1f6ab103b92921e5fe1754eb3ec1b062298b5b976bc887ef2d559102a2ce8c758c5f7e12e33973c46326a126599226250f941251553be4f2854
SSDEEP:	98304:Xd36tNUGXT/1LirUtZDS7uJTtTD+ukiR+erm7fr2:X8tNFNLgQA7E9DtkoK7fK
TLSH:	ED063356030E55D8CA528B3929C4BB25F77475A0C2A3D30D32A890775EEE70BDAFED12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.~g..............0...9...........9.. ....9...@.. ........................:...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x79a9da
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677E194C [Wed Jan 8 06:21:00 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
adc dh, byte ptr [esi+edx*2]
js 00007F3A307F1472h
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x39a988	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x39c000	0x618	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x398704	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3989f8	0x398a00	db6e7c209ab5ed87ae1a649dce154e4b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x39c000	0x618	0x800	5dd18aedd949dc659da3b5b222db78e8	False	0.3359375	data	3.457239621336859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x39e000	0xc	0x200	b59b0b392e5cd9003d5411a2756e8a20	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x39c090	0x388	data			0.4192477876106195
RT_MANIFEST	0x39c428	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T12:48:15.586054+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	94.156.177.117	5287	192.168.2.4	49736	TCP
2025-01-08T12:48:15.586054+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	94.156.177.117	5287	192.168.2.4	49736	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 12:48:14.843255043 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:14.848119974 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:14.848217010 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:14.856270075 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:14.861074924 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:15.569263935 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:15.569284916 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:15.569385052 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:15.578752995 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:15.586054087 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:15.812189102 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:15.872365952 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:16.909128904 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:16.909174919 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:16.909245968 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:16.911079884 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:16.911094904 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.756572962 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.756666899 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:17.761550903 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:17.761580944 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.761864901 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.769789934 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:17.815331936 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.961065054 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.961148024 CET	443	49738	195.201.57.90	192.168.2.4
Jan 8, 2025 12:48:17.961256981 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:18.292387962 CET	49738	443	192.168.2.4	195.201.57.90
Jan 8, 2025 12:48:18.600476980 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:18.606324911 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:18.606379032 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:18.611991882 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:19.131222963 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:19.281632900 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:19.501163960 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:48:19.669223070 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:21.255002975 CET	63837	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:21.259849072 CET	53	63837	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:21.259910107 CET	63837	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:21.264760971 CET	53	63837	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:21.708065033 CET	63837	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:21.713124037 CET	53	63837	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:21.713180065 CET	63837	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:44.513041973 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:48:44.517963886 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:49:09.528680086 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:49:09.533516884 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:49:34.597675085 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:49:34.602559090 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:49:59.747695923 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:49:59.753628016 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:50:24.763293028 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:50:24.768187046 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:50:49.841588974 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:50:49.846462011 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:51:14.970277071 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:51:14.975174904 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:51:40.029383898 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:51:40.034245968 CET	5287	49736	94.156.177.117	192.168.2.4
Jan 8, 2025 12:52:05.185762882 CET	49736	5287	192.168.2.4	94.156.177.117
Jan 8, 2025 12:52:05.190732956 CET	5287	49736	94.156.177.117	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 12:48:12.589793921 CET	64538	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:12.605371952 CET	53	64538	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:14.827189922 CET	49833	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:14.842231989 CET	53	49833	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:16.898441076 CET	55930	53	192.168.2.4	1.1.1.1
Jan 8, 2025 12:48:16.905210972 CET	53	55930	1.1.1.1	192.168.2.4
Jan 8, 2025 12:48:21.254548073 CET	53	51974	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 12:48:12.589793921 CET	192.168.2.4	1.1.1.1	0xc08a	Standard query (0)	twart.myfirewall.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 12:48:14.827189922 CET	192.168.2.4	1.1.1.1	0xbff4	Standard query (0)	rency.ydns.eu	A (IP address)	IN (0x0001)	false
Jan 8, 2025 12:48:16.898441076 CET	192.168.2.4	1.1.1.1	0x3d5c	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 12:48:12.605371952 CET	1.1.1.1	192.168.2.4	0xc08a	No error (0)	twart.myfirewall.org	127.0.0.4	A (IP address)	IN (0x0001)	false
Jan 8, 2025 12:48:14.842231989 CET	1.1.1.1	192.168.2.4	0xbff4	No error (0)	rency.ydns.eu	94.156.177.117	A (IP address)	IN (0x0001)	false
Jan 8, 2025 12:48:16.905210972 CET	1.1.1.1	192.168.2.4	0x3d5c	No error (0)	ipwho.is	195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	195.201.57.90	443	6724	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 11:48:17 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2025-01-08 11:48:17 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 11:48:17 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2025-01-08 11:48:17 UTC	1021	IN	Data Raw: 33 66 31 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f Data Ascii: 3f1{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.189", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yo

Target ID:	0
Start time:	06:47:59
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe"
Imagebase:	0x730000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1758223737.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1762726823.000000000C1F2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1762726823.000000000B691000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:48:03
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe"
Imagebase:	0xd70000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.1769970688.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.1769970688.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:48:05
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f
Imagebase:	0xd30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:48:05
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:48:05
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x7ff70f330000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1816081787.0000000002AD9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1822871144.0000000003A99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1822871144.0000000004299000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:48:06
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Imagebase:	0xb10000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1919924334.000000000BC7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1878255019.00000000031C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:48:08
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x580000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:48:08
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x710000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:48:08
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x960000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000009.00000002.4182925533.000000000318C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:48:11
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f
Imagebase:	0xd30000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:48:11
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:48:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x430000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:48:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x720000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:48:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x130000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:48:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x180000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:48:15
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0xd60000
File size:	3'773'952 bytes
MD5 hash:	9B3C35A49DD56D6282A2A89832046FFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.2%
Total number of Nodes:	191
Total number of Limit Nodes:	14

Executed Functions

Function 02C51560 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c3eb38c7d18a33160fc1f970ef840d819fd1ffa6585a7e7b9c1408167a30bd
Instruction ID: 47098a0cbe08df7279ca1ef313d7d1eb260e0e9441ae8d354f3f9ab8c287431e
Opcode Fuzzy Hash: e7c3eb38c7d18a33160fc1f970ef840d819fd1ffa6585a7e7b9c1408167a30bd
Instruction Fuzzy Hash: 8861F771D45629CBEB24CF66C8447E9BBF6BF89300F14C1AAD80DA6251DBB05AC5CF44

Function 0121D031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0121D0BE
GetCurrentThread.KERNEL32 ref: 0121D0FB
GetCurrentProcess.KERNEL32 ref: 0121D138
GetCurrentThreadId.KERNEL32 ref: 0121D191

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 05b2ab39d42ca121d09de0cd09a571d3bf50e7194f1da3b2c3126c4e47ffa484
Instruction ID: ffe11f07a97df8e9e08affbab7e1f5b683b792f2525bd18a9460bbde937136bc
Opcode Fuzzy Hash: 05b2ab39d42ca121d09de0cd09a571d3bf50e7194f1da3b2c3126c4e47ffa484
Instruction Fuzzy Hash: 205144B0901249CFDB14DFA9D548B9EBFF1BF89304F208469E119A7360D735A984CF65

Function 0121D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0121D0BE
GetCurrentThread.KERNEL32 ref: 0121D0FB
GetCurrentProcess.KERNEL32 ref: 0121D138
GetCurrentThreadId.KERNEL32 ref: 0121D191

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9a5d77d5a0b88b45a9dd502e63db0e2693efe402741eea7f9c317e707f763ce5
Instruction ID: 0e727972c50cfbf46826441d045378066314f1a40cb4e40001bf416d9e432d90
Opcode Fuzzy Hash: 9a5d77d5a0b88b45a9dd502e63db0e2693efe402741eea7f9c317e707f763ce5
Instruction Fuzzy Hash: 005133B0900249CFDB14DFAAD548BEEBBF1BB88304F208459E119A7360D735A984CF65

Function 02C50457 Relevance: 1.8, APIs: 1, Instructions: 264
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 02C50696

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c68bc494b61dafcc6a0bd7e9de6bca698ea9acf8b99f2207e6b96743a8027d63
Instruction ID: 14c70208e5a8b7e043d4421b90274b45452ebe69f5eccd47372196676aa8f200
Opcode Fuzzy Hash: c68bc494b61dafcc6a0bd7e9de6bca698ea9acf8b99f2207e6b96743a8027d63
Instruction Fuzzy Hash: C2A15B71D00229CFDB10CFA8C9417EEBBB2BF88314F1485A9E849E7254DB749A85CF95

Function 02C50460 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 02C50696

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 776071bcf84e30ab4b03f6e62a947ba48e17781a3d875ecd0cbfae4398c6729e
Instruction ID: 98b60362d065e95f2fd3edb598831b8ff7faabcc6fa066519e91eb9c2b753f1c
Opcode Fuzzy Hash: 776071bcf84e30ab4b03f6e62a947ba48e17781a3d875ecd0cbfae4398c6729e
Instruction Fuzzy Hash: 58914971D00229CFDB10CFA8C8417EEBBB2BF88314F1485A9E849E7254DB749A85CF95

Function 012144C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012159C9

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dd642c7f100a4493ffd8fa7950aab9e1e6ae62d199fd08890ce068c6e3489e78
Instruction ID: 811ba1580095037ed7f1ee0ffa1e224a6328f5ffdf576c0c7013b0649e0065b4
Opcode Fuzzy Hash: dd642c7f100a4493ffd8fa7950aab9e1e6ae62d199fd08890ce068c6e3489e78
Instruction Fuzzy Hash: A141D2B1C10719CFDB24CFA9C88478EBBF5BF49304F24809AE419AB255DB756945CF90

Function 01215913 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012159C9

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ccc41e553727a07f7fa1c6bd579ebee0a21fbe46b6716045b8745a25b4c8dd6f
Instruction ID: 31d77e056d1e852d0d24705c00cdf65b1ed5adcdef8ef8c2ebb587a3111b06f1
Opcode Fuzzy Hash: ccc41e553727a07f7fa1c6bd579ebee0a21fbe46b6716045b8745a25b4c8dd6f
Instruction Fuzzy Hash: FB41C2B1C00719CFDB24CFA9C98478EBBF5BF49304F24809AD419AB255DB756945CF90

Function 02C50006 Relevance: 1.6, APIs: 1, Instructions: 88
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C500BE

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 559bfe91ee82096b1c6f9d59e7830f749faef55020649c947e7f397eae24eb47
Instruction ID: 0b793fb3dce5909fcca8fdd52782b23a313affb1813e0ea843a0a50523b9c6a8
Opcode Fuzzy Hash: 559bfe91ee82096b1c6f9d59e7830f749faef55020649c947e7f397eae24eb47
Instruction Fuzzy Hash: 22319E718043598FC711CFA9C4817EEBFF0EF8A324F15846AD444AB252D7389985CBA4

Function 02C50110 Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02C50186

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 30d07aa17dbbd5778e56749c71dfb4aff15d2976fa5982fc080ae4c945b70106
Instruction ID: 7a1b313df146b07eca0ea0b6703f6d91ec75512066116c45bd546e70fe5454cb
Opcode Fuzzy Hash: 30d07aa17dbbd5778e56749c71dfb4aff15d2976fa5982fc080ae4c945b70106
Instruction Fuzzy Hash: 0121DBB28003498FCB10DF99C8407DEBFF4EF88320F14882AD465A7251C739A954CFA1

Function 02C501D0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02C50268

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 0824ac888968a81a4c0347c5d05867e96d71000126c34ada0322f12b7d2d5906
Instruction ID: c70196c11a7b8ee69b23225034148e4fe708338090659d33cd5f1d485e406bc3
Opcode Fuzzy Hash: 0824ac888968a81a4c0347c5d05867e96d71000126c34ada0322f12b7d2d5906
Instruction Fuzzy Hash: 0D2168B19003199FCB10CFA9C880BEEBBF4FF48310F108429E959A7250D7789944CBA4

Function 02C501D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 02C50268

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d6f6c5b9666a8e5b04f0acc45275f493e0c2fc4b0b166f9934d2628c0960d8e2
Instruction ID: 9e634de3fe3a013c15ef291a0738f30a9cd3ffb33e28de1e9531f63964056856
Opcode Fuzzy Hash: d6f6c5b9666a8e5b04f0acc45275f493e0c2fc4b0b166f9934d2628c0960d8e2
Instruction Fuzzy Hash: CB2127B59003599FCF10CFA9C985BEEBBF5FF48310F10842AE959A7250D7789944CBA4

Function 02C502C3 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02C50348

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fc90f1426e7d01ec621f8eb15883e2c0041e5f3f4fb00e212fdaeeb7a1d2dc45
Instruction ID: bc392097d48515d0fbfe666fe701ae0c6fdd715abe3f007de067f8ff2ab720df
Opcode Fuzzy Hash: fc90f1426e7d01ec621f8eb15883e2c0041e5f3f4fb00e212fdaeeb7a1d2dc45
Instruction Fuzzy Hash: 4A214AB18003599FCB10DFA9C980BDEFBF5FF88320F108429E958A7250D7359945CBA5

Function 0121D689 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121D717

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0008447acf2664994f59a42e9398832fbd3def42de4de26d0fa7709654057de3
Instruction ID: 8b76434d079d14e3e8e23512ab20da34c85dc4effeaeef824e0415af113e0cd9
Opcode Fuzzy Hash: 0008447acf2664994f59a42e9398832fbd3def42de4de26d0fa7709654057de3
Instruction Fuzzy Hash: EB21E3B5900259DFDB10CF9AD984ADEFFF5FB48314F14802AE918A7210D374A940CFA5

Function 02C502C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 02C50348

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2017d7df6a119f399622cc01040669e8f3df9c82783a67911d7a2b7510a0ffbf
Instruction ID: 24851d5c379c6ba443cce34c222c9ad1e23a41545080cbeeca600b8fd491816e
Opcode Fuzzy Hash: 2017d7df6a119f399622cc01040669e8f3df9c82783a67911d7a2b7510a0ffbf
Instruction Fuzzy Hash: 8D2139B19003599FCB10DFAAC944BEEFBF5FF48320F10842AE959A7250C7399544CBA5

Function 02C50040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C500BE

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6c0b5ad51eb6be65089534dba2ab2a04244b938a50385ce7030124e8811bd7e9
Instruction ID: ff8a7fef182ba9de5c41aac5317b58d2b6c8ed643ccb2291d2570a47a1669c3d
Opcode Fuzzy Hash: 6c0b5ad51eb6be65089534dba2ab2a04244b938a50385ce7030124e8811bd7e9
Instruction Fuzzy Hash: 8E214CB19003198FDB10DFAAC5857EEBBF4EF88324F108429D459A7240C7789584CFA5

Function 0121D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0121D717

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6477482dea24c019dccf2799f1688f113892fddbc34a4794a89cffbfd56dd178
Instruction ID: 7857db5c71d3298d40f7bfd210995c4aaada611f4eb0cc48fe49d10cf0cb8c2f
Opcode Fuzzy Hash: 6477482dea24c019dccf2799f1688f113892fddbc34a4794a89cffbfd56dd178
Instruction Fuzzy Hash: 1D21E4B5900248DFDB10CF9AD584ADEBFF4FB48310F14801AE918A3310D374A940CFA5

Function 02C50118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 02C50186

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f47308699b479ef0cbb9841b9f69eddd89d449ae26bb1990c1c20356638914fb
Instruction ID: a223f9e546052d119e6741a3be27139e50c1f32879e4f9d98a9a00ef7a3fff36
Opcode Fuzzy Hash: f47308699b479ef0cbb9841b9f69eddd89d449ae26bb1990c1c20356638914fb
Instruction Fuzzy Hash: B91126B59002499FCB10DFAAC844BDFBFF5EF88320F208819E559A7250C775A944CFA5

Function 02C525A0 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02C52605

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9720986a3682c0727b1efaa9c1ecaef2f281bbc06d5ec8a2b430a390aacddc1c
Instruction ID: c12bebe4a9a2130bf3a15a0820f17facea7bc5719c1130c8208a79cc3747228e
Opcode Fuzzy Hash: 9720986a3682c0727b1efaa9c1ecaef2f281bbc06d5ec8a2b430a390aacddc1c
Instruction Fuzzy Hash: E41113B58002589FCB10CF99C484BDEFBF8EB48314F108459E858A7210C375A984CFA5

Function 0121AF93 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0121AFFE

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9804596b3b654451e476a9bcafa860fd9993ac7e50087eb96a3e11d782ea1d64
Instruction ID: 5fe70bcbc57cb236918b994a80f77330d2dbc5f9450bfe74b72defb8ca84bbe2
Opcode Fuzzy Hash: 9804596b3b654451e476a9bcafa860fd9993ac7e50087eb96a3e11d782ea1d64
Instruction Fuzzy Hash: 001132B5C002898FCB20CFAAC444BDEFFF0AF88324F14805AD569A7210C379A545CFA1

Function 0121AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0121AFFE

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6b42e47771927f00dcc09201a1a53da1560c5c6bb0e7a3bb5c09eb186fab8136
Instruction ID: 55ca5c86d839e70ad2a1a9b9df191f9d72cd595b100bf782c3e8f0a916a6c1dc
Opcode Fuzzy Hash: 6b42e47771927f00dcc09201a1a53da1560c5c6bb0e7a3bb5c09eb186fab8136
Instruction Fuzzy Hash: 2011E0B5C003498FDB14CF9AC444BDEFBF4AB88324F10842AD569A7214D379A545CFA5

Function 02C525A8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02C52605

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 79e395903ec622f15684c0d2ac9af836db3036bc10559e1f57a7aa20ebb4992f
Instruction ID: cca1f9ce7fb4d890f7a0f1cbdafc943a46653afe24d3e67d88ae292ea5214e68
Opcode Fuzzy Hash: 79e395903ec622f15684c0d2ac9af836db3036bc10559e1f57a7aa20ebb4992f
Instruction Fuzzy Hash: 7211D3B58003599FDB10DF9AC545BDEFBF8EB48324F10845AE958A7210C375A984CFA5

Function 011AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749110762.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ad000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf43e7fc16db1f8b74fa16bce788365eaf052aa28f27534c151fb30fcf71ae4
Instruction ID: 6faafe34aa7f27aa465970a2eaab71ed1f47f0dae3c650163f8e9cd6832730dc
Opcode Fuzzy Hash: cdf43e7fc16db1f8b74fa16bce788365eaf052aa28f27534c151fb30fcf71ae4
Instruction Fuzzy Hash: 92214579500600DFCF09DF58E9C0B2ABF75FB88318F60C569E8494BA56C336D446CBA2

Function 011BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749192159.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d17430e48414f54a18309bb8cf1260544b170c1eb1f4cab1cec39af9ff69f36
Instruction ID: 7955627ca388717fa9f50482e18c9ef0af731854f4d835c94cf73474b298cbd1
Opcode Fuzzy Hash: 1d17430e48414f54a18309bb8cf1260544b170c1eb1f4cab1cec39af9ff69f36
Instruction Fuzzy Hash: 43212271604200DFCF1DDF58E9C4B66BFA5EB88318F20C5ADE80A4B256C33AD447CA62

Function 011BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749192159.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa5df409a8a2fb91bd10012dac708fa2b173619f05df416be5a217a274267cb
Instruction ID: 208e5f4f378cc8c4e3a42760240eeff3a5ca2f81b9e0c491c620c567144d1055
Opcode Fuzzy Hash: efa5df409a8a2fb91bd10012dac708fa2b173619f05df416be5a217a274267cb
Instruction Fuzzy Hash: 4A210771504240DFDF0DDF98E5C0B66BBA5FB84328F20C5ADE9094B256C336D446CB62

Function 011BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749192159.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f2a7916b9dc3e8a5a531636d941f516d17fdf38417d11473851c1fa1901f11
Instruction ID: f6523a7609b924413182d333bec9c5b540eaadc17d110656853d31d2570324f5
Opcode Fuzzy Hash: 52f2a7916b9dc3e8a5a531636d941f516d17fdf38417d11473851c1fa1901f11
Instruction Fuzzy Hash: ED2180755083809FCB06CF64D9D4B11BF71EB46218F28C5DAD8498F2A7C33A981ACB62

Function 011AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749110762.00000000011AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ad000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: d5e461b79528952b75a0887eb8ae0521e68497e559cf4b65e91b5667f967942f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 1111E176404280CFCF06CF54E5C4B16BF71FB84318F24C6A9D8490B656C336D45ACBA2

Function 011BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749192159.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: d4537a75b3f6d4194b4c5ca6f60d921e0c5393cfd8e546b52c00833ba1c4d21b
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3E11BB75504280DFDB0ACF54D5C4B55BFA1FB84228F24C6AAD8494B296C33AD40ACB62

Non-executed Functions

Function 02C53330 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aec3cf42c445255b0587ac1b08cf4f6535973b97f646ec7d08baef71d989a3f
Instruction ID: dd480d6f90e5ddfcb2fbfc21af20676552ab26afe5aec913c8bd8798633ad825
Opcode Fuzzy Hash: 6aec3cf42c445255b0587ac1b08cf4f6535973b97f646ec7d08baef71d989a3f
Instruction Fuzzy Hash: 95E1CC707016A08FDB2ADB39C550B6EB7F6AFC8244F1484ADD9068B394CF35E942CB55

Function 0121D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749645972.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1210000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ecf67d2a47ddf25833384e6cf14a8ffa316db2bea7024148d6a512473c0028
Instruction ID: 64ad5560f135dbdccdc75c95f9775d7b912b04b643fd6c30025953be98686091
Opcode Fuzzy Hash: 80ecf67d2a47ddf25833384e6cf14a8ffa316db2bea7024148d6a512473c0028
Instruction Fuzzy Hash: 24A18032E1021ACFCF05DFB4C9405AEB7F2FF95300B15456AE915AB269DB71E91ACB80

Function 02C5155B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750961399.0000000002C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c50000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfc2d92a268928c83352dcbf0d5b353b2538855241af4d1e83cd950242d31f8
Instruction ID: 43b4582181d124af81d02e17a3e6791513a9ac05345a29112abbcd22e32d4623
Opcode Fuzzy Hash: ccfc2d92a268928c83352dcbf0d5b353b2538855241af4d1e83cd950242d31f8
Instruction Fuzzy Hash: F93197B1D056288BEB28CFAB99143DDFAF6AFC9304F08C1AAC40CA6255DB740685CF44

Analysis Process: QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exePID: 4940, Parent PID: 6648COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	92
Total number of Limit Nodes:	12

Executed Functions

Function 01856540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 018565BE
GetCurrentThread.KERNEL32 ref: 018565FB
GetCurrentProcess.KERNEL32 ref: 01856638
GetCurrentThreadId.KERNEL32 ref: 01856691

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7e9e6c64192b995b34a72decace2f50cbda874f9a2bd1db5dbeb59274031a4af
Instruction ID: d19486372a05a1e78e8a368383749b37b5f51f5b1623084598f8863f81548d35
Opcode Fuzzy Hash: 7e9e6c64192b995b34a72decace2f50cbda874f9a2bd1db5dbeb59274031a4af
Instruction Fuzzy Hash: 895134B0900209CFDB54DFA9D548B9EBFF1EF48304F248469E519A73A0DB34A948CF65

Function 0185BFF0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0185C256

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b1cd8c764916413e0b5295bc0a3c2e299671d8966e48d998fc762c42c0aeb67e
Instruction ID: 14e277d35ccca25bdaa876ccb1a512c9012c4bbe9eeb99ff1b100def5159e35f
Opcode Fuzzy Hash: b1cd8c764916413e0b5295bc0a3c2e299671d8966e48d998fc762c42c0aeb67e
Instruction Fuzzy Hash: AB8121B0A00B058FD764DF69C44475ABBF5FB48304F008A2ED88ADBA50DB75EA49CF91

Function 01856780 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0185680F

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cbb155af61f9a6630b6e446476c0c30e3c310bda484c41948c8f23f28af0b3e1
Instruction ID: a12849e96663784335cc41c626e213cb5791c35387ea6bfdcb551460263de529
Opcode Fuzzy Hash: cbb155af61f9a6630b6e446476c0c30e3c310bda484c41948c8f23f28af0b3e1
Instruction Fuzzy Hash: B94137B6900219AFCB01CF99D844AEEBFF9FB48310F14806AE914E7321D735A914DFA5

Function 01856414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01857421

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fc8d2cdc4548be71b16b828902f8b0ad7a3efedbb48fdd554cf0b19c3054de6f
Instruction ID: 02d52cd639460aee9433f55791342945e716eb480a6f10b0c99319cb46f5f502
Opcode Fuzzy Hash: fc8d2cdc4548be71b16b828902f8b0ad7a3efedbb48fdd554cf0b19c3054de6f
Instruction Fuzzy Hash: DF41A2B0C0061DCEDB24DFA9C98479DBBB6BF45304F64805AD408AB255DB756949CF90

Function 01857364 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01857421

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2b8ee0c058570f7f4ce1f32d9e7a80d10e353f0cbd9d4fc2b134c6b1c806b0a
Instruction ID: 465ff1f55518b216d99cc9d9460e538eb5109fa64b3996f30d327b3c243ec513
Opcode Fuzzy Hash: a2b8ee0c058570f7f4ce1f32d9e7a80d10e353f0cbd9d4fc2b134c6b1c806b0a
Instruction Fuzzy Hash: 9C41B0B1C00619CFDB24CFA9C984B9EBBB6BF49304F64806AD408AB255DB756949CF90

Function 01856788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0185680F

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0a93294764d108960bab3f0213f5bb5e3aa3674376f77aa571d3e3cfbfd8a728
Instruction ID: ccf4e5931f733d1da66fe123765b10ab3930b4aa3fe8b542ec5f08a380fdd763
Opcode Fuzzy Hash: 0a93294764d108960bab3f0213f5bb5e3aa3674376f77aa571d3e3cfbfd8a728
Instruction Fuzzy Hash: 6721E4B59002189FDB10CF9AD984ADEBFF4FB48320F14801AE958A3310D374A944CFA5

Function 0185C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0185C256

Memory Dump Source

Source File: 00000002.00000002.1784353686.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1850000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8460c2ed4219281bc68d4a1d48cdc1950602ace75fa72b2f7995a874d4a90445
Instruction ID: 7ca90fee7a21de3bc7e4107ec33a3add41ad7ad3a81c7faa1474d5a9b7bf0ac5
Opcode Fuzzy Hash: 8460c2ed4219281bc68d4a1d48cdc1950602ace75fa72b2f7995a874d4a90445
Instruction Fuzzy Hash: 0C11E0B5C003498FDB10DF9AC444ADEFBF8EB89324F10852AD969B7610C375A645CFA5

Function 0180D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1783930870.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180d000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30546d301508e5a721ced23b35f89431c4cec8d519db8eb0be2c05330c4e6574
Instruction ID: c7c13fa3f33de672235758ef9ce6d36fcd87056ce7d150c174f10cbbe9a1da45
Opcode Fuzzy Hash: 30546d301508e5a721ced23b35f89431c4cec8d519db8eb0be2c05330c4e6574
Instruction Fuzzy Hash: BB212271604208DFDB56DF98D9C4B26BFA5EB84318F20C66DD80E8B296C33AD547CA61

Function 0180D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1783930870.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_180d000_QUOTATION - RFQ2496_PO 08775622879.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 5da5a7f5bb88ce04c9648fb7e8881effa279815cffe308459cd76f80887ce241
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E711BE75504284CFDB12CF54D9C4B15BF61FB44314F24C6AAD8098B696C33AD50ACB62

Analysis Process: Exccelworkbook.exePID: 6576, Parent PID: 4940COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	193
Total number of Limit Nodes:	11

Executed Functions

Function 00C3D031 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C3D0BE
GetCurrentThread.KERNEL32 ref: 00C3D0FB
GetCurrentProcess.KERNEL32 ref: 00C3D138
GetCurrentThreadId.KERNEL32 ref: 00C3D191

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2e21b49f06ad225f53f03d519e3dabb38968a9bf4984b7f29d1f38ad892484f3
Instruction ID: 9e518536a902e4ffe16624875a153b413a8bee43879ffbc17cfccf0d1463c510
Opcode Fuzzy Hash: 2e21b49f06ad225f53f03d519e3dabb38968a9bf4984b7f29d1f38ad892484f3
Instruction Fuzzy Hash: 8A5165B09103498FDB14DFAAD548BAEBBF1AF48314F208459D019A73A1DB359984CF65

Function 00C3D040 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C3D0BE
GetCurrentThread.KERNEL32 ref: 00C3D0FB
GetCurrentProcess.KERNEL32 ref: 00C3D138
GetCurrentThreadId.KERNEL32 ref: 00C3D191

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 879fae28cee7dd79a63a4794f8c379801c35ec38e7253be022d1b3fa5205fa73
Instruction ID: f051b09e203a7968aad78d8559b5072c99d2f421fad661c09c002203b41fe073
Opcode Fuzzy Hash: 879fae28cee7dd79a63a4794f8c379801c35ec38e7253be022d1b3fa5205fa73
Instruction Fuzzy Hash: 275144B09103098FDB14DFAAD548BAEBBF1BF88314F208459E419A7360DB74A984CF65

Function 028C0110 Relevance: 3.1, APIs: 2, Instructions: 92
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 028C00BE
VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028C0186

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: AllocContextThreadVirtualWow64
String ID:
API String ID: 2727713192-0
Opcode ID: 2713bbb46a7ceb3d0276181c8f2ba13345b7477f99f45f0892a8569818eaf547
Instruction ID: 7d0c4a6450f6a415f0a57274ae199d26cc1d442239ef0a128125c0eae9f5168c
Opcode Fuzzy Hash: 2713bbb46a7ceb3d0276181c8f2ba13345b7477f99f45f0892a8569818eaf547
Instruction Fuzzy Hash: 03316876900209CFDB10DFAAC8447EEFBF5EF88324F24842AD559A7250CB799945CBA1

Function 028C0454 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 028C0696

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c9643776a70139b5c3def38b7ffde55e9c88b87989e9238909dd3ff8281ec47d
Instruction ID: 0c80e32fdace76d23428c1ba14b511e2ed1f944c14069474b32ef47ec6d6876b
Opcode Fuzzy Hash: c9643776a70139b5c3def38b7ffde55e9c88b87989e9238909dd3ff8281ec47d
Instruction Fuzzy Hash: 97A16B79D00219DFDB14CFA8C841BDEBBB2BF48354F2481A9E848E7250DB759985CF91

Function 028C0460 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 028C0696

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 869e3902516427ba855c1b45b071d76fdeef8279b1887c79c89167c69349b2f6
Instruction ID: 2a4c7ae572ff707f4e00faac18be80d75a9f938eb6847ca2e67c3031b097bea5
Opcode Fuzzy Hash: 869e3902516427ba855c1b45b071d76fdeef8279b1887c79c89167c69349b2f6
Instruction Fuzzy Hash: 68916A79D00219CFDB24CFA8C841BDEBBB2BF48354F2481A9E808E7250DB759985CF91

Function 00C3ADA8 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C3AFFE

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d347a4a291c1238ba7ee68ad794b995367cf24968418de2d1c944e4fdfa86181
Instruction ID: 4089e451cb5b158bdfb20b67c296fe7f123b6b35e6be4f00282927c9985a7e9c
Opcode Fuzzy Hash: d347a4a291c1238ba7ee68ad794b995367cf24968418de2d1c944e4fdfa86181
Instruction Fuzzy Hash: 63815470A10B058FD724DF2AD44579ABBF1FF88700F008A2DD49AD7A50D735E969CB91

Function 00C3590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C359C9

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e69d62afc01269816f4e3e123143df8a2722960a1df3f9eb01c4109fd39a812f
Instruction ID: 5f4dfa190658a23f4be6a32cebb83d809db490e5c5a347eaeb784cea563db0d7
Opcode Fuzzy Hash: e69d62afc01269816f4e3e123143df8a2722960a1df3f9eb01c4109fd39a812f
Instruction Fuzzy Hash: 9241C2B0C00619CFDB24CFA9C884BDEBBF5BF49304F24816AD418AB255DB756946CF90

Function 00C344C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00C359C9

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 49e7f2a184094d76fb05396de06e80f0f5b263cbeac4f9d3a18ff271531e7246
Instruction ID: f3cec6d075265abb560d0e3e873d3e3a82f656eb38e9eb6cdd9cb9f94394fe1e
Opcode Fuzzy Hash: 49e7f2a184094d76fb05396de06e80f0f5b263cbeac4f9d3a18ff271531e7246
Instruction Fuzzy Hash: 3041DFB0C00B1DCBDB24DFAAC884B9EBBF5BF49304F24816AD418AB255DB756945CF90

Function 028C0007 Relevance: 1.6, APIs: 1, Instructions: 86
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 028C00BE

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 244569ee14b2d93c75227a97353c75ad919a9b2fdedc18aa65060ac6bd08e9d4
Instruction ID: e4c8a624feafaf413c771509453e023585863c241b2f76a1afeb61db55942a70
Opcode Fuzzy Hash: 244569ee14b2d93c75227a97353c75ad919a9b2fdedc18aa65060ac6bd08e9d4
Instruction Fuzzy Hash: 2931E2759093888FCB11CFB9C4447DEBFF4AF4A324F1984AED488AB252C7389544CB65

Function 028C01D0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028C0268

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 339e945dbafb183acd19daa72db2c7d6502789bc9fddaad266eaf4626878e9bd
Instruction ID: dbb401006d84e2741e416be7da741400771cc31d4f425b9588035a7364ac7896
Opcode Fuzzy Hash: 339e945dbafb183acd19daa72db2c7d6502789bc9fddaad266eaf4626878e9bd
Instruction Fuzzy Hash: FA214875900349DFCB10CFA9C985BEEBBF5FF48320F108429E958A7250D7789944CBA0

Function 028C01D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 028C0268

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d3723245b7b4f932b407834eba04e7e0b5c2ca33f75198a2298236dea70f3158
Instruction ID: 3f47e3834ce28ad2d2b61d9780cefe2004f9bd1ee9f82c1abb02062848081a5c
Opcode Fuzzy Hash: d3723245b7b4f932b407834eba04e7e0b5c2ca33f75198a2298236dea70f3158
Instruction Fuzzy Hash: BB2127B5900359DFCB10CFA9C985BEEBBF5FF48320F108429E958A7251D7789944CBA4

Function 028C02C2 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028C0348

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d7e6472c8d705f23109b4d8b2322c329d9dbd109dd53dcac7c84b813a1e3ca2b
Instruction ID: d5d47491b6bff44f9420ad6c19b9d2fc9b5812238eab5411cd64509ae94e3d22
Opcode Fuzzy Hash: d7e6472c8d705f23109b4d8b2322c329d9dbd109dd53dcac7c84b813a1e3ca2b
Instruction Fuzzy Hash: 0E2136B5900349DFCB10DFAAC980AEEFBF5FF48320F148429E558A7250C7349944CBA4

Function 00C3D689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C3D717

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9936ffa0c02ec083fbe1a38bb0de3b47b5132a03581cdde81dd63e52ca9ea842
Instruction ID: 4300596d12a4a9fee75781ec83036be2788cec1b7656f3d0e2530325b165aa81
Opcode Fuzzy Hash: 9936ffa0c02ec083fbe1a38bb0de3b47b5132a03581cdde81dd63e52ca9ea842
Instruction Fuzzy Hash: 632114B5900258DFDB10CF9AD584ADEBFF4EB48320F14841AE918A7310C378A940CFA1

Function 028C02C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 028C0348

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 504760644b7b526f17f8255be21866414b6fe6feee5c2ad2acf7568e9570bb27
Instruction ID: 4e614f1c7b1550e35ff32e8705678180b0ebeed6613e0ee23f73d734116b70a9
Opcode Fuzzy Hash: 504760644b7b526f17f8255be21866414b6fe6feee5c2ad2acf7568e9570bb27
Instruction Fuzzy Hash: 602128B5900359DFCB10DFAAC980ADEBBF5FF48320F148429E558A7250C7759544CBA4

Function 028C0040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNELBASE(?,00000000), ref: 028C00BE

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b92b849ed48e303e663e6dd1add0852fd0e5ea7523108eec5019a901d4f0f26d
Instruction ID: c10f4ee2cd0f3d971de3ba3c2cd6d8739b8ee5bb329d5f46552f58ef55cdabf8
Opcode Fuzzy Hash: b92b849ed48e303e663e6dd1add0852fd0e5ea7523108eec5019a901d4f0f26d
Instruction Fuzzy Hash: 812135B5900309CFDB10DFAAC5857EEBBF4EF48324F20842AD559A7240CB78A944CFA5

Function 00C3D690 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C3D717

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c2dcd2934a28874a364446afca24ed9c8f4ae3bcaa622b5b019af7ccd571742e
Instruction ID: b1ee6ec7f108f1613e4de702fb4e109061ea5ae7ba0b9bd1033a000abb5460bb
Opcode Fuzzy Hash: c2dcd2934a28874a364446afca24ed9c8f4ae3bcaa622b5b019af7ccd571742e
Instruction Fuzzy Hash: 1321E4B5900248DFDB10CF9AD584ADEBBF8EB48320F14841AE915A3350D374A940CFA5

Function 028C0118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 028C0186

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 91d35bedbe179913f1af35c9c341acc60d03be7607e829717dfbebe43c93b25a
Instruction ID: fc8fb366a4dd4aa1320aae6f8702279b5b3dc0502d986890b431a555f4d16230
Opcode Fuzzy Hash: 91d35bedbe179913f1af35c9c341acc60d03be7607e829717dfbebe43c93b25a
Instruction Fuzzy Hash: 3B112675900249DFCB10DFAAC944BDFBFF5EB48320F20881AE559A7250C775A944CFA0

Function 0502FF3A Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0502FFA2

Memory Dump Source

Source File: 00000005.00000002.1846547828.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5020000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1a4b5c6d8db9c44c73cabce9ffb6e9fa6a2394cf42f5bae8f0d2d688c0a750f3
Instruction ID: f97f9790f6458a9bf825fb77990b60af4c57b75fa8ee37bd37b209c8fce717f3
Opcode Fuzzy Hash: 1a4b5c6d8db9c44c73cabce9ffb6e9fa6a2394cf42f5bae8f0d2d688c0a750f3
Instruction Fuzzy Hash: F21158B19042898FCB10DFAAC5457DEFBF8EF89324F208429D459A7250CB35A944CFA4

Function 0502FF40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0502FFA2

Memory Dump Source

Source File: 00000005.00000002.1846547828.0000000005020000.00000040.00000800.00020000.00000000.sdmp, Offset: 05020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5020000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bcbaa10668746b58edb53617590de5127bf0f9660776b7bd50271eb5490b8db0
Instruction ID: 0434de71e0ee4eb11757e5f611552d441c8b0bd8b5e2456aca9adb139bc7190a
Opcode Fuzzy Hash: bcbaa10668746b58edb53617590de5127bf0f9660776b7bd50271eb5490b8db0
Instruction Fuzzy Hash: 9E1136B19043598FDB20DFAAC5457DEFBF8EF88324F208829D459A7250CB75A944CFA4

Function 00C3AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00C3AFFE

Memory Dump Source

Source File: 00000005.00000002.1812699600.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c30000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e783b82a021101ea4f3e6cccbb9e9c4713f5cb72b42743ff72f719df6c9303a6
Instruction ID: ed71f7ae2a40b4844ff046cf090a4cdba8c4820419643e6624496d6f030178f9
Opcode Fuzzy Hash: e783b82a021101ea4f3e6cccbb9e9c4713f5cb72b42743ff72f719df6c9303a6
Instruction Fuzzy Hash: FF11E0B5C002498FDB14CF9AC544ADEFBF4AB88324F10842AD969A7210D375AA45CFA5

Function 028C26A0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 028C2705

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 053ae97ed88ccf2eab8571bb7bca6eb54d7124dd7935e211512a81f6cae42033
Instruction ID: 9330485a749cd603d2b3b3063b27b30f0581028bce40ee5871b1b760f69b809f
Opcode Fuzzy Hash: 053ae97ed88ccf2eab8571bb7bca6eb54d7124dd7935e211512a81f6cae42033
Instruction Fuzzy Hash: 6F11E3B58002499FDB10CF99D585BDEBBF8EB48324F208459D958A7251C375A944CFA1

Function 028C26A8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 028C2705

Memory Dump Source

Source File: 00000005.00000002.1815630375.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_28c0000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3f933c0c286df2c18b426e9596e59e5f73c77a42a70e800446d62c7a25779e60
Instruction ID: 370714769344ece884fe523cbd995222ffc0a148405cdc8d607f12a5db037a52
Opcode Fuzzy Hash: 3f933c0c286df2c18b426e9596e59e5f73c77a42a70e800446d62c7a25779e60
Instruction Fuzzy Hash: 151103B9800348DFDB10CF9AC984BDEBBF8EB48324F208459D958A7250C375A544CFA1

Function 00B8D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806667015.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b8d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae505882361efc24b18d87f0cedcd127b74812a760b64a1677f1949fc1379a00
Instruction ID: 770c3b8b9fef83106fe1e2bd5b980ea012fa8f21e580add168c3b8ac4affa169
Opcode Fuzzy Hash: ae505882361efc24b18d87f0cedcd127b74812a760b64a1677f1949fc1379a00
Instruction Fuzzy Hash: 1E210A71504204DFDB05EF14D9C4B17BFA5FB94324F28C5AAD9094B3A6C336E856C7A1

Function 00B8D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806667015.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b8d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86b54aca0811bc175a7302eddb6c1029d812f7c7f0b7e0aaef32cc2d21c15ac
Instruction ID: 6fc4a4927b7253b64aa308988bbfd6d724d80ebff695c2743d2ff972f5b33d05
Opcode Fuzzy Hash: b86b54aca0811bc175a7302eddb6c1029d812f7c7f0b7e0aaef32cc2d21c15ac
Instruction Fuzzy Hash: 2521C471504240DFDB05EF14D9C0B66BFA5FBA4318F24C5ABD9054A2A6C336D856C7A1

Function 00B9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806725572.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b9d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741b79f5e43fbcbc6290ed8d05d411f1b4a6004c5a0f7ead29c1139b660ac707
Instruction ID: f6500fad0ab4746a9da0fb49a3cb2f007df13a8c975506b0288b10a5e7585e64
Opcode Fuzzy Hash: 741b79f5e43fbcbc6290ed8d05d411f1b4a6004c5a0f7ead29c1139b660ac707
Instruction Fuzzy Hash: 5D21DE71604200DFDF14DF25D9D4B26BBA5EB88314F20C6B9E84A4B296C33AD846CA61

Function 00B9D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806725572.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b9d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a89ac9c536af73cfa7013df294514790cc8286227b74a0df36537027751138b
Instruction ID: bc44893e97646d7825343f04d92d29f591ae7a41e847027b5f6c7d05a7b537f7
Opcode Fuzzy Hash: 7a89ac9c536af73cfa7013df294514790cc8286227b74a0df36537027751138b
Instruction Fuzzy Hash: 05212371604200EFDF05DF15DAC0B26BBE5FB88314F20C6BDE9094B296C33AD846CA61

Function 00B9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806725572.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b9d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438be6f1d441c551f0e1e629f73a0fe8c74213f4ea99c9281ca23474a010f71c
Instruction ID: 007b875b7ece79b4f96b84653d7961185f7080661c091d804b7627c932f1d8fe
Opcode Fuzzy Hash: 438be6f1d441c551f0e1e629f73a0fe8c74213f4ea99c9281ca23474a010f71c
Instruction Fuzzy Hash: 4621A4755093808FDB06CF24D5A4715BFB1EB45314F28C5EAD8498B297C33A980ACB62

Function 00B8D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806667015.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b8d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 55a287b6cafc172676a04ebbed4d45830be1c776ebff26e666c797e3c5ad6b99
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 22110372504280CFCB02DF10D5C4B56BFB1FBA4318F24C6ABD8090B666C336D85ACBA1

Function 00B8D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806667015.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b8d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 91c6d6a8ed4bb326f18c4264613658aa4bff159436fc4d601d334a5edef4bf21
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E711E172504240DFCB02DF00D5C4B16BFB1FB94324F28C2AAD8090B366C33AE85ACBA1

Function 00B9D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1806725572.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_b9d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7a8f23bab797aeb2d8c4b64587589c8ae5cf4963c57336190a21d3a89495505c
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 10118B75504280DFDB16CF14D5C4B15BBA1FB94314F24C6AAD8494B6A6C33AD84ACB61

Analysis Process: Exccelworkbook.exePID: 3060, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	254
Total number of Limit Nodes:	12

Executed Functions

Function 07680D8A Relevance: 2.9, Strings: 2, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0%p1, xrefs: 07681090
0%p1, xrefs: 07681089

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 0%p1$0%p1
API String ID: 0-3740086479
Opcode ID: 91ba78a34c8595b2901112598e1594ebb444814280ed5200d424cda2d6a91cbd
Instruction ID: 000f6b33f4eefa53961ee260fcac3fe2aa18b23f7cf3fb4425bb11f5e163b5e8
Opcode Fuzzy Hash: 91ba78a34c8595b2901112598e1594ebb444814280ed5200d424cda2d6a91cbd
Instruction Fuzzy Hash: 75E1C2B0D14249DFCB44DF99D8808EEFBB2FF49310B14CA5AE416AB215C7349A82CF95

Function 07680E10 Relevance: 2.9, Strings: 2, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0%p1, xrefs: 07681090
0%p1, xrefs: 07681089

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 0%p1$0%p1
API String ID: 0-3740086479
Opcode ID: 8a01aa7a10918226d54e9d71b7edbab5ad261b66587d374339b768f9d44eee11
Instruction ID: 1ba487646f3b4494b46206c327f36af3b9280e2d0c7d974b71dcedc3151c97cf
Opcode Fuzzy Hash: 8a01aa7a10918226d54e9d71b7edbab5ad261b66587d374339b768f9d44eee11
Instruction Fuzzy Hash: 92E1C1B0D14249DFCB44DF99D8808EEFBB2FF49310B14DA5AE416AB215C7349A86CF91

Function 07680F00 Relevance: 2.8, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0%p1, xrefs: 07681090
0%p1, xrefs: 07681089

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 0%p1$0%p1
API String ID: 0-3740086479
Opcode ID: 45f68b7c92e5b7c5f1394e1ed0b8f943325db46598822f3253b6875d91744822
Instruction ID: 8321da3844e410b456b801bcabd4512df8f99b3a91847f2a10eb2188e700ba74
Opcode Fuzzy Hash: 45f68b7c92e5b7c5f1394e1ed0b8f943325db46598822f3253b6875d91744822
Instruction Fuzzy Hash: E4C139B0D1520ADFCB48DF99C4818AEFBB2FF89340F14D659E416AB254D734A982CF94

Function 07686DD1 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

O5>M, xrefs: 076870F7

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: O5>M
API String ID: 0-2302383708
Opcode ID: 65f7535ae15104c54568bdd5b2958a0b42bf61a1566f1da3044deac6289f6ddb
Instruction ID: a92517d9bd68ad375e17525274312538580c3167620bee826722058f865c5dff
Opcode Fuzzy Hash: 65f7535ae15104c54568bdd5b2958a0b42bf61a1566f1da3044deac6289f6ddb
Instruction Fuzzy Hash: 1BB159B1E19619DFCB44DFAAD98089EFBB2FF89300F14D626D416BB215D73099028F64

Function 07686DE0 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

O5>M, xrefs: 076870F7

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: O5>M
API String ID: 0-2302383708
Opcode ID: 1552eabfdcbc657b9371066ba90b011747074b6b7b71aa3ab1f7c1aff4877548
Instruction ID: 4b8f9878dd5d6f7b48bffeb5e35d70054ed4c452c9cd2e65349c1d7703f6022b
Opcode Fuzzy Hash: 1552eabfdcbc657b9371066ba90b011747074b6b7b71aa3ab1f7c1aff4877548
Instruction Fuzzy Hash: 23B13AB0E19619DFCB44DFAAD98489EFBB2FF89300F14D626D416BB215D73099028F64

Function 07684538 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

7{f', xrefs: 076847A4

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 7{f'
API String ID: 0-2192695807
Opcode ID: 95a0aa929dbcae72f3f8aa616c8045d1839fce3ba43d7cd01904e0911fa27868
Instruction ID: 51332d8687e3b85bd88f0d349276bf741a6fb747d7bf790247a1194d6dcbe21d
Opcode Fuzzy Hash: 95a0aa929dbcae72f3f8aa616c8045d1839fce3ba43d7cd01904e0911fa27868
Instruction Fuzzy Hash: 0DA14AB0E1624ADFCB44DFE5D6809DDFBB2EB8A310F20952AD406B7254DB349946CB14

Function 07684548 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

7{f', xrefs: 076847A4

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 7{f'
API String ID: 0-2192695807
Opcode ID: f80e85ed43dfececaba01344f61896a40a838cf7427b5b3a8aa1e3bd334450b8
Instruction ID: 12e2d9e67381f52c60b9a824fe767d4306b4d35b7a21db0b80d28dccfef971ba
Opcode Fuzzy Hash: f80e85ed43dfececaba01344f61896a40a838cf7427b5b3a8aa1e3bd334450b8
Instruction Fuzzy Hash: 85A128B0E1624ADFCB44DFE5D680ADDFFB2EB8A310F20A51AD406B7254DB349946CB14

Function 07684210 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Z, xrefs: 076843C2

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1862792848
Opcode ID: 95ee93b7c0ef91989351cdd493508b999314e9e53cf1ce29c02e1ed92cbef0f6
Instruction ID: 42b1023044be89c299cc43cc76550b8e1239ba6dfd305e496ae87f5eab192689
Opcode Fuzzy Hash: 95ee93b7c0ef91989351cdd493508b999314e9e53cf1ce29c02e1ed92cbef0f6
Instruction Fuzzy Hash: 2F9119B4E1522ACFCB44DFA9C4419EEFBB2FB89200F10951AD816B7358D7399902CF54

Function 07684201 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

Z, xrefs: 076843C2

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1862792848
Opcode ID: 807473e20ec5f950233aca1903dfa50032c7e692e6c73b82a07a2ce0698b4e40
Instruction ID: 8e71e735ea590de81908dd43cdf3027ad0dafb71f65cace7f9180a11ea337c88
Opcode Fuzzy Hash: 807473e20ec5f950233aca1903dfa50032c7e692e6c73b82a07a2ce0698b4e40
Instruction Fuzzy Hash: F99128B4E1522ACFCB44DFA9C8419EEFBB2FF89200F10955AD815A7358D7389906CF54

Function 0768368A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9721c3ef9eddd2ca6b15570885018e33a35cc988457c1feb3535e0b4d748c9b
Instruction ID: 0db7e15a936b02d83cd462e9d3c3fdce14a87cca1593edec7a325c6603681aae
Opcode Fuzzy Hash: f9721c3ef9eddd2ca6b15570885018e33a35cc988457c1feb3535e0b4d748c9b
Instruction Fuzzy Hash: 934104B4E11508EFC748CF9AE18499DFBF2FF89210B55C1E6D459AB325D731DA108B04

Function 07683698 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bc40c2b76a5b31666264100882da28a2944e209ef584e886f2e6c64549be88
Instruction ID: ff30f287dd307cf538d2f1c17bc6aeaab18125444bc16196076ea0d85bae76ae
Opcode Fuzzy Hash: d0bc40c2b76a5b31666264100882da28a2944e209ef584e886f2e6c64549be88
Instruction Fuzzy Hash: 5F41EFB4E11508EFC748CF9AE18499DFBF2EF89210F55D1E6D459AB324EB31DA118B04

Function 07680006 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87ee9d78fa097736334bb7c95fa610362f16a0a4d24148af13d39868e92e70a
Instruction ID: 31402d6ae70453ec9348edf593da651cace313bc3083d28023f68fb331a08e54
Opcode Fuzzy Hash: f87ee9d78fa097736334bb7c95fa610362f16a0a4d24148af13d39868e92e70a
Instruction Fuzzy Hash: 983163B1D053848FDB45CFA6C8502DEBFB2AFC6310F18C1ABD444AB265DA350945CF51

Function 07680040 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b1d2c73897626c67a6ddfa86d15386ba071a874a2bb6cd69b59cbcecefa28c
Instruction ID: 37db26f4f6bb7e0520e8f0a91290c9194a8a1f0e80a34cc19b6dd155e2ba7834
Opcode Fuzzy Hash: 88b1d2c73897626c67a6ddfa86d15386ba071a874a2bb6cd69b59cbcecefa28c
Instruction Fuzzy Hash: 052112B1E006189BDB58CFAAD8442DEBBF3AFC8310F14C16AD409A6228DB340A49CF50

Function 051B0454 Relevance: 1.7, APIs: 1, Instructions: 244
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 051B0696

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ebc5e8a001cae3686eac08cacb633e55dab236aa08fb45b09801d74b3cc1f7e3
Instruction ID: d48dc2273644b22328f1b1918f62be6a276a4652e4f19a2490b76ccfdeeeed20
Opcode Fuzzy Hash: ebc5e8a001cae3686eac08cacb633e55dab236aa08fb45b09801d74b3cc1f7e3
Instruction Fuzzy Hash: 29A15F71D00219DFEB10DF68C8497EEBBB2FF48310F1485A9E849A7250DB749A85CF91

Function 051B0460 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 051B0696

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c8c867c658dc7e2d851925312b977a0976cecd2c12fdd5e3816b4b9fa0d0a8a7
Instruction ID: d514ba60d3709eb8c09269dae945978311bf5ded637de957c14a1f24e7bfb605
Opcode Fuzzy Hash: c8c867c658dc7e2d851925312b977a0976cecd2c12fdd5e3816b4b9fa0d0a8a7
Instruction Fuzzy Hash: B1913F71D00619DFEB10DF68C849BEEBBB2FF48310F148169D849A7250DB749A85CF91

Function 0187ADA8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0187AFFE

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 605de201aa574577382fc760eb3a70e2c75e881a92fe25420ae64fbf5ebd3e45
Instruction ID: 047555648692ff10e7d7a502c5b74bfea2eb9e79dbcaf5d85bc68b83d9eace54
Opcode Fuzzy Hash: 605de201aa574577382fc760eb3a70e2c75e881a92fe25420ae64fbf5ebd3e45
Instruction Fuzzy Hash: EA713370A00B058FD728DF2AD44579ABBF1FF88304F048A2DD08AD7A50DB75EA49CB91

Function 0768E538 Relevance: 1.6, Strings: 1, Instructions: 361COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0768EA48

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: a0d9ecbd38053632bb106ee1c6d23ff42cc1cce9955f4cdad8bef222c0831bca
Instruction ID: 4eed76f44bc84462c46b72cf202a9d8faaa3c028d9f42bb9f31ed66aded7422b
Opcode Fuzzy Hash: a0d9ecbd38053632bb106ee1c6d23ff42cc1cce9955f4cdad8bef222c0831bca
Instruction Fuzzy Hash: 84E172B4B00209DFDB45DFB9D944AAEBBB6FF88300F108558E405A73A8DE369D85CB51

Function 018744C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018759C9

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a79741462f76dabc39ead56b4fda5c12a2d574f9b10ce2b8547050f3874fe9ef
Instruction ID: 8dd9e3e43e18bd7e1dcbdf1a54e2727a22bb4e866a68b5c226acc969284c88e8
Opcode Fuzzy Hash: a79741462f76dabc39ead56b4fda5c12a2d574f9b10ce2b8547050f3874fe9ef
Instruction Fuzzy Hash: 3B41A2B0C0071DCBDB24DFA9C984B9DBBB5FF49304F2480AAD409AB255DB756945CF90

Function 0187590C Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 018759C9

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9f96d8c3238f52488a659359f81313c40b07150fb4f5dae41c547c068b24e88b
Instruction ID: a1a0b755f28bd4f69cd48a8b8cfa633838c22d8a7970a7a93ffd640faa402b1e
Opcode Fuzzy Hash: 9f96d8c3238f52488a659359f81313c40b07150fb4f5dae41c547c068b24e88b
Instruction Fuzzy Hash: 7B41B2B0C00719CFDB24DFA9C984B9DBBB5BF49304F2480AAD409AB255DB756A85CF90

Function 05744040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05744101

Memory Dump Source

Source File: 00000006.00000002.1902332019.0000000005740000.00000040.00000800.00020000.00000000.sdmp, Offset: 05740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5740000_Exccelworkbook.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8defc09666c57bea27b9c325d46f29995e7a7797946c818109bb2aef06bddd93
Instruction ID: d7691cbd683749780398e992e4ad0859e716499f0def237aef433108f00a5a5a
Opcode Fuzzy Hash: 8defc09666c57bea27b9c325d46f29995e7a7797946c818109bb2aef06bddd93
Instruction Fuzzy Hash: 3F41F7B4900249DFCB14CF99C848BAABBF6FB98314F24C499D519AB321D775A841DFA0

Function 051B0006 Relevance: 1.6, APIs: 1, Instructions: 90threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 051B00BE

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe0afdd74c692c2aba81f9ff03c0b7fd538fda163e4ed5f0372498bc07749ccf
Instruction ID: 50bb5d228aaf4449337a4764fb94e70284f9b8da7c6710d2ef36ca782032a0ab
Opcode Fuzzy Hash: fe0afdd74c692c2aba81f9ff03c0b7fd538fda163e4ed5f0372498bc07749ccf
Instruction Fuzzy Hash: C5319A718043488FDB11CFA9C9847EEBFF5FF49324F18846AD459AB252D7789948CBA0

Function 051B01D8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 051B0268

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: df2cda2adec5ac19b7f6d0190fe227e529a0fe8cf67d10772d6126558d5c876b
Instruction ID: 37d71bd5dc2918c8c27833144bde7fe466eaececffe7954ef6a28190670c5b56
Opcode Fuzzy Hash: df2cda2adec5ac19b7f6d0190fe227e529a0fe8cf67d10772d6126558d5c876b
Instruction Fuzzy Hash: 9A2155B19003499FDF10CFA9C984BDEBBF5FF48320F10842AE959A7250C778A944CBA0

Function 051B01D0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 051B0268

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4a113609868026f88b8bc35bee8998d7c97be757640d9dd59add7afe56a507dd
Instruction ID: 0a113c21afe3f68f08a2483f40266dcb574e9cb0a3d5970273dd08787ee42a74
Opcode Fuzzy Hash: 4a113609868026f88b8bc35bee8998d7c97be757640d9dd59add7afe56a507dd
Instruction Fuzzy Hash: 222157B59003598FDF10CFA9C9857EEBBF5FF48310F10842AE959A7250C778A954CBA0

Function 0187D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0187D656,?,?,?,?,?), ref: 0187D717

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0cd7231cae04d5be99f18be92af0db01c55852aaffc2b631ea920f124879037f
Instruction ID: e6bef48db08186ebdc333cfdb3de331c12f88a55dfbd3fe959b60579dab1675b
Opcode Fuzzy Hash: 0cd7231cae04d5be99f18be92af0db01c55852aaffc2b631ea920f124879037f
Instruction Fuzzy Hash: E221D2B5900248AFDB10CF9AD984AEEFBF4EB48314F14855AE918A7310D374A954CFA5

Function 051B02C3 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 051B0348

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 72273d4c849e26dc0d7b2e54b6417b24476c5c6b1757f0f2f1a00f3b0b190534
Instruction ID: 74efb51c0f6074091b33f0cd6ce38db7fda06fe886db6b1fced74c16430a11a8
Opcode Fuzzy Hash: 72273d4c849e26dc0d7b2e54b6417b24476c5c6b1757f0f2f1a00f3b0b190534
Instruction Fuzzy Hash: 6D2148B18003499FCB10DFAAC984BDEBBF5FF48320F108429E559A7250C7789944CBA0

Function 051B0040 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 051B00BE

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 479944499fdf95522bb45004b76ab13460b0b2e44800993cde2befcf4fe8bf54
Instruction ID: 78273ef2dfda2d7ca8eb1df923b0c2de2e871266381debda48b7130038fb19ed
Opcode Fuzzy Hash: 479944499fdf95522bb45004b76ab13460b0b2e44800993cde2befcf4fe8bf54
Instruction Fuzzy Hash: E72115B19003098FDB10DFAAC5857EEBBF4EF48364F14842AD559A7240DB78A944CFA5

Function 051B02C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 051B0348

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4518ef2737fbe739c7c5d838e0a15d145fb09211ab83e94be26de92e3a7ddb69
Instruction ID: 4aadac47667fed2f18ee66806aa795f26e0892546f0f41f926386305929868df
Opcode Fuzzy Hash: 4518ef2737fbe739c7c5d838e0a15d145fb09211ab83e94be26de92e3a7ddb69
Instruction Fuzzy Hash: C22125B18003599FDB10DFAAC984AEEBBF5FF48320F10842AE559A7250C7799944CBA4

Function 0187D689 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0187D656,?,?,?,?,?), ref: 0187D717

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 178549ada40087ad00aecafd8646f685839f732bc6a0d88ea7cf8a51598716e6
Instruction ID: 6327a119f85c681d74b1288416d1194fba7b1914546b96599ca6815e38a94ef8
Opcode Fuzzy Hash: 178549ada40087ad00aecafd8646f685839f732bc6a0d88ea7cf8a51598716e6
Instruction Fuzzy Hash: D921DFB99002599FDB10CFA9D984ADEBBF5EF48314F14841AE918A3350D374AA54CFA4

Function 051B0110 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 051B0186

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01263993bee4470b53753f31b03b91b3cc95f5eaa1cd3ebe4f27986cb239ee01
Instruction ID: 1cec6a049cab309c306aefcd3c4d0b3549ec1a32b186b62121a7f400ad13e754
Opcode Fuzzy Hash: 01263993bee4470b53753f31b03b91b3cc95f5eaa1cd3ebe4f27986cb239ee01
Instruction Fuzzy Hash: 5C215672900249ABDB10DFAAC844ADFFFF5FB48320F248419E55AA7210C775A954CBA0

Function 051B0118 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 051B0186

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a9fa7562dc79e5bf523941cfe28111fedd5cc2b02fd0c29fd40c885c76af4b71
Instruction ID: 9c00db26e5ae6d496273fc8c2a13c996e31529ae9d908362c0d0885e996751a0
Opcode Fuzzy Hash: a9fa7562dc79e5bf523941cfe28111fedd5cc2b02fd0c29fd40c885c76af4b71
Instruction Fuzzy Hash: 5F1123729002499FDB10DFAAC844ADFBFF5EF88320F208819E559A7250CB75A954CFA0

Function 0582FF3B Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0582FFA2

Memory Dump Source

Source File: 00000006.00000002.1903469950.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6c30a6d6e9a02941b13d23aae3c80e2385293892adcebedfeaf072b98fdaf240
Instruction ID: 9a627a26a09f0017b0c1847b38ea5bc3e146e487642ab66ba85d1dc37bbffd14
Opcode Fuzzy Hash: 6c30a6d6e9a02941b13d23aae3c80e2385293892adcebedfeaf072b98fdaf240
Instruction Fuzzy Hash: C81128B1D043588BCB10DFAAC54579EFFF4EF88324F248419D559A7250CB75A944CB94

Function 0582FF40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0582FFA2

Memory Dump Source

Source File: 00000006.00000002.1903469950.0000000005820000.00000040.00000800.00020000.00000000.sdmp, Offset: 05820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5820000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dbd4d52a34539e29e0866a608d31c49262929d28d0f29774cb4f90248b191130
Instruction ID: 32f7204c67b6f8edd26844806eb9b9988446e085d8a7a49e00168eba4acacdf1
Opcode Fuzzy Hash: dbd4d52a34539e29e0866a608d31c49262929d28d0f29774cb4f90248b191130
Instruction Fuzzy Hash: DA1125B19042988BCB20DFAAC54579EFBF8AF88324F208429D559A7250CB75A944CBA4

Function 0187AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0187AFFE

Memory Dump Source

Source File: 00000006.00000002.1874491758.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1870000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1660f0860faf6b207d9f8afd607ae61fe45282359c2c3cb849e6884efbb14faa
Instruction ID: f8282948648c56f39ac0cd6237f519384d984151e69dc2f9b4c68a50782d644c
Opcode Fuzzy Hash: 1660f0860faf6b207d9f8afd607ae61fe45282359c2c3cb849e6884efbb14faa
Instruction Fuzzy Hash: 091110B5C002498FDB14CF9AC444ADEFBF4AF88324F10842AD529A7210D375A645CFA1

Function 051B26A0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 051B2705

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 113d967529dfa201d04c19bc64e7a1192863d1a573985d8de71f72c93b7b6911
Instruction ID: f4443dc5abb7725cdfce66b10b9dc62efbfa9a8d99f4136cfd492eca0b208f2e
Opcode Fuzzy Hash: 113d967529dfa201d04c19bc64e7a1192863d1a573985d8de71f72c93b7b6911
Instruction Fuzzy Hash: 9411F2B98003489FDB10DF9AD985BDEBBF8FB48324F208459E559A7210C3B9A544CFA5

Function 051B26A8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 051B2705

Memory Dump Source

Source File: 00000006.00000002.1900548536.00000000051B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51b0000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fa20621343dfce09f68d359aa4441f1be5388272954bc5699b1cd42d2c9501df
Instruction ID: 3ad221e3ad7dc8006adb28b826ba890dc46ce5e56570ed95494cf36b317970bd
Opcode Fuzzy Hash: fa20621343dfce09f68d359aa4441f1be5388272954bc5699b1cd42d2c9501df
Instruction Fuzzy Hash: 2111D3B58003499FDB10DF9AC985BDEBBF8FB48324F108459D559A7210C379A544CFA5

Function 07689D00 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

Tekq, xrefs: 07689EDD

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 21b19c8b9308b0b1be18b468b268b10ffc5bddb55c36a63ff1ecfb3eedd839d8
Instruction ID: 6525c9128287b95fc64e8df880345f9e3182233980d6c9b904a251159639a5b3
Opcode Fuzzy Hash: 21b19c8b9308b0b1be18b468b268b10ffc5bddb55c36a63ff1ecfb3eedd839d8
Instruction Fuzzy Hash: 0F41DBB4E157088BDB44DFAAC4486EEBBF6AF89300F14912AD41AAB354DB706906CF50

Function 07689D86 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Tekq, xrefs: 07689DD5

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 606bb80bf39d0f0b7c454f36442b0cc5f62b39f54f096dc0c230b51a9bc1f6da
Instruction ID: dad87c1350f597190dde351c267809e5b6b4beda960c6df50fd28a45b45f12c2
Opcode Fuzzy Hash: 606bb80bf39d0f0b7c454f36442b0cc5f62b39f54f096dc0c230b51a9bc1f6da
Instruction Fuzzy Hash: CC31B1B4E04209CFCB08DFE9C4849ADBBB5FF89310F20916AE91AAB365C7316945CF50

Function 07689CF0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

Tekq, xrefs: 07689EDD

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: d4dc7e79372b3fc142a4d4183fca12ff29fdd8fe1d6d66bbf61165d0110db9cd
Instruction ID: e7af6f3f3fcf2339f396e0c902a09e97fe6fd84d40609f0fa36e5a45741b524a
Opcode Fuzzy Hash: d4dc7e79372b3fc142a4d4183fca12ff29fdd8fe1d6d66bbf61165d0110db9cd
Instruction Fuzzy Hash: 2121E7B1D046088BDB58DFAAC8486EEFBF6AF89300F14C12AD415AB354DB741946CF51

Function 07685AC0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tekq, xrefs: 07685B2B

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 1edd6e47df3e2485b231277ec1f6ca39b47104b55ff9cbeb1dc38747e9454165
Instruction ID: 4364fe7d8adaecadc2bcfdd69e48f7eb52fd6e8cf8eaea8e9118040717ab1e17
Opcode Fuzzy Hash: 1edd6e47df3e2485b231277ec1f6ca39b47104b55ff9cbeb1dc38747e9454165
Instruction Fuzzy Hash: 6E115EB1B0020A8BCF54EBB999105EFB7B6AF99311B204179C506EB354EB359E11CBA1

Function 0768D486 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

Lfo, xrefs: 0768D499

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Lfo
API String ID: 0-3361531095
Opcode ID: 1b21c4589866813141385297b2936252fe97b10033af42eaeb5803485ae319ea
Instruction ID: 8410675909de320c4e88bb9ad0377a1a46e93487b944e85c82dc41a834e19a23
Opcode Fuzzy Hash: 1b21c4589866813141385297b2936252fe97b10033af42eaeb5803485ae319ea
Instruction Fuzzy Hash: 7A010474A10214CFD712DFB4D58569CBB75FB88200B20991AD425A77D9DF309C418F00

Function 07683BA4 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182176b1f5d7e6fd90075a4217d7f89c12a92a512dd22f3f4db07a17761872e5
Instruction ID: 470e7777a40d2ea46e8df5d12338b63cca0b5b2573313d2ff99b203629c32b2d
Opcode Fuzzy Hash: 182176b1f5d7e6fd90075a4217d7f89c12a92a512dd22f3f4db07a17761872e5
Instruction Fuzzy Hash: 9281D9B5B10215DFCB51DBB8D848ABEBBB6EF85310F14852AE917E7342DA308815CB61

Function 0768954C Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f5701e891586891de107161bb958bb9552486b5cc88b24688f602f78f4799b
Instruction ID: 9a617da4817dd3fbc52a0728d6731858662a0dcf9c37a582e5c1d2ae765c10da
Opcode Fuzzy Hash: 27f5701e891586891de107161bb958bb9552486b5cc88b24688f602f78f4799b
Instruction Fuzzy Hash: 4A8136B0915215CFDB90EF69C584AAEBBF6FF09315F14E295E00AAB212D730E885CF54

Function 076867B0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ce5a14223aa49d7697a72478ba757aeb37a8a45b27f01a2e65f2519765f581
Instruction ID: 153de3f4eeb5b5de9aa5369055ab4a2606001973ad908ceb8c7c520a69ff0e3c
Opcode Fuzzy Hash: 82ce5a14223aa49d7697a72478ba757aeb37a8a45b27f01a2e65f2519765f581
Instruction Fuzzy Hash: A251B5B0A10219DFDB44EBA9D9417BEB6B2FF84310F108566E506AB3DADB709C41CB91

Function 07687270 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba2d7b219f1587636f7726dd15ba298d1de8e87562795bdbb867b0ec9fa4eef
Instruction ID: 14655f554171383a4b805c31747b99850864aa660e6a3af6624401e861f9aa1e
Opcode Fuzzy Hash: bba2d7b219f1587636f7726dd15ba298d1de8e87562795bdbb867b0ec9fa4eef
Instruction Fuzzy Hash: 9751D1B0A54211CFD754ABB8C8017BABBA2EF45310F388667F516CB3A6D735D845C721

Function 076867A1 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c15ba78f9cc4df0bd00a3aa5ba5818fc3b1a0bbac8636824c6382f39956fc7
Instruction ID: 09112c1b25bd4779d4b07e9a9c6e5dda793129743a06ccca54ce69177693e045
Opcode Fuzzy Hash: c6c15ba78f9cc4df0bd00a3aa5ba5818fc3b1a0bbac8636824c6382f39956fc7
Instruction Fuzzy Hash: 7051C3B0F00219DFDB44EBA5D9407AEBAB2FF88310F108566E506AB3D9DB709C41CB91

Function 0768A4B0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c9c0542c790288faba44840ad6e23368e60af548179824d779ffd0f9af14cc
Instruction ID: 8ba90b4e95b86313840d4de3d57f150670ca09f3b07ed4effdc9fefe7b59b30f
Opcode Fuzzy Hash: b4c9c0542c790288faba44840ad6e23368e60af548179824d779ffd0f9af14cc
Instruction Fuzzy Hash: EF4138B0D152098FCB44DFEAC4446FEBBF6AB8D301F14E26AD80AA3201D7344A81CF65

Function 07685C70 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70af7c7968f0632ce222bee5826daefd17199f33230112bd2830c58441a18d53
Instruction ID: 77a4534a6e149e1bed34acaf6b25514f3e6357abad25d4c78bba8fddabf5d4d8
Opcode Fuzzy Hash: 70af7c7968f0632ce222bee5826daefd17199f33230112bd2830c58441a18d53
Instruction Fuzzy Hash: 1C41B6B5A10205DFCB919FA8D884ABDBBB6EF44700F00822BE503EB352DB719951CF65

Function 07689580 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8491d6be2a3ab5a91bcf8cb19c55b8c2853f884002b97edd4ca51a7e147d2792
Instruction ID: 231c19ba61ee020eac15ed544ff53388df1ddfab98ea575ed6a99f7c15e83396
Opcode Fuzzy Hash: 8491d6be2a3ab5a91bcf8cb19c55b8c2853f884002b97edd4ca51a7e147d2792
Instruction Fuzzy Hash: 36515AF0905216CFDB90DF68C540AAEBBB1FF0A304F04E295D00A9B602DB30E985CF55

Function 07683988 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbf3ca116067e4d863faff815aac10ec88fc383aafa87ae144dc8132cc35ee
Instruction ID: 6c245dc2f687324e827c22c3ec9cb893b026c7be14409d7fdffe9b5b75659b61
Opcode Fuzzy Hash: 52dbf3ca116067e4d863faff815aac10ec88fc383aafa87ae144dc8132cc35ee
Instruction Fuzzy Hash: 41417BB0E1520A9FCF44DFDAD9419EEFBB2FF89310F109526D509AB354E7709A018BA0

Function 07683982 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c7476ea8fe98d2f742afc7d7f8bc432bbb9dfee235a6342120d06cad2b02ab
Instruction ID: 27625b1a11a4b3c059a8dd395a82dd5b21ea851f6768f8e7b4dd173a0c53761b
Opcode Fuzzy Hash: 88c7476ea8fe98d2f742afc7d7f8bc432bbb9dfee235a6342120d06cad2b02ab
Instruction Fuzzy Hash: 274149B4E1120A9FCF44DFE6D9419EEFBB2FB89320F10952AD505A7354E7709A418BA0

Function 0768A49F Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b36ce85ab17412cd397d08eae86f360d7f1221939cb3ab66aae5c6dcce31039
Instruction ID: da90cca0a65f1f5ea70bb4bb6c8300f8ccacf58478c12008d2b96714b1927b78
Opcode Fuzzy Hash: 5b36ce85ab17412cd397d08eae86f360d7f1221939cb3ab66aae5c6dcce31039
Instruction Fuzzy Hash: BE4149B0D152088FDB44DFAAD4446EEBBF2AB8D311F14D26AE80AA7251D7344981CF65

Function 07689138 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c504aafcf31dd586d04fa694f560bd35ecc47e6105944efcebc1dfb5fcf1bef
Instruction ID: 07b9033d7e95ac5adfe9967ab88e7488d4fbd7b85f7ca6ae48dd693984fe0f42
Opcode Fuzzy Hash: 6c504aafcf31dd586d04fa694f560bd35ecc47e6105944efcebc1dfb5fcf1bef
Instruction Fuzzy Hash: 3F41C1B1D28716CFDB819FA9C8456BEB7B5FF49304F00822AE566E6280C334B950CA50

Function 076837FA Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372b25d4ee0e48053406ec029c3345e6f38a5546cd1ecf300da681acd2e915db
Instruction ID: 09c915c9dbdfdf8e5821b5248bfee484eb0fcce163ec0275daedf408db544805
Opcode Fuzzy Hash: 372b25d4ee0e48053406ec029c3345e6f38a5546cd1ecf300da681acd2e915db
Instruction Fuzzy Hash: 9D416DB0E2120ADFCB48DF99D58599EFFB1FB89310FA0D596D405A7314D7309A15CB14

Function 07683800 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393ec0514bf1754e8d97b426cf7ca4d7661da560ce5410b4dd74602ca6a512d9
Instruction ID: 5e6387e5b854e461c571c450561db86f71177e8d343ed5ef4bdbd85be3a2af69
Opcode Fuzzy Hash: 393ec0514bf1754e8d97b426cf7ca4d7661da560ce5410b4dd74602ca6a512d9
Instruction Fuzzy Hash: 64416DB0E2120AEFCB88DF99D58599EFBB1FB89310FA0D596D415A7318DB309A11CB14

Function 0768D12F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f134fc8097e4670bfcdd17971e3fad79fb4733036bc262849e8981b50ba514e
Instruction ID: 1ca54927afe1bd6095a061ed303216586f0cd30b89e675ac26d376e313491639
Opcode Fuzzy Hash: 0f134fc8097e4670bfcdd17971e3fad79fb4733036bc262849e8981b50ba514e
Instruction Fuzzy Hash: 7531E5B4A51148CFD705EF68C954BADBBB2FF49304F009A95D01AAB395DB309C86CF20

Function 076814A2 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304cc20c06b0dee8a4f41600df4b57debfcfb3a23707f2b0f050b64d8f5858ef
Instruction ID: 13b4298b759479b082170490fa0153571dfa7ae22b1548ac021c57ac64fab202
Opcode Fuzzy Hash: 304cc20c06b0dee8a4f41600df4b57debfcfb3a23707f2b0f050b64d8f5858ef
Instruction Fuzzy Hash: 00318FB090524ADFCB48CFA9C5405AEFFF1EF8A210F28C69AC412A7350D7308B42DB11

Function 076814B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97cc9dd76ee383eb6d51ee89aa5aa9c8a5947468de493dd7033e32f0d1c4138
Instruction ID: 4206b30cc2f07c72ea2c273173d7beaa33af213cac9b8a9863f399a1ff3acfdd
Opcode Fuzzy Hash: a97cc9dd76ee383eb6d51ee89aa5aa9c8a5947468de493dd7033e32f0d1c4138
Instruction Fuzzy Hash: 0C314CB0D15209DFCB48DFA9C5406AEFBF5EB8A300F24D6AAD406A7214E7309A42CB51

Function 0179D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1873903279.000000000179D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_179d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08c12754615b12e45d45bb32fbfdd7af7ff734b268ca5c5e1f21871fc49f933
Instruction ID: 5286242c5e7b91a9c5bd643624a6f0f2435e7685e33b0dc6a8fff1ad579580cf
Opcode Fuzzy Hash: e08c12754615b12e45d45bb32fbfdd7af7ff734b268ca5c5e1f21871fc49f933
Instruction Fuzzy Hash: CD2128B1500204DFDF15DF98E9C0B66FF65FB94314F20C1A9DD094B266C336E45AC6A1

Function 0179D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1873903279.000000000179D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_179d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af3f1b317bd193203a4debe818ca06ba523213d43f4895a9c3fb2bd205c6f6b
Instruction ID: 28bf47dee65c0ed88647ef44325ed9ea83ed85cde9da6f24a253d5206c305406
Opcode Fuzzy Hash: 8af3f1b317bd193203a4debe818ca06ba523213d43f4895a9c3fb2bd205c6f6b
Instruction Fuzzy Hash: A521F171500240DFDF25DF58EA80B26FF65FB88318F30C5A9E9094B256C336D45ACBA1

Function 0768FEF3 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac382bc337f8babcf0a11dfc557a1ae8ee21b0514213c24bd5828fc381982e0f
Instruction ID: bf3ad9e89a6b6ee4f38eca1383fa77b851b81bf1a1304d2b3bef73b0862eae00
Opcode Fuzzy Hash: ac382bc337f8babcf0a11dfc557a1ae8ee21b0514213c24bd5828fc381982e0f
Instruction Fuzzy Hash: 5C3118B5E112199FCB45EFA8D584AEDBBF1FF49310F04812AE801A7360DB34A945CFA4

Function 07686BB0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac68719bdcabd1b188abf4aa65fca356835c56924dc2406e52b3ac5c4bf7733f
Instruction ID: e0264129d6b9a6d08f873d4839de024a0368bc06dceda52fc87b11dbdf162eca
Opcode Fuzzy Hash: ac68719bdcabd1b188abf4aa65fca356835c56924dc2406e52b3ac5c4bf7733f
Instruction Fuzzy Hash: 5E21C3B0618255CBC750AFB9E9402BAFBA4FB46304F108637B513C6387D274996AC792

Function 0768FF00 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fb3ad8acbb37cf5f80e9d962388fe6007aa7ae34e920cb3e7c56ee13e1b4c7
Instruction ID: d19078b5fc700acd4b5cb9ce8f983837c71e2573d6d3546453ccfe452301baff
Opcode Fuzzy Hash: f9fb3ad8acbb37cf5f80e9d962388fe6007aa7ae34e920cb3e7c56ee13e1b4c7
Instruction Fuzzy Hash: 5D31E9B4E112199FCB45DFA8D4949EDBBF1FF49310F04812AE801A7360DB34A945CF90

Function 017AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874123364.00000000017AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c897a895243155408ec3ad6c31a9df293a87663f840c170d7008cf1dbdb117
Instruction ID: a62ae6198af4aadef18dd7eb65ea1ba21a3678d0f87abb4dd35f053559027403
Opcode Fuzzy Hash: f3c897a895243155408ec3ad6c31a9df293a87663f840c170d7008cf1dbdb117
Instruction Fuzzy Hash: C7210071684200DFCB25DF68D984B27FBA5EB88314F60C6A9E80A4B656C33AD446CA61

Function 017AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874123364.00000000017AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62ac0fac18e95c2f06e1cc71d1b6c21bfa6de4f42023b83c5f9f97ffeab87e1
Instruction ID: dde3901a65482191c7ae623d902f7ccfbcdda5a557c76adeb75c3e86889d713c
Opcode Fuzzy Hash: c62ac0fac18e95c2f06e1cc71d1b6c21bfa6de4f42023b83c5f9f97ffeab87e1
Instruction Fuzzy Hash: E3212971508200DFDB15DF98D5C4B26FBA5FBC4324F60C7ADD9094B696C336D446CA61

Function 07686BA1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05c2bd9212675aad187b6e71e8b65e581b015832b95c2f8c41d4a800bdbc238
Instruction ID: 9a38365e64d4ea7ca9bde2150acf03dfd06fef9dad211096668a0060bd93cc0e
Opcode Fuzzy Hash: d05c2bd9212675aad187b6e71e8b65e581b015832b95c2f8c41d4a800bdbc238
Instruction Fuzzy Hash: 2621D2F1614115CBC7509FA9E9402BAFB74FB4A315F108737E11396382C2748A6AC7A1

Function 07686D78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3de46dd9e8af9690551d41fe90258a0f4a4bc0002cc9d93d1fae8ab82f8a0e
Instruction ID: b2efa158818d414c88eecc731f23abaf38b81da8b2993401e2d3cb3d1c78abe8
Opcode Fuzzy Hash: 2c3de46dd9e8af9690551d41fe90258a0f4a4bc0002cc9d93d1fae8ab82f8a0e
Instruction Fuzzy Hash: AB1103B2614105CFD790EFA8E9427AABBB1FB06710F108A67E443DB253D275C52ADB50

Function 0768B5BB Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078d96420b740f04734ea903d77fc76b97c3a0f4fcffdebd3092e5b1e1cdeacb
Instruction ID: a005d027ad0aece15a1fd9cc5b069aca424a731287e8cc2a14088bf1fae575ab
Opcode Fuzzy Hash: 078d96420b740f04734ea903d77fc76b97c3a0f4fcffdebd3092e5b1e1cdeacb
Instruction Fuzzy Hash: 2C2190B4D192489FC744CFAAD8409EDBFB6AF8A310F44D16AE849AB352C7709446CF90

Function 0768D231 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc1f3cea7098ad9cdc1847147886c2180bf3273d9653bf3aa8db6bb5e500dc7
Instruction ID: a1c47dab6af80f2809a6e7c9400a7a6cdefae0b583c2c88b1542982d9e78e971
Opcode Fuzzy Hash: 1fc1f3cea7098ad9cdc1847147886c2180bf3273d9653bf3aa8db6bb5e500dc7
Instruction Fuzzy Hash: 67216DB4A65205CFC744EFA9E19456CBFB6FB09311B049266F42A97391DF309C81CF60

Function 0768A650 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eebe8914f0baa2d8c738487f3e0c46c3a6af6a460ec4ae4e6861157b863a93d
Instruction ID: 55f9373b2c7c73162183cb87ffe9bc636c14a497e9bbc9719db719bcede8fbb0
Opcode Fuzzy Hash: 2eebe8914f0baa2d8c738487f3e0c46c3a6af6a460ec4ae4e6861157b863a93d
Instruction Fuzzy Hash: F52130B4919109CFCB40DFE9C181AAEBBF5EF4A310F209296D806B7755C7319A81CF61

Function 0768E480 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78afbd72f293ae5b59e28260f50b92be0805ad8e4a2be9ee4e630561ce38487
Instruction ID: 331e8e0878a430fbbc935c17e68f2422b0248e1e31abe014130b66b5e9a1a2f8
Opcode Fuzzy Hash: c78afbd72f293ae5b59e28260f50b92be0805ad8e4a2be9ee4e630561ce38487
Instruction Fuzzy Hash: E11106B4B002199BCB98AE79990467F7AA6FF84720F048739E81BD7354EE32CD4587D1

Function 0768A660 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede6d7ea4738cad9c171722b45e4fcc00e8ca0a54bd8ed0cb059cb0b6244e767
Instruction ID: f13cf23351c097a106c92ea2c237eb85107d6ec29d4e7b50a822918480e4edc9
Opcode Fuzzy Hash: ede6d7ea4738cad9c171722b45e4fcc00e8ca0a54bd8ed0cb059cb0b6244e767
Instruction Fuzzy Hash: 3521DBB4D19209CFCB84DFE9C1819AEBBF5EB49300F609156D909B7715D7309A81CFA1

Function 0768AB98 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa26b7f92b1a3068a5f9f23c81786215f567ed235e53803365a12da8b456dca
Instruction ID: 33e1bdd5b47826b1f5d6c507a4f3d8b54a44db4311dfafc3a92a4702151eaa83
Opcode Fuzzy Hash: 0fa26b7f92b1a3068a5f9f23c81786215f567ed235e53803365a12da8b456dca
Instruction Fuzzy Hash: B621D6B1D006189BEB58DFABD8457DEFEF6AFC8300F14C16AD40976254DB7409468FA0

Function 07685B90 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a2a49543231656540030b09702b0bbe712d553344fdb478bc014dc4ac31491
Instruction ID: db16c68f54f57f096009a5c9b71234fdf4190d30f373d7a27d6eda7cd92c9eca
Opcode Fuzzy Hash: 92a2a49543231656540030b09702b0bbe712d553344fdb478bc014dc4ac31491
Instruction Fuzzy Hash: 5611ACB5A006164B8B15EFB999849BFB7F7EFC82607244A2DD42AD7340EF308D058B60

Function 076815E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9b3e4e2d642670ad5be023503cbfdc68dcd32b40180f6124fa3bfcf5650b30
Instruction ID: 60f0489d2222edc2843e07dea844ef30465909ac6ccc7ce1e0b8b0e14f06f831
Opcode Fuzzy Hash: 3d9b3e4e2d642670ad5be023503cbfdc68dcd32b40180f6124fa3bfcf5650b30
Instruction Fuzzy Hash: E811E7B4E01109EFCB48DFA9C545A9DFBF6EB89300F18C5AA9419A7355DB309A41CB00

Function 0179D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1873903279.000000000179D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_179d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 578fb8abe385dfaaa52af2772d41dbd5c2ff4e8704c68c57513b4dc2aba2a667
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: C711CD76404280CFCF12CF54D5C4B16BF62FB84218F24C6A9D8090B256C336D45ACBA1

Function 0179D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1873903279.000000000179D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0179D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_179d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: b65e9f97dbd0374c0535f9086790c219d9e279f6b7d4e543e881d1363be881fb
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 9611CD72404240CFDF12CF44D5C4B56BF62FB94224F24C2A9DD090B266C33AE45ACBA1

Function 0768A709 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8716973d508d4681b44cd774f2d0222399fe8ce07345dd46b5051a23cbcd53
Instruction ID: 0c26505d3aeed4dad87c85856ec30005d6039717d98bb4cc2f9d2c6312c23b78
Opcode Fuzzy Hash: 2e8716973d508d4681b44cd774f2d0222399fe8ce07345dd46b5051a23cbcd53
Instruction Fuzzy Hash: 4E114FB8D09108DFCB44EFE9C540AADBBF5FB49300F45D696985AA7305D330AA42DF40

Function 076815D0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3faba440dd0a5f7a80196f8e99d6e39f36c26a1d42aca91fa3f0f4acefc15bb1
Instruction ID: 7c3c03b4f5781cdac82e29fd329ee3cd57880371abf009f632700b2d2e2f4a15
Opcode Fuzzy Hash: 3faba440dd0a5f7a80196f8e99d6e39f36c26a1d42aca91fa3f0f4acefc15bb1
Instruction Fuzzy Hash: 34211AB4A05109DFCB49CFA9C585A9EFBF2EF89310F18C59AD4159B355DB309A41CB40

Function 07686B62 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7509bd911d5e2cb6c9986b25f6483998a84446bbcf0e661abce4f54ccda0da0
Instruction ID: 58b6b1a15780958b1c441f1b794d4e40c221874f68f24b0cab8014422f40d8d0
Opcode Fuzzy Hash: e7509bd911d5e2cb6c9986b25f6483998a84446bbcf0e661abce4f54ccda0da0
Instruction Fuzzy Hash: CD11E1E0624025CBC7906EA8E5403BAF260EB45309F009B32A2138A786D2349ABB8691

Function 0768B224 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e7020c2d366422772ee13df2b6974703383980d3b5d42e7e7f9d8f9c3c56f2
Instruction ID: b8793aacfa16e061b4519049971f4014cf77d72d14ab58f3fb0858aeb4d1c943
Opcode Fuzzy Hash: 25e7020c2d366422772ee13df2b6974703383980d3b5d42e7e7f9d8f9c3c56f2
Instruction Fuzzy Hash: 981106B0915218CFCB94EFA4C594AACB7B6FB0A311F109299D40AAB345CB359D86CF10

Function 017AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874123364.00000000017AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: c366b9269d557a12a49a5d9bd2d15fe7d96dd5251048ce307a60298435f386a5
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 62118B75508280DFDB16CF54D5C4B15FFA1FB84224F24C6AAD8494B6A6C33AD44ACB61

Function 017AD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1874123364.00000000017AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 419d6aafbf7d59bc346cc06f69d9f5a5c96972454d0e9d79c5284401ade81e32
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 0C11D075544280CFDB12CF54D5C4B16FF71FB88314F24C6AAD8494B656C33AD40ACB61

Function 0768ABA8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656dea5958b5924e9010a50066eeb4d2164c9be0e80ef582eea32fdf5ffbba44
Instruction ID: 9404423f0f6243fb86b05301a2e664fa489fa8c71f7a55c5480a30f192437d0a
Opcode Fuzzy Hash: 656dea5958b5924e9010a50066eeb4d2164c9be0e80ef582eea32fdf5ffbba44
Instruction Fuzzy Hash: 9211C3B1D016188BEB58DFABD8457DEFAF7AFC8310F14C16AD40976264DB7409468FA0

Function 0768D284 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172dfeb4b98af6d21848289ea453a955adc532025f75961597cb911e7a6c8b2d
Instruction ID: 152c69625712d787f3503224c4974eea8e15cb9875d89d502c52f8b678b04184
Opcode Fuzzy Hash: 172dfeb4b98af6d21848289ea453a955adc532025f75961597cb911e7a6c8b2d
Instruction Fuzzy Hash: 56116AB4A61206CFC740EFA9E19996DBFF6FF09310B149216E41A9B391CF309C81CB60

Function 0768A718 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4320aab29ae7736b2913e6f9089e240d738e2c2a387819ae85c5cc36f4dc152d
Instruction ID: 639bcf0099a9d10eda448f589d48f3f060ed08e74a2658decd2d6dc55827bdf9
Opcode Fuzzy Hash: 4320aab29ae7736b2913e6f9089e240d738e2c2a387819ae85c5cc36f4dc152d
Instruction Fuzzy Hash: 04113CB8D08208DFCB44EFE9D5409ADBBF5FB49310F01D6A6981AA7301D330AA41DF80

Function 0768B5F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e843d2e6747f54dfa11150f10cf2ed23bc400d489d28ec26b8919e20c12a37d8
Instruction ID: 7664882fb201e9cdd5732f840b60d88dcd33cb9f72bc079739de79f46184c72e
Opcode Fuzzy Hash: e843d2e6747f54dfa11150f10cf2ed23bc400d489d28ec26b8919e20c12a37d8
Instruction Fuzzy Hash: 5E010CB4E152199BDB48DFAAD4449AEBBF6AF8D300F00D12AE90AA7350DB705545CF90

Function 0768D1C7 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1164ba975ade87f4fff08a76550aadf28cdcc1cc5b5bdb7bff417622f5fdc59
Instruction ID: fcfa92f75e435d2e60c96854c14f2b2ea3b858fe65cdb4e06b12160c9b0d611d
Opcode Fuzzy Hash: a1164ba975ade87f4fff08a76550aadf28cdcc1cc5b5bdb7bff417622f5fdc59
Instruction Fuzzy Hash: 17115E74A61205CFC740DFA9E1954ADBFF6FF49314B009656E42A9B395CB309881CB60

Function 0768948E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333503ac5bd14a4d27e527e10abbdd331d180da108a69ff4de27529ab862260f
Instruction ID: e9840d3d27e6552cafa540795d8f4c445f7736509074e301e52e534e167cb133
Opcode Fuzzy Hash: 333503ac5bd14a4d27e527e10abbdd331d180da108a69ff4de27529ab862260f
Instruction Fuzzy Hash: 3C110CF4E19359CFDB90EF65C8407A9B7BAFB4A300F1092E9C00E97255C7306A85CB12

Function 0768BA79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1475ac2004165f25bfe2b3cd781272a5793bd77e123835490f36fbca9fd0d4
Instruction ID: ed6e7942ae16f6e59ca8931a005fa5fa42ac7c5443321de8f2a8cd96f265004b
Opcode Fuzzy Hash: 0c1475ac2004165f25bfe2b3cd781272a5793bd77e123835490f36fbca9fd0d4
Instruction Fuzzy Hash: 2A015AB4A14208EFC740EFB8D688AADBBF5FF49300F10D195A40AAB365DB309E01DB50

Function 07689517 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c2dfe8fd2f1b0d0a74f36e5be09ff48adfc99ca1f58b6c7d6470250d80199c
Instruction ID: 4eb11acb94f730de8a228f90e982612ebba6f947c333ebba9257cbde610af159
Opcode Fuzzy Hash: 09c2dfe8fd2f1b0d0a74f36e5be09ff48adfc99ca1f58b6c7d6470250d80199c
Instruction Fuzzy Hash: B3011BF4E19319CFDB90EF55C9407AEB7BAFB45300F109695D00AA7251C7306A85CF01

Function 07689D6F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2b841eb77a7df4f93feb9da510b6966bbe74047f0e957eb824ba402e80ef44
Instruction ID: 2b94a53dca9baeaf1dc8db4f64e22ebb7a2412f0e5470bd17e3a282e6e5eb338
Opcode Fuzzy Hash: 9a2b841eb77a7df4f93feb9da510b6966bbe74047f0e957eb824ba402e80ef44
Instruction Fuzzy Hash: 8001DAB4E19318CFCB84DFA5D944ABDBBF9BF4A301F14A519E40AAB355D770A802CB50

Function 0768BA01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83f9b2201142948e01698bd8980750ebba0a92104919269ab52ffa8a36a8689
Instruction ID: 1b3173e11e98814d235c15e127d1e311d2365b0523d7777de534fedb8d46e2a0
Opcode Fuzzy Hash: f83f9b2201142948e01698bd8980750ebba0a92104919269ab52ffa8a36a8689
Instruction Fuzzy Hash: 280162F0969108DFC745EFAAD5416B9BBB8EF4A300F00E365E40E6F615DB309A46DB50

Function 0768BA88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3e68a4041e052279d19806d2c379ce51ea9f8bc57613dc3c18f1395db2a8f4
Instruction ID: 013c82429703e68831dcfbf6b6736b55b63bd7b9f789ff5b94c925acbb8018b8
Opcode Fuzzy Hash: 0d3e68a4041e052279d19806d2c379ce51ea9f8bc57613dc3c18f1395db2a8f4
Instruction Fuzzy Hash: 26014FB4A14108DFC740EFA9C684AADBFF5EF49300F15D194A40DAB355DB309E01DB50

Function 07687260 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c8934f8a524ac8e4c0585bf91ff4d414af782a8575c3ae81af28480c8a7eb4
Instruction ID: 08e97e2344b8f193523dc696310bde8b25a1007aa57a071e3c01fa15571f2d36
Opcode Fuzzy Hash: 29c8934f8a524ac8e4c0585bf91ff4d414af782a8575c3ae81af28480c8a7eb4
Instruction Fuzzy Hash: 0D01D6317C53009FE31597B08916F95BBB2EB46720F294096F10A5F1F7C672C800C715

Function 0768BA10 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9232438c13f63ba7fe7d0007677a64d14d43b00b7c1752b43592d027abddcdd6
Instruction ID: a7eb776b0fa2bdba1a22982bfbec6ede2adb22f47638ca99e33381ada17de7d9
Opcode Fuzzy Hash: 9232438c13f63ba7fe7d0007677a64d14d43b00b7c1752b43592d027abddcdd6
Instruction Fuzzy Hash: DEF044F0919108DFC755EF9AD5405B9BBB8EB4A300F00E2A5940E6F616DB309B46DB54

Function 0768D25E Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114e3aa1eb58d68d2717917b26cc8de73215bb74d25a00cdf8f86b6fd4baf56a
Instruction ID: a4b6a9f2612b9403353c84e17567ee1f5a3196826cd0b4402e93815e0f9e6d51
Opcode Fuzzy Hash: 114e3aa1eb58d68d2717917b26cc8de73215bb74d25a00cdf8f86b6fd4baf56a
Instruction Fuzzy Hash: 5B018474A15204CFD745EF68E895768BB71EB4E210F209A97E41AA7384CF304D81CF20

Function 0768E410 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a43d30901d815c0670d17f2552396875ece0975d4d437a55ccb86572832d1f
Instruction ID: ae3f31c3dfb7e6d0946515d9d4e425e1f8baf1cefc82361d8214c0b2a9fd6729
Opcode Fuzzy Hash: 47a43d30901d815c0670d17f2552396875ece0975d4d437a55ccb86572832d1f
Instruction Fuzzy Hash: F5F08275A00249ABCF11DFB8D4046EDBFB1EF44325F24C29BE8146A351C7369643DB62

Function 0768AC83 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb847846af685f4ef59cb574ad9fa60d95c42d8c5121b4b3d19e3e72c9b679ce
Instruction ID: 86868a5b68495adc756f5a7dfe68bacb1b1739cca6dade46139b068482909620
Opcode Fuzzy Hash: fb847846af685f4ef59cb574ad9fa60d95c42d8c5121b4b3d19e3e72c9b679ce
Instruction Fuzzy Hash: 52F01CF46151088BC790EF98C4919ADB7B9BF09300F0AD241D41E67219C630F849CBA4

Function 0768B71C Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900a2a868bde249c6120075ac814ec556c7531d1a23a35427a7870614b3f1d0c
Instruction ID: 808914b8422676f8040fad33596b4cf0e92c000f1ef2865dd1711a2a93be3658
Opcode Fuzzy Hash: 900a2a868bde249c6120075ac814ec556c7531d1a23a35427a7870614b3f1d0c
Instruction Fuzzy Hash: 24E065B49141489FC740DF69C5458AD7FF8AB4E311B00D205F82EA7296C7709485CF20

Function 07689503 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9a073b90688a4551ffd8a2cf7246c710dd09ff5abd71bc1a86600296813bbf
Instruction ID: cff860f1d15118db4e981953e8ace285ac31441e86e9d5df519c247abbf67aa9
Opcode Fuzzy Hash: 3e9a073b90688a4551ffd8a2cf7246c710dd09ff5abd71bc1a86600296813bbf
Instruction Fuzzy Hash: 34F030F0A1631ACFDF90DF54C894BBD7B79EB05304F0456A9D00B97261CA746985CB05

Function 0768E420 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46cbd44ff434e1db4fbc8d82186b0d8a35b7a7f3cf505542e65818cffe20fb0
Instruction ID: 5b870775ace51d74d1c23ac64f01405bcb3b22ec8844b721fbbf5163d1fd475c
Opcode Fuzzy Hash: e46cbd44ff434e1db4fbc8d82186b0d8a35b7a7f3cf505542e65818cffe20fb0
Instruction Fuzzy Hash: DDF039B5E0120CEBCF40EFB8D40569CFBB1EF48310F10C0AAA808A3350DA359A55DF51

Function 07689CB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a8e6ea8223ca382b15bf806f5dfa20257ceff726c6e2eea8a6f75654cfc108
Instruction ID: 454060d63b1cd637aeadd07527cc45df32cd4b59a452f51dc876ce2692a1a023
Opcode Fuzzy Hash: 75a8e6ea8223ca382b15bf806f5dfa20257ceff726c6e2eea8a6f75654cfc108
Instruction Fuzzy Hash: 38E04872D11208AFCB80DFBCD84639D7BF4D704315F54906AD844A2340E67567419F51

Function 0768985E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9390efb548b9be1bd1380b42de6e7a81d480664673fab147694ba402de313cd1
Instruction ID: 3580cd84338062410257be6f8b9bc8fc5c5857a11abab0579d2ee47830b2ec8a
Opcode Fuzzy Hash: 9390efb548b9be1bd1380b42de6e7a81d480664673fab147694ba402de313cd1
Instruction Fuzzy Hash: 7EE0EDB0A16316CFDF91DF54CC94BACB775EB05304F1456A9D00AD7261CA746E89CF05

Function 0768AC61 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f666bea3e815f3d509a97e622c21078d3631526fdd418283b49a766f83fd09
Instruction ID: 046254b538cba00cfd670924c9e4a2c32f6a50ff891ba57c4c566220720d5b4a
Opcode Fuzzy Hash: f7f666bea3e815f3d509a97e622c21078d3631526fdd418283b49a766f83fd09
Instruction Fuzzy Hash: E6E0C2B0115214CFC364EF68D155A687B76FF0E212F40A299E40EAB711CB35DC86CF24

Function 07680B7B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290859f1ab6d024e24659b98acb8afcc277ea962253609ddf33403fa478c1f32
Instruction ID: 28e64b6740973f71ac9696e8325a158d49f3beb5c142d18f7c18853f5ba12d87
Opcode Fuzzy Hash: 290859f1ab6d024e24659b98acb8afcc277ea962253609ddf33403fa478c1f32
Instruction Fuzzy Hash: 4BF039749222199FDB50DF98C98499DBBB1FF88310F15D595E406AB329EB30EE85CF10

Function 0768B9B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971c8c79ed18a0730699ea83e0bcaac5d8fa4a8ad6e87fbfb7b301007382af3e
Instruction ID: ddc31a3017efdd3c3f208c06657fe3dd78a8f18b79af52d4727a4f943da03ec6
Opcode Fuzzy Hash: 971c8c79ed18a0730699ea83e0bcaac5d8fa4a8ad6e87fbfb7b301007382af3e
Instruction Fuzzy Hash: EAE0D8F15191959FC716D778E0156AD7F30BB07211F1081DAE84456241CB360D56C791

Function 07680B62 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcb2dbba832ca6275fff2bdce77f251f295fc2d9a14cdf64c55cece4dad5c0c
Instruction ID: b09708f68509f43e0f5e1c7ee0409afc537600249f0498895c065f8fbda033ba
Opcode Fuzzy Hash: 5bcb2dbba832ca6275fff2bdce77f251f295fc2d9a14cdf64c55cece4dad5c0c
Instruction Fuzzy Hash: 26E0CD749222159FCB45DBA0DD9529DBB74FB82321F545B514037B93ACF7394845C610

Function 0768B695 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076b75de4c1a5799f1de48132f7bc31d039ecb586668abb77019982c73108130
Instruction ID: 054c8ceb47eb3269981d1cc9ddb46893f8c7e4db73316e40bc6698ca3de3db1e
Opcode Fuzzy Hash: 076b75de4c1a5799f1de48132f7bc31d039ecb586668abb77019982c73108130
Instruction Fuzzy Hash: 51E086F450C3459FCB82CB5184454FA3FB99F4A200B445095E54E4A212DA748446CB51

Function 07686D88 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b531e7dc77834a588990883b71e6dd72d2a832ae6af5b31f833fae3983c8015
Instruction ID: 7c5cf6c3c0e8dff383bebb2f9175b50543ba85ae6efebc5a314b14757cee21f5
Opcode Fuzzy Hash: 2b531e7dc77834a588990883b71e6dd72d2a832ae6af5b31f833fae3983c8015
Instruction Fuzzy Hash: EFE092B0D40209DFD780EFA9C909B9EBBF1AB08600F1185A9D41AE7352EB7496058F91

Function 0768B9C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df44b0e7a4c0b85802f970b6aa37e1b3fe41f5e52219b9d7adc72272795334d
Instruction ID: bf82c41f42d1374f5e143134a2a96466cef9b161f8fb55693ba2b3a1fd1ae987
Opcode Fuzzy Hash: 4df44b0e7a4c0b85802f970b6aa37e1b3fe41f5e52219b9d7adc72272795334d
Instruction Fuzzy Hash: 0AE086B1801208DBC704DFA8D40559DBF74AB05301F10C1A9E50462340CB314A41DBA0

Function 0768D6A7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97030477de9c756f300bffe7fc5347bd4453734ca80bb03e42e326e25d225af3
Instruction ID: 0426a64763b28dc2b9dd3b5855a92bf2653d6dd708945d0956f23dd8c8807d30
Opcode Fuzzy Hash: 97030477de9c756f300bffe7fc5347bd4453734ca80bb03e42e326e25d225af3
Instruction Fuzzy Hash: A2E01A74A50219DFCB40DF94D5496ACBBB6FB48320F104315E425AB3D8DB305C42CB80

Function 07689CC0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8049e64ccb3c18b7f5b2907f7f64bb3787e1f30b12deba6b3c1886f8e35e760b
Instruction ID: 110d3dee3aee1d2a42874fb9a1c071b8e1f98aa7892169f3b0677cd6688ca028
Opcode Fuzzy Hash: 8049e64ccb3c18b7f5b2907f7f64bb3787e1f30b12deba6b3c1886f8e35e760b
Instruction Fuzzy Hash: F8E01270D51208DFCB80EFBCD94569CBFF4AB04311F1041AAE804A3340EA315B40CF51

Function 076801FD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80d05d27c40831e4b44a26c0f5e782a1a174f6b3957ade31b48b0439a810a19
Instruction ID: 2df0fd07b57b547e523ce45fcb96d1378d7a8978f8ce62b598b9b645681c00cb
Opcode Fuzzy Hash: e80d05d27c40831e4b44a26c0f5e782a1a174f6b3957ade31b48b0439a810a19
Instruction Fuzzy Hash: 59E0EC75617304CFC759CF68C185959BBB6FF49311F5044A9E0069B355CB36EA81CF00

Function 0768AD24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c867aba32f2f7c289768dbb47a405b92aed742d7954cfbe144e7837c681344a
Instruction ID: 82605f1b73e1d368e523150f63b8971416255431cd415579327a21f8ec57ec40
Opcode Fuzzy Hash: 9c867aba32f2f7c289768dbb47a405b92aed742d7954cfbe144e7837c681344a
Instruction Fuzzy Hash: EBE0E2B4219254CFC364EF24C058A653B7AAF0B312F4052E9E00E5B752CB35D885CF14

Function 07686040 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5469aaad4d7801ad5c62897c7b38efcb6f849d85bd37d624b2377c52c10d9309
Instruction ID: 246003361e6ae6c9cdd6615bfdf99be13eb861f9d1124a5e746b28ddf105ccfb
Opcode Fuzzy Hash: 5469aaad4d7801ad5c62897c7b38efcb6f849d85bd37d624b2377c52c10d9309
Instruction Fuzzy Hash: 85C08C5A2987A2CEC3079B60690A4F6BBB0BEA7B1031000C3D2449B193C2240B29C377

Function 07683B84 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119a182edf289e449201455cf4e52db5d142fbe9f57763ae6a166526344b07ea
Instruction ID: bd377ea5bebef7d8eb57af0dec57e94cff90214e65b5db3bd013772682d466eb
Opcode Fuzzy Hash: 119a182edf289e449201455cf4e52db5d142fbe9f57763ae6a166526344b07ea
Instruction Fuzzy Hash: 85C04C75055001DAC641BB5489C481AFAA1FBA6700F40D955664685135D622C82D9716

Function 07683C2C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8e5118c6ddcd79faa5e5bb2939b0267e6c24395b35dd2282c32885fabe5c25
Instruction ID: b938e9bc9b0d32e21c9bdcfd12154d1c7ac58d78cd65b1f82fdc1238eeaf767b
Opcode Fuzzy Hash: 4f8e5118c6ddcd79faa5e5bb2939b0267e6c24395b35dd2282c32885fabe5c25
Instruction Fuzzy Hash: 21B012B52E9110E5C90077648F89F3ED6E1EBE3700F509C153347A0055C421D86DE12F

Function 07685A89 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1916575623.0000000007680000.00000040.00000800.00020000.00000000.sdmp, Offset: 07680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7680000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df842828702483ccf0a6a08d99a8220785b299cb2035eeedb882810a8f13181
Instruction ID: da49ca8a6b6b252c1e1d48c542b0ce361970ec3a4f62870d8b04a8d06d6fe28f
Opcode Fuzzy Hash: 9df842828702483ccf0a6a08d99a8220785b299cb2035eeedb882810a8f13181
Instruction Fuzzy Hash: E2C08C6900D1C0CFC7076F61A91C851BF71EF2A20470840CAE0C40A133C51A0835DB1A

Analysis Process: Exccelworkbook.exePID: 6724, Parent PID: 6576COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	75
Total number of Limit Nodes:	7

Executed Functions

Function 0141C003 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0141C256

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e406f856ae87aac7c6aca518ace5c89716d8756866e0bede7531bcbf7861d6d9
Instruction ID: 2ef0fd4c024f412ea273b7886e4fb9b00593aabac50209d480bd60c290cecf7e
Opcode Fuzzy Hash: e406f856ae87aac7c6aca518ace5c89716d8756866e0bede7531bcbf7861d6d9
Instruction Fuzzy Hash: B07147B0A40B458FD724DF6AC98079BBBF1BF48204F10892ED48AD7B64D775E946CB90

Function 01416414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01417421

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 95b9808b5b14534447500cb1fcb4e8aab95c651c5d2795623da9ac37bf47a682
Instruction ID: 0705f5f78a0b6155e7986987b38c7f11f476f80af62e0fefbb8664be555e328f
Opcode Fuzzy Hash: 95b9808b5b14534447500cb1fcb4e8aab95c651c5d2795623da9ac37bf47a682
Instruction Fuzzy Hash: 7641C0B0C0061DCFDB24DFA9C944B9EBBF5BF49304F24806AD408AB265DB756985CF90

Function 01417364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01417421

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6ffbc5edb1b716c2c3fede88ff8230bcae394f1f051d64d6c3264eb36a57f7da
Instruction ID: 9b2184f58bbc7f84b6164db8656115c5aac0376eee03a569e40945c73ee471f0
Opcode Fuzzy Hash: 6ffbc5edb1b716c2c3fede88ff8230bcae394f1f051d64d6c3264eb36a57f7da
Instruction Fuzzy Hash: 6A41D1B1C40619CFDB24CFA9C944BDEBBF5BF49304F2480AAD408AB265DB755949CF90

Function 01416780 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0141674E,?,?,?,?,?), ref: 0141680F

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2165bb710450dd27bb27be34d869e8d406ef134dadef2b6c001cda40dd26cd8
Instruction ID: c133e31a02bf28d5a328f97555062f5e13924937ec96167c8cdf9985f85b5a76
Opcode Fuzzy Hash: d2165bb710450dd27bb27be34d869e8d406ef134dadef2b6c001cda40dd26cd8
Instruction Fuzzy Hash: BB21F4B5900248AFDB10CFAAD884AEEBFF4EB48320F14801AE954A7311D774A940CFA5

Function 0141611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0141674E,?,?,?,?,?), ref: 0141680F

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8714a8e8814f16443782cf9a0935c74ad66f3526b175b84c244b447d2641deee
Instruction ID: b8d3de53ce2167afbf8084cc465489401f43b4920c96690ce29c8c05ae82c09e
Opcode Fuzzy Hash: 8714a8e8814f16443782cf9a0935c74ad66f3526b175b84c244b447d2641deee
Instruction Fuzzy Hash: 2521E3B5900248AFDB10CF9AD984ADEBFF8FB48320F14841AE958A7310D374A940CFA5

Function 0141C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0141C256

Memory Dump Source

Source File: 00000009.00000002.4181823411.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1410000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 509f9b5db84c950798d986205b83e485351f5aeec68992f06e95b5392f9debd7
Instruction ID: a57a097482261efa4ed279492e297145c8bca10dd31170d1b97c57e4df1e2401
Opcode Fuzzy Hash: 509f9b5db84c950798d986205b83e485351f5aeec68992f06e95b5392f9debd7
Instruction Fuzzy Hash: 721110B5C002498FDB10DF9AC844ADEFBF4AB88320F10842AD829B7210C3B9A545CFA1

Function 0138D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4181380895.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe525d403c45a5ad86edf7d6317f6d6ab544ca51736af81b5c7b04d84d78602
Instruction ID: 17b582227c59ba50c3b5ae452d7ab4cebdbec33e3f05d3f282252574df9fdf76
Opcode Fuzzy Hash: 4fe525d403c45a5ad86edf7d6317f6d6ab544ca51736af81b5c7b04d84d78602
Instruction Fuzzy Hash: 542122B1604304DFDB15EF98D984B26BFA5FB84318F20C56DD80A4B396C33AD447CA61

Function 0138D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4181380895.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_138d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: af53d568839933dc112eab31eca0de8df607c81ea012b28f3e35ef4ab21a8390
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7311BEB5504380CFDB12DF54D5C4B15BF61FB44318F24C6AAD8494B696C33AD40BCB61

Function 0137D603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4181284832.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_137d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4844497bdd83abce1c20f006312f9cd53477cc1838d2cc5221dfe092c6e0d30c
Instruction ID: 357038debfd168db5404b46c2a75024096692687fd79c7ea86f7b432da79ecf2
Opcode Fuzzy Hash: 4844497bdd83abce1c20f006312f9cd53477cc1838d2cc5221dfe092c6e0d30c
Instruction Fuzzy Hash: 71F04976200600AFD3208F0AD884C23FBADFFC4634719C05AE84A4B612C271FC42CEA0

Function 0137D5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4181284832.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_137d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb68d65dfb7c1b8e160e191d0fc919db0f40903917848f56c0fa952718329b2
Instruction ID: 69c697c2536dbff9f9968292f02833c24b46dc292541ade97312b77be6d74bf4
Opcode Fuzzy Hash: 7eb68d65dfb7c1b8e160e191d0fc919db0f40903917848f56c0fa952718329b2
Instruction Fuzzy Hash: 78F0E775104680AFD725CF16CD84C22BBB9FF8A6647198489E84A9B762C675FC42CFA0

Analysis Process: Exccelworkbook.exePID: 1816, Parent PID: 3060COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	8

Executed Functions

Function 03306530 Relevance: 6.1, APIs: 4, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 033065BE
GetCurrentThread.KERNEL32 ref: 033065FB
GetCurrentProcess.KERNEL32 ref: 03306638
GetCurrentThreadId.KERNEL32 ref: 03306691

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5880cfe70bfc56e8391c4c8203e842292008aa411ae5e9cd2a6604bde8e78d86
Instruction ID: 9bcf41043c96866f7b4f7d21472d8d02da9988e90b8ff753e807bd7729191831
Opcode Fuzzy Hash: 5880cfe70bfc56e8391c4c8203e842292008aa411ae5e9cd2a6604bde8e78d86
Instruction Fuzzy Hash: 285187B49002498FDB14DFA9D988BDEBFF1EF48304F248059D049AB3A5DB349944CF65

Function 03306540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 033065BE
GetCurrentThread.KERNEL32 ref: 033065FB
GetCurrentProcess.KERNEL32 ref: 03306638
GetCurrentThreadId.KERNEL32 ref: 03306691

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: df2863f6c97f90a5a2316e19b1b62ca5c6f56779b9f982d69654bdf18d6c94ec
Instruction ID: 44bf1f61def65ec2ff401211510038f751693047c05df11f971ea081981360a4
Opcode Fuzzy Hash: df2863f6c97f90a5a2316e19b1b62ca5c6f56779b9f982d69654bdf18d6c94ec
Instruction Fuzzy Hash: 6F5144B49102098FDB14DFA9C988B9EFBF5EF48304F248459E409A73A4DB34A984CF65

Function 0330BFF0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0330C256

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 91a9d611b60038b6b1809924fa0e8b0581d6947a1cd4deebcff9efb5978ac8d3
Instruction ID: eeeb69b87656cdfac98e87c52e7cfc01f0745dde3423fbd266f8d7cb260f74a5
Opcode Fuzzy Hash: 91a9d611b60038b6b1809924fa0e8b0581d6947a1cd4deebcff9efb5978ac8d3
Instruction Fuzzy Hash: EB8135B0A00B058FD724DF69D99075ABBF5FF48300F048A6DD486DBA90D775E849CB91

Function 03307364 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03307421

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fe03c44c906828528d8b0f76b99e254e6be17824d91d8747f7f2b3599955db4a
Instruction ID: 7b9b81d18a94a2e6b259961f6aac560d63557b2961b54887a8b7db3b204a79cd
Opcode Fuzzy Hash: fe03c44c906828528d8b0f76b99e254e6be17824d91d8747f7f2b3599955db4a
Instruction Fuzzy Hash: 5B41C0B0C00619CFDB25CFA9C98478EBBB5BF49304F24805AD458AB265DB756985CF90

Function 03306414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03307421

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ae01b2290800a48cb794c065ea20dd041180712ae31f055fe898baa13dffdd26
Instruction ID: 550d532fb9fed1b5052e6117f9326153d22e58416311daeca6be881173b55623
Opcode Fuzzy Hash: ae01b2290800a48cb794c065ea20dd041180712ae31f055fe898baa13dffdd26
Instruction Fuzzy Hash: 6641D2B0C0461DCFDB25CFA9C8847CEBBB5BF44304F24805AD418AB265DB756985CF90

Function 03306780 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0330680F

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fb897f38c266027339f614a032bbb1a3b22eeb0f0176afe6dc7131f0acbffddf
Instruction ID: f456514a440cb9d6d5cb1dc49412db1203deb588df147302356d29f2f65823fb
Opcode Fuzzy Hash: fb897f38c266027339f614a032bbb1a3b22eeb0f0176afe6dc7131f0acbffddf
Instruction Fuzzy Hash: 8721F4B5D00219DFDB10CF99D984AEEBBF8FB48320F14802AE954A7350D334A954CFA5

Function 03306788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0330680F

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d3e946b318600b93891a1c0ae6cf5d5a5b5346d86f69dfc0c461e7752303f59e
Instruction ID: 6d6f982ed1cf9a7c4ff188c752497c1afae91b5e30b69205e47efe4684c07298
Opcode Fuzzy Hash: d3e946b318600b93891a1c0ae6cf5d5a5b5346d86f69dfc0c461e7752303f59e
Instruction Fuzzy Hash: CF21E3B59002189FDB10CF9AD984ADEFBF8EB48320F14841AE954A7250D374A950CFA5

Function 0330C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0330C256

Memory Dump Source

Source File: 00000010.00000002.1900792648.0000000003300000.00000040.00000800.00020000.00000000.sdmp, Offset: 03300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3300000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1e64bc142d86c39eb35738a3dff9f61f2706bfddf7705acb20057e4d13438461
Instruction ID: 2a9b949c562cb4762794ca28a790fd6cac61ae720d3ae73778fbf5d3e8a23f00
Opcode Fuzzy Hash: 1e64bc142d86c39eb35738a3dff9f61f2706bfddf7705acb20057e4d13438461
Instruction Fuzzy Hash: CA1110B5C002498FCB10DF9AC844ADEFBF8AB88320F14852AD469BB650C375A545CFA5

Function 018CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899335889.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_18cd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5ca25700e8e800836abc678964da97a5f48001e2720812f32cb2f8b0f1a182
Instruction ID: 20119832436407fdc6acfe7107aa57b5fc5fce265f1273bf64f7ba1626c41fdf
Opcode Fuzzy Hash: 9d5ca25700e8e800836abc678964da97a5f48001e2720812f32cb2f8b0f1a182
Instruction Fuzzy Hash: 43210071604204DFCB15EF58D9C4B26BBA5EB84B18F20C67DD80A8B256C33AD547CAA1

Function 018CD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1899335889.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_18cd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: a7f479fd8260b4b6c8fa89aeca40555210b8e2cddd4b2a457a7cdb97208c5035
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B311EB75504280CFCB02DF18D5C4B16BFA2FB84314F24C6AED8098B656C33AD40ACBA2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Exccelworkbook.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe.log

C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre