Edit tour

Windows Analysis Report
VSLS SCHEDULE_pdf.exe

Overview

General Information

Sample name:	VSLS SCHEDULE_pdf.exe
Analysis ID:	1585951
MD5:	ea999998326f1b7061dfcf2def8e1d1b
SHA1:	513f32a0d21c87ebe413c7cf3cbc99138ec374c5
SHA256:	abc0b5e65132918208e06122ecfe2172c468494da7b0e48cc40f8475138153b2
Tags:	exeuser-James_inthe_box
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

VSLS SCHEDULE_pdf.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe" MD5: EA999998326F1B7061DFCF2DEF8E1D1B)

VSLS SCHEDULE_pdf.exe (PID: 7164 cmdline: "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe" MD5: EA999998326F1B7061DFCF2DEF8E1D1B)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "export.dryer@friuleir.com", "Password": "Godisgood101", "Server": "us2.smtp.mailhostbox.com", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa43ff:$a1: get_encryptedPassword 0xbb22f:$a1: get_encryptedPassword 0xd1e4f:$a1: get_encryptedPassword 0xa4727:$a2: get_encryptedUsername 0xbb557:$a2: get_encryptedUsername 0xd2177:$a2: get_encryptedUsername 0xa419a:$a3: get_timePasswordChanged 0xbafca:$a3: get_timePasswordChanged 0xd1bea:$a3: get_timePasswordChanged 0xa42bb:$a4: get_passwordField 0xbb0eb:$a4: get_passwordField 0xd1d0b:$a4: get_passwordField 0xa4415:$a5: set_encryptedPassword 0xbb245:$a5: set_encryptedPassword 0xd1e65:$a5: set_encryptedPassword 0xa5d71:$a7: get_logins 0xbcba1:$a7: get_logins 0xd37c1:$a7: get_logins 0xa5a22:$a8: GetOutlookPasswords 0xbc852:$a8: GetOutlookPasswords 0xd3472:$a8: GetOutlookPasswords
00000002.00000002.3243663897.0000000002834000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe53e:$a1: get_encryptedPassword 0xe7d9:$a2: get_encryptedUsername 0xe2fa:$a3: get_timePasswordChanged 0xe40e:$a4: get_passwordField 0xe554:$a5: set_encryptedPassword 0xf9ef:$a7: get_logins 0xf71d:$a8: GetOutlookPasswords 0xf557:$a9: StartKeylogger 0xf954:$a10: KeyLoggerEventArgs 0xf5b4:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3549:$a1: get_encryptedPassword 0x3862:$a2: get_encryptedUsername 0x32f8:$a3: get_timePasswordChanged 0x3419:$a4: get_passwordField 0x355f:$a5: set_encryptedPassword 0x4e62:$a7: get_logins 0x4b13:$a8: GetOutlookPasswords 0x4905:$a9: StartKeylogger 0x4db2:$a10: KeyLoggerEventArgs 0x4962:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12371:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1186f:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b7d:$a4: \Orbitum\User Data\Default\Login Data 0x12975:$a5: \Kometa\User Data\Default\Login Data
2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14171:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1366f:$a3: \Google\Chrome\User Data\Default\Login Data 0x1397d:$a4: \Orbitum\User Data\Default\Login Data 0x14775:$a5: \Kometa\User Data\Default\Login Data
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x2600f:$a1: get_encryptedPassword 0x3cc2f:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26337:$a2: get_encryptedUsername 0x3cf57:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25daa:$a3: get_timePasswordChanged 0x3c9ca:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25ecb:$a4: get_passwordField 0x3caeb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x26025:$a5: set_encryptedPassword 0x3cc45:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27981:$a7: get_logins 0x3e5a1:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27632:$a8: GetOutlookPasswords 0x3e252:$a8: GetOutlookPasswords
0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14171:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2afa1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41bc1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1366f:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a49f:$a3: \Google\Chrome\User Data\Default\Login Data 0x410bf:$a3: \Google\Chrome\User Data\Default\Login Data 0x1397d:$a4: \Orbitum\User Data\Default\Login Data 0x2a7ad:$a4: \Orbitum\User Data\Default\Login Data 0x413cd:$a4: \Orbitum\User Data\Default\Login Data 0x14775:$a5: \Kometa\User Data\Default\Login Data 0x2b5a5:$a5: \Kometa\User Data\Default\Login Data 0x421c5:$a5: \Kometa\User Data\Default\Login Data
0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5024f:$a1: get_encryptedPassword 0x6707f:$a1: get_encryptedPassword 0x7dc9f:$a1: get_encryptedPassword 0x50577:$a2: get_encryptedUsername 0x673a7:$a2: get_encryptedUsername 0x7dfc7:$a2: get_encryptedUsername 0x4ffea:$a3: get_timePasswordChanged 0x66e1a:$a3: get_timePasswordChanged 0x7da3a:$a3: get_timePasswordChanged 0x5010b:$a4: get_passwordField 0x66f3b:$a4: get_passwordField 0x7db5b:$a4: get_passwordField 0x50265:$a5: set_encryptedPassword 0x67095:$a5: set_encryptedPassword 0x7dcb5:$a5: set_encryptedPassword 0x51bc1:$a7: get_logins 0x689f1:$a7: get_logins 0x7f611:$a7: get_logins 0x51872:$a8: GetOutlookPasswords 0x686a2:$a8: GetOutlookPasswords 0x7f2c2:$a8: GetOutlookPasswords
0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x551e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x6c011:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x82c31:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x546df:$a3: \Google\Chrome\User Data\Default\Login Data 0x6b50f:$a3: \Google\Chrome\User Data\Default\Login Data 0x8212f:$a3: \Google\Chrome\User Data\Default\Login Data 0x549ed:$a4: \Orbitum\User Data\Default\Login Data 0x6b81d:$a4: \Orbitum\User Data\Default\Login Data 0x8243d:$a4: \Orbitum\User Data\Default\Login Data 0x557e5:$a5: \Kometa\User Data\Default\Login Data 0x6c615:$a5: \Kometa\User Data\Default\Login Data 0x83235:$a5: \Kometa\User Data\Default\Login Data
0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x7a07f:$a1: get_encryptedPassword 0x90eaf:$a1: get_encryptedPassword 0xa7acf:$a1: get_encryptedPassword 0x7a3a7:$a2: get_encryptedUsername 0x911d7:$a2: get_encryptedUsername 0xa7df7:$a2: get_encryptedUsername 0x79e1a:$a3: get_timePasswordChanged 0x90c4a:$a3: get_timePasswordChanged 0xa786a:$a3: get_timePasswordChanged 0x79f3b:$a4: get_passwordField 0x90d6b:$a4: get_passwordField 0xa798b:$a4: get_passwordField 0x7a095:$a5: set_encryptedPassword 0x90ec5:$a5: set_encryptedPassword 0xa7ae5:$a5: set_encryptedPassword 0x7b9f1:$a7: get_logins 0x92821:$a7: get_logins 0xa9441:$a7: get_logins 0x7b6a2:$a8: GetOutlookPasswords 0x924d2:$a8: GetOutlookPasswords 0xa90f2:$a8: GetOutlookPasswords
0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x7f011:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x95e41:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xaca61:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e50f:$a3: \Google\Chrome\User Data\Default\Login Data 0x9533f:$a3: \Google\Chrome\User Data\Default\Login Data 0xabf5f:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e81d:$a4: \Orbitum\User Data\Default\Login Data 0x9564d:$a4: \Orbitum\User Data\Default\Login Data 0xac26d:$a4: \Orbitum\User Data\Default\Login Data 0x7f615:$a5: \Kometa\User Data\Default\Login Data 0x96445:$a5: \Kometa\User Data\Default\Login Data 0xad065:$a5: \Kometa\User Data\Default\Login Data
Click to see the 20 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T15:06:55.926592+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VSLS SCHEDULE_pdf.exe

Avira: detected

Found malware configuration

Source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "export.dryer@friuleir.com", "Password": "Godisgood101", "Server": "us2.smtp.mailhostbox.com", "Port": 587}

Multi AV Scanner detection for submitted file

Source: VSLS SCHEDULE_pdf.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: VSLS SCHEDULE_pdf.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: VSLS SCHEDULE_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.0

Source: VSLS SCHEDULE_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Stubs Fully\Public\Public Runpe\PR\PR\obj\Debug\Poses.pdb source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010321287.0000000002F71000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 00DF5782h	2_2_00DF5367
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 00DF51B9h	2_2_00DF4F08
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 00DF5782h	2_2_00DF56AF
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C1935h	2_2_011C15F8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CEBD0h	2_2_011CE928
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CCC30h	2_2_011CC988
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C1449h	2_2_011C11A0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CF480h	2_2_011CF1D8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CBAD0h	2_2_011CB828
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C02E9h	2_2_011C0040
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CE320h	2_2_011CE078
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C4350h	2_2_011C40A8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CC380h	2_2_011CC0D8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C0B99h	2_2_011C08F0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CADC8h	2_2_011CAB20
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C3648h	2_2_011C33A0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CB678h	2_2_011CB3D0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CD4E0h	2_2_011CD238
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CA518h	2_2_011CA270
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CFD30h	2_2_011CFA88
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C2D98h	2_2_011C2AF0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CC7D8h	2_2_011CC530
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C0FF1h	2_2_011C0D48
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CF028h	2_2_011CED80
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CD088h	2_2_011CCDE0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CDEC8h	2_2_011CDC20
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C3EF8h	2_2_011C3C50
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C0741h	2_2_011C0498
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CBF28h	2_2_011CBC80
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CA0C0h	2_2_011C9CA0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CE778h	2_2_011CE4D0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C31F0h	2_2_011C2F48
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CB220h	2_2_011CAF78
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011C3AA0h	2_2_011C37F8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CF8D8h	2_2_011CF630
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CD93Ah	2_2_011CD690
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 4x nop then jmp 011CA970h	2_2_011CA6C8

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49706 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.0000000002742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000277B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000277B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, UltraSpeed.cs

.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: VSLS SCHEDULE_pdf.exe

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 0_2_0144E084	0_2_0144E084
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 0_2_09151720	0_2_09151720
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFC168	2_2_00DFC168
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF27B9	2_2_00DF27B9
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFCAB0	2_2_00DFCAB0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF2DD1	2_2_00DF2DD1
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF7E68	2_2_00DF7E68
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF4F08	2_2_00DF4F08
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFB9E0	2_2_00DFB9E0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFCAAF	2_2_00DFCAAF
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF4EF8	2_2_00DF4EF8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DF7E67	2_2_00DF7E67
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C6A20	2_2_011C6A20
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C4500	2_2_011C4500
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C15F8	2_2_011C15F8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C1C58	2_2_011C1C58
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C7780	2_2_011C7780
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE928	2_2_011CE928
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE922	2_2_011CE922
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC97A	2_2_011CC97A
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C118F	2_2_011C118F
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC988	2_2_011CC988
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C11A0	2_2_011C11A0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CF1D8	2_2_011CF1D8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CF1C8	2_2_011CF1C8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CB818	2_2_011CB818
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C0032	2_2_011C0032
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CB828	2_2_011CB828
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C0040	2_2_011C0040
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE078	2_2_011CE078
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE068	2_2_011CE068
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C4098	2_2_011C4098
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C40A8	2_2_011C40A8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C08DF	2_2_011C08DF
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC0D8	2_2_011CC0D8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC0CE	2_2_011CC0CE
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C08F0	2_2_011C08F0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CAB10	2_2_011CAB10
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CAB20	2_2_011CAB20
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C3391	2_2_011C3391
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C33A0	2_2_011C33A0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CB3D0	2_2_011CB3D0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CB3C1	2_2_011CB3C1
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CD238	2_2_011CD238
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CD232	2_2_011CD232
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CFA78	2_2_011CFA78
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CA270	2_2_011CA270
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CA261	2_2_011CA261
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CFA88	2_2_011CFA88
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C2AF0	2_2_011C2AF0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C2AE0	2_2_011C2AE0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C0D3A	2_2_011C0D3A
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC530	2_2_011CC530
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CC52A	2_2_011CC52A
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C0D48	2_2_011C0D48
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CED70	2_2_011CED70
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CED80	2_2_011CED80
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CCDDA	2_2_011CCDDA
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C15EA	2_2_011C15EA
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CCDE0	2_2_011CCDE0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CDC11	2_2_011CDC11
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CDC20	2_2_011CDC20
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C3C50	2_2_011C3C50
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C1C4A	2_2_011C1C4A
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C3C41	2_2_011C3C41
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CBC71	2_2_011CBC71
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C0498	2_2_011C0498
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C048A	2_2_011C048A
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CBC80	2_2_011CBC80
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C9CA0	2_2_011C9CA0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE4D0	2_2_011CE4D0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CE4C0	2_2_011CE4C0
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C2F38	2_2_011C2F38
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C2F48	2_2_011C2F48
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CAF78	2_2_011CAF78
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CAF68	2_2_011CAF68
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C37F8	2_2_011C37F8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011C37E8	2_2_011C37E8
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CF630	2_2_011CF630
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CF620	2_2_011CF620
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CD690	2_2_011CD690
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CD681	2_2_011CD681
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CA6B9	2_2_011CA6B9
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_011CA6C8	2_2_011CA6C8

Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVebinace.dll2 vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2009598984.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010321287.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000000.2003354915.0000000000AA2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNone.exe* vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010321287.0000000002FEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010321287.0000000002FEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242189429.0000000000537000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242535570.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.000000000055A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs VSLS SCHEDULE_pdf.exe
Source: VSLS SCHEDULE_pdf.exe	Binary or memory string: OriginalFilenameNone.exe* vs VSLS SCHEDULE_pdf.exe

Source: VSLS SCHEDULE_pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: VSLS SCHEDULE_pdf.exe, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, AirFilter.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, AirFilter.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, EngineBlock.cs	Suspicious method names: .EngineBlock.FuelInjectionType
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorType
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.AreInjectorsClogged
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorDutyCycle
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorFlowRate
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorType
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.AreInjectorsClogged
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorDutyCycle
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, FuelInjector.cs	Suspicious method names: .FuelInjector.InjectorFlowRate
Source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, EngineBlock.cs	Suspicious method names: .EngineBlock.FuelInjectionType

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VSLS SCHEDULE_pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Mutant created: NULL

Source: VSLS SCHEDULE_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VSLS SCHEDULE_pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000027BE000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3244407948.000000000370D000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000027CE000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000027FD000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000027DC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: VSLS SCHEDULE_pdf.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process created: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process created: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: VSLS SCHEDULE_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: VSLS SCHEDULE_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: VSLS SCHEDULE_pdf.exe, Form1.cs	.Net Code: Form1_Load System.Reflection.Assembly.Load(byte[])
Source: VSLS SCHEDULE_pdf.exe, Form1.cs	.Net Code: Form1_Load

Source: VSLS SCHEDULE_pdf.exe

Static PE information: 0x827F415A [Thu May 19 00:31:22 2039 UTC]

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFF273 push ebp; retf		2_2_00DFF281
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Code function: 2_2_00DFB544 push eax; retf		2_2_00DFB545

Source: VSLS SCHEDULE_pdf.exe

Static PE information: section name: .text entropy: 7.7580330271790805

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: 1440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe TID: 6776

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242535570.00000000006E6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Code function: 2_2_00DFC168 LdrInitializeThunk,LdrInitializeThunk,

2_2_00DFC168

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.VSLS SCHEDULE_pdf.exe.2fd28b4.1.raw.unpack, EngineAlgorithm.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.VSLS SCHEDULE_pdf.exe.2fd28b4.1.raw.unpack, EngineAlgorithm.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Process created: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe "C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3243663897.0000000002834000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.VSLS SCHEDULE_pdf.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.400e220.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fcd1b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VSLS SCHEDULE_pdf.exe.3fa3380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VSLS SCHEDULE_pdf.exe PID: 7164, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Data from Local System	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
VSLS SCHEDULE_pdf.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.MassloggerRAT
VSLS SCHEDULE_pdf.exe	100%	Avira	HEUR/AGEN.1306813
VSLS SCHEDULE_pdf.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000277B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000277B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.0000000002742000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	VSLS SCHEDULE_pdf.exe, 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, VSLS SCHEDULE_pdf.exe, 00000002.00000002.3243663897.000000000275E000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	reallyfreegeoip.org	European Union		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585951
Start date and time:	2025-01-08 15:06:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VSLS SCHEDULE_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 51 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.164, 172.202.163.200, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: VSLS SCHEDULE_pdf.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
193.122.130.0	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ORDER REF 47896798 PSMCO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.53.168
	Selvi Payroll Benefits & Bonus Agreementfdp.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://e.trustifi.com/#/fff2a0/670719/6dc158/ef68bf/5e1243/19ce62/f4cd99/c6b84a/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d78873/cd64d0/869af2/e9ab57/7015c1/91dda7/f34c0a/f30b47/688cba/a1d645/18dc79/33d9f9/9ee0a0/c61099/8f2456/8e1864/996369/790047/a93a09/347b17/38082d/363d49/f88c07/81bae2/57a7bb/6027c6/942952/b2de1b/e98aef/6a05c2/91297b/c70871/7f29c3/0a450d/ad0cac/967c2a/e7cb67/6e1193/8c4088/13aef1/e1d296/5056d4/51a97e/89a35b/c13e69/fa274a/5b7c2e/a8c901/02856f/1e0211/03ca84/d7b573/7e0de3/e2bdbb/7cab47/4dd465/addb41/2076e1/85559c/dbcb2d/514505/a6a54e/41e864/abb5a5/e59e4b/8c2df6/7e5cf3/b648da/8fbd98/4c7d8a/08e6a3/72f66f/a49cc6/18211b/1e6a5c/0d4fde	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Your Google Account has been deleted due to Terms of Service violations.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://jmak-service.com/3225640388	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	malw.hta	Get hash	malicious	Branchlock Obfuscator	Browse	162.159.61.3
	web55.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	Rgr8LJz.exe	Get hash	malicious	LummaC	Browse	104.21.4.114
	06012025_1416_bombastic.hta	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	malw.hta	Get hash	malicious	Unknown	Browse	162.159.61.3
ORACLE-BMC-31898US	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	miori.x86.elf	Get hash	malicious	Unknown	Browse	140.204.251.205
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	193.123.7.176
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	144.25.181.0
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	test.exe	Get hash	malicious	Unknown	Browse	130.61.86.87

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Mv XIN HAI TONG 21_VESSEL'S_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MV DESPINA_VESSEL_DESCRIPTION.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.747012057708558
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	VSLS SCHEDULE_pdf.exe
File size:	217'088 bytes
MD5:	ea999998326f1b7061dfcf2def8e1d1b
SHA1:	513f32a0d21c87ebe413c7cf3cbc99138ec374c5
SHA256:	abc0b5e65132918208e06122ecfe2172c468494da7b0e48cc40f8475138153b2
SHA512:	8e46786a5d3b5356360656c12e420ef0147e881a123161ec2f5f1d187cceb06ff62908a775ee3905ddce7bf85891407371f8a05d19423a2a57ffa3830c9b9f74
SSDEEP:	3072:oXeICe+2LbgMBGKznc9qz/yoj7wzBt56g4JEJ2WTi5l/N2Ft1vbR:ouICe+2HGKfzD72MmJ2T8
TLSH:	2224F6BE29BEC4A1C8B2D1BCD950230973671501DBD561A97B4BBAE7DC10B18DC0A6F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ZA................0......6.......7... ...@....@.. ....................................@................................

File Icon


Icon Hash:	13d1421995c6490d

Static PE Info

General

Entrypoint:	0x43371e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x827F415A [Thu May 19 00:31:22 2039 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x336c4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x33c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31724	0x31800	07f92ae98cb8656968431817d49f1558	False	0.6829427083333334	data	7.7580330271790805	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x33c0	0x3400	2ff4d91a063ab2b90dd010ec1dc98153	False	0.9199969951923077	data	7.698405552990344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38000	0xc	0x200	6f6bb9996e1bcbc53f04faf30c5d7cb1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x34130	0x2d91	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9799399914273468
RT_GROUP_ICON	0x36ec4	0x14	data	0.95
RT_VERSION	0x36ed8	0x2fc	data	0.43324607329842935
RT_MANIFEST	0x371d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T15:06:55.926592+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 15:06:54.675913095 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:06:54.680751085 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:06:54.680830956 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:06:54.681088924 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:06:54.685848951 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:06:55.759831905 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:06:55.764403105 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:06:55.770030022 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:06:55.872154951 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:06:55.926592112 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:06:55.949418068 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:55.949461937 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:55.949531078 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:55.964194059 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:55.964215994 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.441695929 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.441772938 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:56.452023983 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:56.452040911 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.452308893 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.504714012 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:56.612015009 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:56.659339905 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.741065025 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.741139889 CET	443	49707	188.114.96.3	192.168.2.5
Jan 8, 2025 15:06:56.741194963 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:06:56.762959003 CET	49707	443	192.168.2.5	188.114.96.3
Jan 8, 2025 15:08:00.871969938 CET	80	49706	193.122.130.0	192.168.2.5
Jan 8, 2025 15:08:00.874169111 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:08:35.912311077 CET	49706	80	192.168.2.5	193.122.130.0
Jan 8, 2025 15:08:35.917097092 CET	80	49706	193.122.130.0	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 15:06:54.629326105 CET	52759	53	192.168.2.5	1.1.1.1
Jan 8, 2025 15:06:54.636745930 CET	53	52759	1.1.1.1	192.168.2.5
Jan 8, 2025 15:06:55.940387964 CET	49410	53	192.168.2.5	1.1.1.1
Jan 8, 2025 15:06:55.947336912 CET	53	49410	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 15:06:54.629326105 CET	192.168.2.5	1.1.1.1	0xca08	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:55.940387964 CET	192.168.2.5	1.1.1.1	0xdd65	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:54.636745930 CET	1.1.1.1	192.168.2.5	0xca08	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:55.947336912 CET	1.1.1.1	192.168.2.5	0xdd65	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 15:06:55.947336912 CET	1.1.1.1	192.168.2.5	0xdd65	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	193.122.130.0	80	7164	C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 15:06:54.681088924 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 8, 2025 15:06:55.759831905 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:06:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7cc2f9806819e8f7e0ebfc9768fdb49a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 8, 2025 15:06:55.764403105 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 8, 2025 15:06:55.872154951 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:06:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3aa141aa54d13955a1201f253b123aa1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	188.114.96.3	443	7164	C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 14:06:56 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-08 14:06:56 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 14:06:56 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1660005 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwGdkmH5QrPcQRHbk74qJNhwMN9f8tcnoZ93Is0kOyBN75MZ2sAt571jrw7HWdwFDMzj3ErF51Wz1B%2FKleddQd62GcXdqnhJ7mgmJoY%2BtwCr0go%2FqVy5u76dWi4%2FLEauxmbPYggp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fecc0442bc48c5d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2062&min_rtt=2045&rtt_var=801&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1337608&cwnd=211&unsent_bytes=0&cid=2c72af02349a2362&ts=304&x=0"
2025-01-08 14:06:56 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	09:06:53
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"
Imagebase:	0xaa0000
File size:	217'088 bytes
MD5 hash:	EA999998326F1B7061DFCF2DEF8E1D1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2010490156.0000000003F79000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:06:53
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VSLS SCHEDULE_pdf.exe"
Imagebase:	0x140000
File size:	217'088 bytes
MD5 hash:	EA999998326F1B7061DFCF2DEF8E1D1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.3242226374.0000000000542000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3243663897.0000000002834000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	99
Total number of Limit Nodes:	7

Executed Functions

Function 09151720 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2012526791.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98034ee1341e7f3cfdfd4447bd50d4fcf806e86be8ea9ad45a3596c0486680a
Instruction ID: f4c0527f60cb536ab086b1fc92b12ee4d2e98be9c96fd23e9642c63536f597a7
Opcode Fuzzy Hash: e98034ee1341e7f3cfdfd4447bd50d4fcf806e86be8ea9ad45a3596c0486680a
Instruction Fuzzy Hash: F8F15E30E04209DFDB15DFA9C984BADBBF1FF44308F168558E82AAB255DB71E945CB80

Function 0144B298 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0144B4FE

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2ca74bb7e8ec61aebdd12c17a7974ec56a502ae8e864699b5151dae3cf07dc0e
Instruction ID: 5daddba75e3e6352c916f702bdeb2adfb28dfaf38a080f8916f1c31f2a465caf
Opcode Fuzzy Hash: 2ca74bb7e8ec61aebdd12c17a7974ec56a502ae8e864699b5151dae3cf07dc0e
Instruction Fuzzy Hash: BF812270A00B458FEB24DF2AD45479ABBF1FF88204F10892ED48ADBB60D735E945CB90

Function 0144449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014459C9

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4e045ed8695c2b2370c7885c47037f564589e1c5064a5947a785581acc552464
Instruction ID: 961563ed53641a05bc7850d1c8010391939872df61a11683252d67f6dba64636
Opcode Fuzzy Hash: 4e045ed8695c2b2370c7885c47037f564589e1c5064a5947a785581acc552464
Instruction Fuzzy Hash: 7141D3B0C00719CBDB24DFA9C88479EBBF5BF45304F20806AD409AB255DB755945CF91

Function 0144590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 014459C9

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fe2bf726add9a7180108642335ea194334bf6642cee41d6c865140db349fcbf5
Instruction ID: 103c4695a419a8a38e3ab78933c99b3aeaaac5bb5ef256b52f2cb30292efe773
Opcode Fuzzy Hash: fe2bf726add9a7180108642335ea194334bf6642cee41d6c865140db349fcbf5
Instruction Fuzzy Hash: 4E41D0B0C00719CBEB24DFA9C884BDEBBB5BF49304F20806AD419AB264DB755946CF91

Function 0144D2F8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0144D74E,?,?,?,?,?), ref: 0144D80F

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a1ea7862ee0d56dbf91147772665f0e6f3de5bcd0ae2882dbaf20f6ef7450a23
Instruction ID: c1b27fe446e4fe7f569ef1beef806765457591626db9092383f9e05bb7b3d7ea
Opcode Fuzzy Hash: a1ea7862ee0d56dbf91147772665f0e6f3de5bcd0ae2882dbaf20f6ef7450a23
Instruction Fuzzy Hash: 8821E7B5D002489FDB10CF99D584AEEBFF4FB48310F14842AE918A3350D378A944CFA0

Function 09152198 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09152211

Memory Dump Source

Source File: 00000000.00000002.2012526791.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: f80f1a7b613832643bf6da16e99bb1365c63528457b5c7c15487a9f53e92f33f
Instruction ID: 107674fc454c7cc8ac05aff699d0f194b3d1f60095de4119e1bd6cdd794754be
Opcode Fuzzy Hash: f80f1a7b613832643bf6da16e99bb1365c63528457b5c7c15487a9f53e92f33f
Instruction Fuzzy Hash: D42114B5D002098FDB14CFA9C844BEEBBF5EB88314F10842AD969A7250C778A941CFA1

Function 0144D780 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0144D74E,?,?,?,?,?), ref: 0144D80F

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87712242e258af6907ec2e552d9a01a730836040fa66ddf59954267e2201ae1f
Instruction ID: 334cf6bdfa6bf0116d850d4697561a0bd2dfdef3c4b9fe23d04a821c27982ee7
Opcode Fuzzy Hash: 87712242e258af6907ec2e552d9a01a730836040fa66ddf59954267e2201ae1f
Instruction Fuzzy Hash: 5B21B3B5D002489FEB10CF99D984AEEBBF5FB48324F14845AE918A3350D378A944CFA1

Function 091521A0 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 09152211

Memory Dump Source

Source File: 00000000.00000002.2012526791.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 5f85629de0d5bb66087df6c710d53e192d69b127924ba2f28474821d849603b3
Instruction ID: 2084fbd3e4e1e112df87ec1cb11dd8cd509dd2206aecb7b31edb5e3a6cc00414
Opcode Fuzzy Hash: 5f85629de0d5bb66087df6c710d53e192d69b127924ba2f28474821d849603b3
Instruction Fuzzy Hash: 762127B5D002098FDB14DF9AC844BEEFBF5FB88324F14842AD469A3250D778A945CFA5

Function 0144B498 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0144B4FE

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cb636975b80e3d84c0a954428a3a92c5b7ef35a9dabcb9ff5119833ec9e384cd
Instruction ID: 76652912a724baec8612b6df3e7a5ea5f0855e78eeb6d29ac73a0099b886fecd
Opcode Fuzzy Hash: cb636975b80e3d84c0a954428a3a92c5b7ef35a9dabcb9ff5119833ec9e384cd
Instruction Fuzzy Hash: 0811E0B5C006498FEB10DFAAD844ADEFBF4EF88314F14842AD529A7710D379A645CFA1

Function 09151502 Relevance: 1.5, APIs: 1, Instructions: 44
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32 ref: 0915155D

Memory Dump Source

Source File: 00000000.00000002.2012526791.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6682a5ae3e3911a7ca4d2f1d45071289acd0fabdfbf44d7748101dd7af42f7a7
Instruction ID: ad8c52309b2a24f2d372cfbe2d2a69f223a50c1c15cfa16cfc133b2dab04c247
Opcode Fuzzy Hash: 6682a5ae3e3911a7ca4d2f1d45071289acd0fabdfbf44d7748101dd7af42f7a7
Instruction Fuzzy Hash: 4C1142B0D04248CFDB20DFAAD548BEEBFF5EB49324F24845AD519A3210C379A640CFA0

Function 09151508 Relevance: 1.5, APIs: 1, Instructions: 43
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32 ref: 0915155D

Memory Dump Source

Source File: 00000000.00000002.2012526791.0000000009150000.00000040.00000800.00020000.00000000.sdmp, Offset: 09150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9150000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9abea6e64c813e4a8b22c43c48e8e04dca2be80b9f5050b6a6c8232edfe9eca8
Instruction ID: 41d51b702909e83ade62a9cdb1171d764e23264c4723a5dd906105c2732a7b68
Opcode Fuzzy Hash: 9abea6e64c813e4a8b22c43c48e8e04dca2be80b9f5050b6a6c8232edfe9eca8
Instruction Fuzzy Hash: 821112B1D042488FDB20DF9AD544B9EBBF8EB48324F20841AD519A3200C378A644CFA5

Function 012AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009854544.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f328b8ea069a6685c16dd6b3326f9054a8cb85c90e775f10d91f2d04fd2c14
Instruction ID: e1cba67611fdcf878388a8f8c64e2e3a82eed47d2918e6634d0c32d516fa2097
Opcode Fuzzy Hash: 51f328b8ea069a6685c16dd6b3326f9054a8cb85c90e775f10d91f2d04fd2c14
Instruction Fuzzy Hash: 12214270294208DFCB15CF68D980B22BF65FB88314F60C56DDA0A0B656C37AD407CA61

Function 012AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2009854544.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09639082974e5a2953d3a1c152fb9c0ed93a2755cc700b14b723c9155de40e1
Instruction ID: 8eb21d45d12f511caf1788be9aaa38482a261162f43933a735e7a290b6e6a84d
Opcode Fuzzy Hash: d09639082974e5a2953d3a1c152fb9c0ed93a2755cc700b14b723c9155de40e1
Instruction Fuzzy Hash: 7921B0714483849FCB03CF24D994711BF71EB4A314F28C5DAD9898F6A7C33A980ACB62

Non-executed Functions

Function 0144E084 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2010038760.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1440000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93279baadb220f5853a8e31e43c3b2b8d322f8973fa26ea29f18981b373bc146
Instruction ID: a4cb741c4e49a980da1aa947427199d2df76707839c2a0101fe6e43ef20a2e73
Opcode Fuzzy Hash: 93279baadb220f5853a8e31e43c3b2b8d322f8973fa26ea29f18981b373bc146
Instruction Fuzzy Hash: 84A18C32E0021A8FEF15DFB9C84059EBBB2FF95300B14456AE905BB365DB35E919CB40

Analysis Process: VSLS SCHEDULE_pdf.exePID: 7164, Parent PID: 5720COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	22.5%
Total number of Nodes:	40
Total number of Limit Nodes:	2

Executed Functions

Function 011C7780 Relevance: 12.2, Strings: 9, Instructions: 920COMMON

Download Yara Rule

Strings

(o]q, xrefs: 011C7C8F
(o]q, xrefs: 011C7D41
(o]q, xrefs: 011C7932
(o]q, xrefs: 011C7C7F
(o]q, xrefs: 011C7869
(o]q, xrefs: 011C7895
,aq, xrefs: 011C7C20
(o]q, xrefs: 011C77AE
,aq, xrefs: 011C7C10

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-99275883
Opcode ID: 8c6ffc4ec038d0518093b68f8607c99b82f7c9a0fff07f66f648379e44deae95
Instruction ID: bdb08d31305e602eeb0631ecb653f8ea5d8f68fcb60dd595bc3b1185b72488e0
Opcode Fuzzy Hash: 8c6ffc4ec038d0518093b68f8607c99b82f7c9a0fff07f66f648379e44deae95
Instruction Fuzzy Hash: 01828A30A0060ADFCB19CF68C984AAEBBF2FF99710F158569E5459B2A2C770ED41CF51

Function 011C6A20 Relevance: 9.7, Strings: 7, Instructions: 920COMMON

Download Yara Rule

Strings

,aq, xrefs: 011C7318
(o]q, xrefs: 011C7292
Haq, xrefs: 011C6E22
(o]q, xrefs: 011C6F56
(o]q, xrefs: 011C72A0
(o]q, xrefs: 011C75BD
,aq, xrefs: 011C730A

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$,aq$,aq$Haq
API String ID: 0-105717579
Opcode ID: 580805dccf68e77e41ff5f0ebbe94ebeb50c61008b7a129a369f204428a4d3e2
Instruction ID: 0cdc12735acebae146422e6568e0e1b8410583ba217f9241dfeacb39183c9c64
Opcode Fuzzy Hash: 580805dccf68e77e41ff5f0ebbe94ebeb50c61008b7a129a369f204428a4d3e2
Instruction Fuzzy Hash: 71728D70A002198FCB19DF69C884AAEBBF6BF98700F158469E815AB3A5DB70DD41CF51

Function 011C1C58 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 011C1EA3
PH]q, xrefs: 011C1E92

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 805be0e561d99ff41775f1d174a7cdb6a7143f85ce58c81253580795d0a0ce8b
Instruction ID: 7073c4a2c4a554769e88163570d4ecc904302aa078ecddd048c373bde5a1457a
Opcode Fuzzy Hash: 805be0e561d99ff41775f1d174a7cdb6a7143f85ce58c81253580795d0a0ce8b
Instruction Fuzzy Hash: 8481CE74E00218DFDB58DFAAD994BADBBF2BF89300F20806AD419AB355DB345946CF50

Function 00DFC168 Relevance: 2.0, APIs: 1, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3243055121.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_df0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46968c1943f2d5bd65d6eadd2fd3fbb4d48f4ca41c0014e0c3d241f756332af2
Instruction ID: 47ebccf13ef92f3320447d0cd2908e6370547d8066bcafc526354e302ce1f733
Opcode Fuzzy Hash: 46968c1943f2d5bd65d6eadd2fd3fbb4d48f4ca41c0014e0c3d241f756332af2
Instruction Fuzzy Hash: 79221570E1021D8FDB14DFA8C984BADBBB2BF88300F1595A9D509AB355DB31AD85CF60

Function 011C4500 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa897f59836becf015b1cae919e93dffec2ca18fb6a696f8bf36ae80e263c21
Instruction ID: d6a10d92ebb00fdb15a8ddb285ad76a00856130a56f981e07840c2c9564c707a
Opcode Fuzzy Hash: bfa897f59836becf015b1cae919e93dffec2ca18fb6a696f8bf36ae80e263c21
Instruction Fuzzy Hash: CF828C74E012288FDB69DF69CD94BDDBBB2BB89300F1481E9940DA7265DB305E85CF50

Function 011C15F8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136531648b18c3e91cf7006de5f1202fbfa44915a9540d97a91ebd88eae44877
Instruction ID: daaebfde4e24d12b133b78f76069bef3d5f004ed22f55315386e5642a911179a
Opcode Fuzzy Hash: 136531648b18c3e91cf7006de5f1202fbfa44915a9540d97a91ebd88eae44877
Instruction Fuzzy Hash: EBE1D374E01218CFEB24DFA5D954B9DBBB2FF89300F2080A9D408AB395DB755A85CF25

Function 00DF4F08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243055121.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_df0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12ecd96246bbbe5c18c5fa8ecea2bb485410c5ac929c4d984a46afcf7903a1d
Instruction ID: ea35d4c4bdaba007ba969be786680cc92713940d3d008f5f6464c9d8e81e2011
Opcode Fuzzy Hash: a12ecd96246bbbe5c18c5fa8ecea2bb485410c5ac929c4d984a46afcf7903a1d
Instruction Fuzzy Hash: 2DC1B274E00218CFDB19DFA5D954B9DBBB2BF88300F2081A9D809AB359DB759E85CF50

Function 00DF5367 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243055121.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_df0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9330b28eeaf77d08202a49ff54268b53aa3f16e91e4ed6437d3c974c4a7f940e
Instruction ID: 49723213efb7fc1fc9123807a168a9faade23ab50932ac66550b7b4808cedbe7
Opcode Fuzzy Hash: 9330b28eeaf77d08202a49ff54268b53aa3f16e91e4ed6437d3c974c4a7f940e
Instruction Fuzzy Hash: 1EA10470D00608CFDB24DFA8D548BEDBBB1FF89301F248269E519A72A5DB749985CF60

Function 00DF56AF Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243055121.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_df0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c7867a4a9071ece0414863234459345d0b17457fd56420f92ee5e07ed5ca9d
Instruction ID: b48bc7505805b2e7c579cc90fe5389e5cf8d6c25f54aeb258a1053788070019b
Opcode Fuzzy Hash: 37c7867a4a9071ece0414863234459345d0b17457fd56420f92ee5e07ed5ca9d
Instruction Fuzzy Hash: 79912470D00608CFDB14DFA8D588BECBBB1FF49301F2482A9E119AB295DB709984CF60

Function 011C15EA Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2551df97ac7a5f38bad938bc0db9d3f6cc7d48d0be62fd9b92a6af5c79fb5cf
Instruction ID: 6366f491efa48fd82be8571e309d44eaff2711ea12a0cf9f9ed4c23421ea52c3
Opcode Fuzzy Hash: f2551df97ac7a5f38bad938bc0db9d3f6cc7d48d0be62fd9b92a6af5c79fb5cf
Instruction Fuzzy Hash: 4241E2B1D00608CBEB18DFAAC84479DBBF2BF89304F14C069D518BB295DB355946CF64

Function 011C8848 Relevance: 4.6, Strings: 3, Instructions: 824
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 011C938F
$]q, xrefs: 011C936C
(o]q, xrefs: 011C9549

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (o]q$$]q$$]q
API String ID: 0-989248301
Opcode ID: a5e7b5f79443bee77b02671039f2d0d3693821773ae68b56a04e92bdc07ad9bd
Instruction ID: 536a70081a78b4c51481beeb7e7c498510f0db07c3a317e7b1b9201e23fcafe3
Opcode Fuzzy Hash: a5e7b5f79443bee77b02671039f2d0d3693821773ae68b56a04e92bdc07ad9bd
Instruction Fuzzy Hash: 52727170A002188FEB599BA4C960B9EBBB7FF85300F1080ADD51A6B3A5CF359E45CF55

Function 011C6140 Relevance: 2.8, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 011C622B
Haq, xrefs: 011C625E

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 9f3cb825d0163f0a8c61def5e8a9e071370e4a5b312e87dcec4a4e12579f56e5
Instruction ID: a0c835a28e36644987c2a998db3e87bcf2349abe514b5491a72425e7214b105e
Opcode Fuzzy Hash: 9f3cb825d0163f0a8c61def5e8a9e071370e4a5b312e87dcec4a4e12579f56e5
Instruction Fuzzy Hash: 47C1DE307042519FDB1E9F28D894A6E7BA2BFD9700B15846DE906CB396DF34DC42CB91

Function 011C6600 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 011C66D6
,aq, xrefs: 011C66E0

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 2fc86aa358193332d10ca904a3c9e567e6e15f42093756b1316639ac26d4c2cd
Instruction ID: ea543ae4b4ccff6161cefd8ceb29fc1cb2b550746254422673a36b33d039d3ab
Opcode Fuzzy Hash: 2fc86aa358193332d10ca904a3c9e567e6e15f42093756b1316639ac26d4c2cd
Instruction Fuzzy Hash: AF81CD74A006158FDB1CCF6DC8849AABBB2FF98A04B15846DD505DB3A5DB31EC41CF91

Function 00DFC76C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 00DFC8AE

Memory Dump Source

Source File: 00000002.00000002.3243055121.0000000000DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_df0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 47ad2b86ab42290f63f3a3f812241f7808c07b7ca640ab2cd12412475a7065c1
Instruction ID: e14d46cc552b9a5370e8a9d5e4aff638dfddb9d459b67efa5e9a50de7526dad2
Opcode Fuzzy Hash: 47ad2b86ab42290f63f3a3f812241f7808c07b7ca640ab2cd12412475a7065c1
Instruction Fuzzy Hash: BC119AB4E1120D8FCB04DBA8D584AFDBBB5FF88305F65D165EA04A7242D730E941CB60

Function 011C5F08 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

d8bq, xrefs: 011C5F60

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: d8bq
API String ID: 0-3484500975
Opcode ID: 11179ad70a9a9b9f9fbc419053b76ccb1fc5f0db704b4afb2a24c404c0604d50
Instruction ID: e7ce53d31bdfe525384df94b28da1344967a71a8229bcb59a85db2f6ecc53032
Opcode Fuzzy Hash: 11179ad70a9a9b9f9fbc419053b76ccb1fc5f0db704b4afb2a24c404c0604d50
Instruction Fuzzy Hash: 8841DD30300A018FC72DAB3EE854A2A7BE6AF95700F15487DE546CB3A1EB64EC05CB91

Function 011C2537 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

(&]q, xrefs: 011C2623

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (&]q
API String ID: 0-1343553580
Opcode ID: 96ce52a410bc4a02f7ab399873495921b36fbba0fb8b9f14052420c3661e9fcd
Instruction ID: 9c0f463b86f76432c8ae2c8d13cf8dd5c43be3462a95fcffabe416cf5a94a23c
Opcode Fuzzy Hash: 96ce52a410bc4a02f7ab399873495921b36fbba0fb8b9f14052420c3661e9fcd
Instruction Fuzzy Hash: 9D415531F002198BDB19DFA9C8906DEBBB2AF95B00F14851DE416B7384DF70AD46CBA1

Function 011C8308 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4']q, xrefs: 011C8383

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: e58671acb999748be1f7648ac76dde3e77655362492595587f22bc5fc93cfc88
Instruction ID: 5b779c83cc9da6c4054c1e0c1a72456030f677719eaf8b2a9befedcb884e153d
Opcode Fuzzy Hash: e58671acb999748be1f7648ac76dde3e77655362492595587f22bc5fc93cfc88
Instruction Fuzzy Hash: 98413575604119DFCB19DF28D888AAE7BB6BF48B10F010069FA168B3B1CB70DC41CBA1

Function 011C26F7 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

M, xrefs: 011C26B3

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 53c0b985c4772ab25c8b6abca8620941caa3a694f90f4f89b5444eba04f1633a
Instruction ID: e9220b4cf36184f62b0174c34139c625f4c58e3dc6205778c91a496742dcdf7e
Opcode Fuzzy Hash: 53c0b985c4772ab25c8b6abca8620941caa3a694f90f4f89b5444eba04f1633a
Instruction Fuzzy Hash: 2C313731B042589BCB0AEFB8D8505AE3F72EFA5740B10449EE906E7292DF319C128771

Function 011C8640 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4']q, xrefs: 011C86BA

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 9719493ea34b3e9fd204e1bef03defce2f355c4df2611a4e3d43671d72d6f611
Instruction ID: 28bc09cade9ff0054e7e2438eb6fabd40507d34e812df4a1973388f83d2d9690
Opcode Fuzzy Hash: 9719493ea34b3e9fd204e1bef03defce2f355c4df2611a4e3d43671d72d6f611
Instruction Fuzzy Hash: 6821C7313082658FDB1DDE69D8C0ABF7FEAABA5A01B05842EE516C7244EB74D850CB61

Function 011C68A1 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

(o]q, xrefs: 011C690B

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 8940a727bd6d60b51c7911e6219070309cd9396b8726bf7810dba24ec1e040cb
Instruction ID: 000d4dc758533f1f6f26fc98e3c65b2de5dcdb1d3646aa25a96b72138c12bc6e
Opcode Fuzzy Hash: 8940a727bd6d60b51c7911e6219070309cd9396b8726bf7810dba24ec1e040cb
Instruction Fuzzy Hash: 562125317002004FCB08AFBD9940AAA7FEAEFC5644B1145789505CB35AEE74EC06C7B0

Function 011C5EF8 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

d8bq, xrefs: 011C5F60

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: d8bq
API String ID: 0-3484500975
Opcode ID: 1cb934d50b1d44e3c34b6d9068fdc57003a9e7f12ca3711e27a732404411e1ba
Instruction ID: 122a5a433be8fea9ec29d9828e7e1c3df4b685c8d0f8e59b33cb70c509566335
Opcode Fuzzy Hash: 1cb934d50b1d44e3c34b6d9068fdc57003a9e7f12ca3711e27a732404411e1ba
Instruction Fuzzy Hash: B211BF317007028FC72A9B2DD454B6EBBEAAF91750F058A2CD0968B265DB64E809C752

Function 011C84F8 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b9b757883c0aec9afbc5cc505701934fba9e993135bd9584f134d36e42b5
Instruction ID: f267aeec5f87532614fb18c4eda4e700298701ceafe7f27b0f2a154f7cb029cc
Opcode Fuzzy Hash: 6225b9b757883c0aec9afbc5cc505701934fba9e993135bd9584f134d36e42b5
Instruction Fuzzy Hash: 2551AF317041258FD718DF3DD8D8A6A7BE9BF99A4030A44AEE516CB366EB30DC01CB51

Function 011C44F0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d8865d8714a892b4c9d3942c24a49c901be8b0a1bf72d88919deda4e25245b
Instruction ID: 76506a4daae451e0afe653edf9c6aea126dd69a5d6db6be358d93ddc2efa7fce
Opcode Fuzzy Hash: a0d8865d8714a892b4c9d3942c24a49c901be8b0a1bf72d88919deda4e25245b
Instruction Fuzzy Hash: F881A374E412289FDB69DF29D890BEDBBB2BB89700F1080EAD449A7354DB705E85CF40

Function 011C5868 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723df0074a5e1c0a0fb36580d7b87fe8f68a808f0c9f8da145658990d8b342dc
Instruction ID: 1ee28d16762736ce0b76a0d7ba24459a7ead3191b9c12273d47d808cdd5305fa
Opcode Fuzzy Hash: 723df0074a5e1c0a0fb36580d7b87fe8f68a808f0c9f8da145658990d8b342dc
Instruction Fuzzy Hash: 9831A030704209AFCB4AAF64E9546AF7BB3EB59710F008029F91587295DB35DE55CBA0

Function 011C8729 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76308c38fb7cb35886464cba989e6a49f6e55940aeafeb44a62ded88526c9ab0
Instruction ID: ea1c3bea9d9423f720f88787ce0f7594060ccab2a15958803f006a789f56c6e3
Opcode Fuzzy Hash: 76308c38fb7cb35886464cba989e6a49f6e55940aeafeb44a62ded88526c9ab0
Instruction Fuzzy Hash: 8B21C4307006104BDB2E573DA8D463E7697AFD9A15714403DD906CB7A6EF38CC42D792

Function 011C8738 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a095ab77aa715a2d4b35ef8c5a0fd1608c0cea4af3c1c2d734a9686b1352f2
Instruction ID: 7add8e127cb8cc4ad9d0ec748cdc444550e2087f2c5ee10777fc388008c52f42
Opcode Fuzzy Hash: 42a095ab77aa715a2d4b35ef8c5a0fd1608c0cea4af3c1c2d734a9686b1352f2
Instruction Fuzzy Hash: 2D21AF347002114BDB2E672EA8E463F759BAFD8A15F14803DD506CB799EB79CC82D391

Function 00D1D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242821088.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60346f1f272510c8062c9d27e9ef6fe00111f16e65abc37dd65484546b2ce46d
Instruction ID: 43d21102326fc3eea7872abf2593028c16cc0f491a58015ce27f212959b2c7b6
Opcode Fuzzy Hash: 60346f1f272510c8062c9d27e9ef6fe00111f16e65abc37dd65484546b2ce46d
Instruction Fuzzy Hash: AB316F7150D3C49FC713CB24D890711BF71AB46214F29C5DBD9898F2A3C33A984ACB62

Function 00D1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3242821088.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788ffb5cd6e3921e4043bbc092204aa54d9a1a377060f4d249f8058fda525e00
Instruction ID: 2fcbf0515094bf6b3a23d5f93ff0a9a93e7c4f6a8752b983a69cb8381d284aa9
Opcode Fuzzy Hash: 788ffb5cd6e3921e4043bbc092204aa54d9a1a377060f4d249f8058fda525e00
Instruction Fuzzy Hash: 8E21F575504204EFCB14DF14E980B66BB66FB88314F24C569E9494B256C73AD886CA72

Function 011C5858 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d19d4da6b36d21ef48dc0650fd725cbd6539ebd6a8c4a3160155f44bf60004b
Instruction ID: 3a5616ea6b629da12e959401928b95f0c1612e8523be92e8a98c9595d9746cd8
Opcode Fuzzy Hash: 5d19d4da6b36d21ef48dc0650fd725cbd6539ebd6a8c4a3160155f44bf60004b
Instruction Fuzzy Hash: 8021FF30B042589FCB59AF68E4447AF7BB2EB99B10F00803DF9158B349D734AE55CBA0

Function 011C2270 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3384d74c1609df5221860ca9a5a194daf87706d1eb0812b4cca1f328295cd8
Instruction ID: 958f20bdb500574c2adc37cfd994342f6640a1421e3df44093ed08c5c11a1305
Opcode Fuzzy Hash: df3384d74c1609df5221860ca9a5a194daf87706d1eb0812b4cca1f328295cd8
Instruction Fuzzy Hash: CE112672800249DFDB10DF99D944BEEBFF5EB48320F148419E618A7250D379A550DFA1

Function 011C2990 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2f79e8a4dd7683d024a9118140dfa7867c2c050569c58074defec2506bd513
Instruction ID: ea71353dffbd1b3a1ba6c63b6e92c8b9dc0ec1198fa3d39e6473bdcec704799e
Opcode Fuzzy Hash: be2f79e8a4dd7683d024a9118140dfa7867c2c050569c58074defec2506bd513
Instruction Fuzzy Hash: 9F112676800249DFDB20DF99C944BEEBFF5EF48320F14845AE958A7250C339A554DFA1

Function 011C1EB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a264a6001fe1963a17bfcaa439ed75e8f19e40a1a6702b0f5c7f9f7f51f10d85
Instruction ID: fb3241040fe30eb2b324b302aeedca6f7bbe1dfd3b67165098cb6f9bd214a1f0
Opcode Fuzzy Hash: a264a6001fe1963a17bfcaa439ed75e8f19e40a1a6702b0f5c7f9f7f51f10d85
Instruction Fuzzy Hash: E6118834E00119CFDB05DFE8D850BEEBBB5AF58301F408065E808A7346E73099418F11

Function 011C60A0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48683408793387b8080ac2670d89b7f1dc22161d4895d0421332e35369a6001
Instruction ID: 1f956c7379ca49419386e02d92da318e5a57b9530c012bad7fcedfc6a54e58f8
Opcode Fuzzy Hash: b48683408793387b8080ac2670d89b7f1dc22161d4895d0421332e35369a6001
Instruction Fuzzy Hash: FB012673A042586FDB1A8E64AC50BEF3FB6EBD5750F05803AF601D7241D7318912CB61

Function 011C60B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33d28bb10b8ea67b35b89a5cfdeb252103da806afc7d057d161fe5085e8ed40
Instruction ID: fd8a2d1b619c20c66531bb2b464d064591d1f127a32846e92f5bbf5b0f1987cf
Opcode Fuzzy Hash: b33d28bb10b8ea67b35b89a5cfdeb252103da806afc7d057d161fe5085e8ed40
Instruction Fuzzy Hash: 710126327000187B8B4D9E58A810AAF3BEBEBC9B50F05802DF605E3380DB319D118BA5

Function 011C2752 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb20c70178ad81b7cb8b468fb94b3644682cdd82899faefb0e5ef5fcadcdc6c
Instruction ID: d5dc115b38d728e5213c8024ebd3f792fc57019335fa998a515b71cc796229ff
Opcode Fuzzy Hash: 6eb20c70178ad81b7cb8b468fb94b3644682cdd82899faefb0e5ef5fcadcdc6c
Instruction Fuzzy Hash: 6BF090322042197F9F0A9EA8E8509AF7BABFBC9324B10446DF509D7260DB32991197A5

Function 011C2758 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b9a995833bd57fdae91c2430ebd0eb285340380541a2ef6143605ba8ffffdf
Instruction ID: c1679f499dfd45610ee3ec2a615420a13f6e9279385002c86d3e3087b5be0d38
Opcode Fuzzy Hash: 74b9a995833bd57fdae91c2430ebd0eb285340380541a2ef6143605ba8ffffdf
Instruction Fuzzy Hash: A6F082363042197B9F099E98E8549EF7BABEBC8360B10842DFA09D3350DF319D1197A5

Function 011C947D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed6abda67c84de04a50034a10c94ebbb68d4566feac5eaeb65e05178f602236
Instruction ID: 9eed501b5de8154bf451e5c68804d81aad4057c0baf6fe7eae3a581c79fc220d
Opcode Fuzzy Hash: 9ed6abda67c84de04a50034a10c94ebbb68d4566feac5eaeb65e05178f602236
Instruction Fuzzy Hash: 52D0673AB40018AFCB159F98E8908DDFB76FB98221B058126E925A3265C6319965DB50

Function 011C68B0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab77299cdc5ec47dbb13c2870034b1e1b4237aeedb16932bbf25f2a59fb9d1a1
Instruction ID: 13b707a330569e517127f30ba0e96522e9c547a91b65170200027ad036d50863
Opcode Fuzzy Hash: ab77299cdc5ec47dbb13c2870034b1e1b4237aeedb16932bbf25f2a59fb9d1a1
Instruction Fuzzy Hash: A8C012301443184EC649FB65F985916772EAAC02047509530A0160E25EEF785D4D8B94

Non-executed Functions

Function 011C9CA0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9410212cbcc45a0ada4e42cd94d7ec5e96485271922b606e471f1be4618dd10d
Instruction ID: 88e25e0f0d4737209af296f061265f87ddd6841c38687cc3fe4d9417c8a34820
Opcode Fuzzy Hash: 9410212cbcc45a0ada4e42cd94d7ec5e96485271922b606e471f1be4618dd10d
Instruction Fuzzy Hash: 31020974E00218CFDB19DFA9C984B9DBBB2BF58304F1580A9D809AB365DB35AD85CF50

Function 011CC530 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26e58f84137587c7236dfb6313e670e7d84cbaeab331bbd6294dfc97b2f6430
Instruction ID: 41226555f4acc6f0c1f7bb5e3aa13bbd98069e21a754dff231a2e82a3b308cba
Opcode Fuzzy Hash: f26e58f84137587c7236dfb6313e670e7d84cbaeab331bbd6294dfc97b2f6430
Instruction Fuzzy Hash: 3BC1A174E00218CFDB58DFA9D954B9DBBB2BF89300F1090A9D409AB369DB359E85CF50

Function 011CE928 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d78c7008cf7cd9a2291b91e5e8c7bd10537b70eddb71c0289db33a7a3737735
Instruction ID: 8e14c5d69cb509210641cf1620f693aa5ef47d7cd429fd53d4bd62fbf118b9d7
Opcode Fuzzy Hash: 2d78c7008cf7cd9a2291b91e5e8c7bd10537b70eddb71c0289db33a7a3737735
Instruction Fuzzy Hash: 9DC1C474E01218CFDB58DFA9D954BADBBB2BF88300F1090A9D409AB355DB359E85CF11

Function 011C0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7a9664c03e9899c299d08d1e3a4c89fe20acc8ea3eeaec5cd7c73dd8ded36e
Instruction ID: e052044bea896ce21aabe284d44c473aacfda58872b35ced6b8a1c6060e43b8e
Opcode Fuzzy Hash: 0f7a9664c03e9899c299d08d1e3a4c89fe20acc8ea3eeaec5cd7c73dd8ded36e
Instruction Fuzzy Hash: BEC1C174E00218CFDB18DFA5D954B9DBBB2BF89300F1080A9D809AB369DB359E85CF51

Function 011CC988 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3cce3cb7a61b3cbcd8eb89a249651a3f31d28f9c5ffcffbbbee891ac61c599
Instruction ID: bb24fb50da585ee810beff0ba89d2d914663a45ff0575f0c5ee259b2df2c6593
Opcode Fuzzy Hash: 3f3cce3cb7a61b3cbcd8eb89a249651a3f31d28f9c5ffcffbbbee891ac61c599
Instruction Fuzzy Hash: 8EC1C374E00218CFDB58DFA9D954B9DBBB2BF89300F1080A9D409AB359DB359E85CF51

Function 011CED80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddade41df72b12c09fa74b649f1f00d6e330fd9942ef5ba50b20729b05ce93a
Instruction ID: 527ea580413ed195bfc31962ced150f39c54b97f5b8ad2ee67b3f88480b7b73a
Opcode Fuzzy Hash: 8ddade41df72b12c09fa74b649f1f00d6e330fd9942ef5ba50b20729b05ce93a
Instruction Fuzzy Hash: 36C1B274E00218CFDB58DFA5D954B9DBBB2BF89300F2080A9D409AB369DB359E85CF50

Function 011C11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2d1389fc812057dfcb2efd5b3bbe0adf70b672afeabfca0bdf5195c7b1e259
Instruction ID: e2159d92db649c3d82820ab5e10d5be9fbd7f8b579384e5eb9569f6afe3664d7
Opcode Fuzzy Hash: 5e2d1389fc812057dfcb2efd5b3bbe0adf70b672afeabfca0bdf5195c7b1e259
Instruction Fuzzy Hash: BFC1C274E00218CFDB19DFA5D954B9DBBB2BF89300F2090A9D809AB359DB359E85CF10

Function 011CF1D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443451e408c16a78b5a183c8f932fb06c992fb37371bf787c07597761fc22401
Instruction ID: 53fba8556d9461961e5a7e4b0d81f832917043280748611055d1879ad8ed8a72
Opcode Fuzzy Hash: 443451e408c16a78b5a183c8f932fb06c992fb37371bf787c07597761fc22401
Instruction Fuzzy Hash: 1CC1B374E00218CFDB58DFA5D954B9DBBB2BF89300F1090A9D409AB359DB359E86CF14

Function 011CCDE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa80e5d62e8f6a76fa6bb523a7fda2fe3220c608d123104ca9c4834b0566214
Instruction ID: 3d379464fc50e3d265c1742e67bb8b7e52b904d4bc50c05333bad761b19eca0c
Opcode Fuzzy Hash: caa80e5d62e8f6a76fa6bb523a7fda2fe3220c608d123104ca9c4834b0566214
Instruction Fuzzy Hash: ECC1B374E00218CFDB58DFA9D954B9DBBB2BF89300F1090A9D809AB355DB359E85CF50

Function 011CB828 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b026ee86167659a0c9054c6cbf838921cd6cb3511895b1f4ba26282722f6148a
Instruction ID: fb71287c84378c2539348da7503ea0aef9432d560ee4fde3828f96dc0c6fa0c8
Opcode Fuzzy Hash: b026ee86167659a0c9054c6cbf838921cd6cb3511895b1f4ba26282722f6148a
Instruction Fuzzy Hash: 8BC1C274E00218CFDB18DFA5D954B9DBBB2BF89300F1090A9D409AB369DB359E85CF14

Function 011CDC20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54db89b7ed506c0108e2a93826532b03ed18ea344d9ce8248e0ccf030e8fa564
Instruction ID: 761cc98516f26283839dd5462af838536c65f93499876aa05b64db4a95076593
Opcode Fuzzy Hash: 54db89b7ed506c0108e2a93826532b03ed18ea344d9ce8248e0ccf030e8fa564
Instruction Fuzzy Hash: 2EC1B274E00218CFDB58DFA5D994B9DBBB2BF89300F1090A9D409AB369DB359E85CF50

Function 011C3C50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0966e4a08602ba5fe79c16bd4ad9038cfbab137f46000a6e0654915e6b8cb9c
Instruction ID: cfc53d1a9c6cf93a309eb231cf7cd7cb99d3b48cac487a4e272c8f4055a12672
Opcode Fuzzy Hash: e0966e4a08602ba5fe79c16bd4ad9038cfbab137f46000a6e0654915e6b8cb9c
Instruction Fuzzy Hash: 93C1B274E00218CFDB18DFA9D954B9DBBB2BF89300F1094A9D409AB369DB359E85CF50

Function 011C0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4194747173a9d859b0c97a74aee9e96501bc386501ae777265b492526a246681
Instruction ID: 0354edfa0a8846736914318957671abca676892c0906100f6dac1c3ed507d142
Opcode Fuzzy Hash: 4194747173a9d859b0c97a74aee9e96501bc386501ae777265b492526a246681
Instruction Fuzzy Hash: A6C1B274E00218CFDB59DFA5D954B9DBBB2BF89300F1090A9E809AB359DB359E85CF10

Function 011CE078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739f88a65b2b1889abad7f250138fb89a4e8c22468b0858febdc659419ad6e92
Instruction ID: 8fbe611a9048342b497c33cca3e0eb8c87373dfacef9b63b204d8c081e4452cd
Opcode Fuzzy Hash: 739f88a65b2b1889abad7f250138fb89a4e8c22468b0858febdc659419ad6e92
Instruction Fuzzy Hash: E7C1D274E01218CFDB18DFA5C954B9DBBB2BF89300F1090A9D409AB369DB359E85CF10

Function 011C0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fd4d0159dcecb6cc99704e5c08f4f70d529368dd3144f5bcecde04efcf3ded
Instruction ID: 93fcb1d28c601feeb1862461f8fdc6e641a221027de9f7682c0430144417edec
Opcode Fuzzy Hash: e8fd4d0159dcecb6cc99704e5c08f4f70d529368dd3144f5bcecde04efcf3ded
Instruction Fuzzy Hash: 24C1B274E00218CFDB59DFA5D954B9DBBB2BF88300F2080A9E809AB359DB355E85CF50

Function 011CBC80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0eb6eca732d388a1ab28811d02af4558246379c651d3c707d2a0523b5c90a8
Instruction ID: 18559234f2725fe827f5fa627c6443aab605734af5b18ecbeb4652e8f96e65db
Opcode Fuzzy Hash: ba0eb6eca732d388a1ab28811d02af4558246379c651d3c707d2a0523b5c90a8
Instruction Fuzzy Hash: BBC1B274E00218CFDB58DFA5D954BADBBB2BF89300F1080A9D809AB359DB359E85CF54

Function 011C40A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68aebdc1a649b422d758a33fe39e954c943ad1b429d34353299c7e2dc664dd1f
Instruction ID: 0b63669ddfafe2ea0bf07261570c4e1e610968b98c724a4509f7d65be81192b5
Opcode Fuzzy Hash: 68aebdc1a649b422d758a33fe39e954c943ad1b429d34353299c7e2dc664dd1f
Instruction Fuzzy Hash: ECC1C374E00218CFDB18DFA5D954B9DBBB6BF89300F2090A9D409AB359DB359E85CF10

Function 011CC0D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69baa30df354b2d42b72d20bbe6a5233cfe317c21f129cdf45d942b8f1d963d
Instruction ID: d18629b8a8f76451caf4de18ac950e2c5dfec80fac1a69760c39afd24e399718
Opcode Fuzzy Hash: a69baa30df354b2d42b72d20bbe6a5233cfe317c21f129cdf45d942b8f1d963d
Instruction Fuzzy Hash: 4BC1C374E00218CFDB58DFA9D954B9DBBB2BF89300F1090A9D409AB369DB359E85CF50

Function 011CE4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1219175aff4366fe7f1d6c0cf454b8fc579a52ced00a72249f6fd3d5fc10dc8f
Instruction ID: 090ca0fddcf4098186f40cdd15a84b8d492d50683e9c53f4d806da1dd1dca6ee
Opcode Fuzzy Hash: 1219175aff4366fe7f1d6c0cf454b8fc579a52ced00a72249f6fd3d5fc10dc8f
Instruction Fuzzy Hash: 02C1B274E01218CFDB18DFA5D994B9DBBB2BF89300F1080A9D409AB369DB359E85CF51

Function 011C08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87c2bd28430940c11f037e56132b9a449371f503b3d35ccba4ae95cb61e7b44
Instruction ID: 6e97c5ab474a49bb1f88ce5e7d9f7b9808df2d959fdaca4d09c252bd84572ef6
Opcode Fuzzy Hash: c87c2bd28430940c11f037e56132b9a449371f503b3d35ccba4ae95cb61e7b44
Instruction Fuzzy Hash: C8C1B274E00218CFDB59DFA5D954B9DBBB2BF88300F2080A9D809AB359DB355E85CF15

Function 011CAB20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6931847e5e7704a464a307da8213d7dfac883b8f55d982a20e3879612b12ac
Instruction ID: 11cd6a64ac8be84ffd64625c2d82a19d288436232501c4af447b14d0251f073e
Opcode Fuzzy Hash: 8f6931847e5e7704a464a307da8213d7dfac883b8f55d982a20e3879612b12ac
Instruction Fuzzy Hash: 76C1D174E00218CFDB19DFA5D954B9DBBB2BF88300F1080A9D809AB369DB359E85CF10

Function 011C2F48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a29dc550eeb53ab58357dc6c1902a7764d22570e89d1a14b8096df52da2877
Instruction ID: 0ffc77e6ed1f51d07a7b0b43d48e53211030e6c5f0124d869b8d1f0872cf3d3c
Opcode Fuzzy Hash: c9a29dc550eeb53ab58357dc6c1902a7764d22570e89d1a14b8096df52da2877
Instruction Fuzzy Hash: C9C1C274E00218CFDB58DFA9D954B9DBBB2BF89300F1090A9D409AB369DB359E85CF14

Function 011CAF78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cb0044538c50c1f1ebc0d2c413ec71d5a303c0ade9fcb8656c087685fcf15b
Instruction ID: d000e93d72540d5dc6c3c2ff03d5b9002f06d5579fea5bb1b80600578295b517
Opcode Fuzzy Hash: 97cb0044538c50c1f1ebc0d2c413ec71d5a303c0ade9fcb8656c087685fcf15b
Instruction Fuzzy Hash: 70C1C374E00218CFDB18DFA5D954B9DBBB2BF89300F1090A9D809AB369DB359E85CF14

Function 011C33A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e28af923224edc794a73cd3ba5def0924bdccf7db7971b2094ff5ad5a7f4ab
Instruction ID: 4ddd926ea031736d54cf4f7ce0ac92c69c2f51395b8c843db2885690a6cbb0c0
Opcode Fuzzy Hash: 69e28af923224edc794a73cd3ba5def0924bdccf7db7971b2094ff5ad5a7f4ab
Instruction Fuzzy Hash: 16C1C374E00218CFDB58DFA5D954B9DBBB2BF89300F2090A9D409AB369DB359E85CF50

Function 011CB3D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7b8bbbbe756e8042e553bb290b46ad7766835550c72010187fb5e86f7eb0dc
Instruction ID: 96bb68afd6eb65275e3ad2e34cf3dca9808191eadf1cb88835d5e452044d264c
Opcode Fuzzy Hash: 1f7b8bbbbe756e8042e553bb290b46ad7766835550c72010187fb5e86f7eb0dc
Instruction Fuzzy Hash: 1FC1B174E00218CFDB58DFA5C955B9DBBB2BF88300F2080A9D809AB365DB359E85CF54

Function 011C37F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34af65ddcd3e46c22dd82ebcb224c199beddbb4950610efa5cbf9a8dcd566adc
Instruction ID: 3a45607820385e468571bcfcaf608b30fa9e7b170b152fc48e23fce09b68b623
Opcode Fuzzy Hash: 34af65ddcd3e46c22dd82ebcb224c199beddbb4950610efa5cbf9a8dcd566adc
Instruction Fuzzy Hash: 11C1B274E00218CFDB58DFA9D954B9DBBB2BF89300F1094A9D409AB369DB359E85CF10

Function 011CD238 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bd9ea26123d7526443cbc84be27a4e2341fac98196c65578818c49a51fbb49
Instruction ID: 5835f8d0691e086a6d0ff93542a62a67906da1801187fe78538fe0da75992da3
Opcode Fuzzy Hash: e9bd9ea26123d7526443cbc84be27a4e2341fac98196c65578818c49a51fbb49
Instruction Fuzzy Hash: ECC1B274E00218CFDB58DFA5D994B9DBBB2BF89300F1090A9D409AB369DB359E85CF50

Function 011CF630 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89bc8cf3ffe3c6d366ce4a9823ed76092e1d652fe492091afff2688ed5a0f0d
Instruction ID: 77716f8500c8d762a686e838db020f2885cc3da6ad4e619e0d77e09b9f345b40
Opcode Fuzzy Hash: c89bc8cf3ffe3c6d366ce4a9823ed76092e1d652fe492091afff2688ed5a0f0d
Instruction Fuzzy Hash: 37C1A274E00218CFDB58DFA9D954B9DBBB2BF89300F1090A9D409AB359DB359E86CF50

Function 011CA270 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0755a175ed69a12de8c4f4671cc55afe24cf47e430e48a64ce1e558e2973fb8
Instruction ID: 3074f33a28f772c4940834fa3c5a7388a3dcbab29052675697973950f117935b
Opcode Fuzzy Hash: f0755a175ed69a12de8c4f4671cc55afe24cf47e430e48a64ce1e558e2973fb8
Instruction Fuzzy Hash: 14C1C174E00218CFDB19DFA5D954B9DBBB2BF89300F2080A9D409AB369DB359E85CF50

Function 011CD690 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b65049268d16288407b1b728ad87d158839cc30eb5d32f044297608ac2acf6
Instruction ID: 7c34d16a6ef9a601c1bfe625b6450906e2b3d2de9126dc0b3aa13bb1327a5200
Opcode Fuzzy Hash: d3b65049268d16288407b1b728ad87d158839cc30eb5d32f044297608ac2acf6
Instruction Fuzzy Hash: BFC1B474E00218CFDB58DFA5D994B9DBBB2BF89300F1090A9D809AB359DB359E85CF50

Function 011CFA88 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4eb5185b290400fe0f4cf1ff2119930a57c420de7e3b8025e160e7afff5223
Instruction ID: da5d0b4e6258704c63040b4b87861652f5d19b20f82c00194f35d9ffad9e1278
Opcode Fuzzy Hash: 4f4eb5185b290400fe0f4cf1ff2119930a57c420de7e3b8025e160e7afff5223
Instruction Fuzzy Hash: 35C1B374E00218CFDB58DFA5D954B9DBBB2BF89300F1080A9D409AB359DB359E86CF54

Function 011CA6C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f9130fda983f302979e4f13485f3ade4d3365eba99c2fbba4ad59dccdb3666
Instruction ID: ce2a545b20e6ea8949855da9a2e534af2d727bac5ab45e6a38c4c709534e9794
Opcode Fuzzy Hash: c0f9130fda983f302979e4f13485f3ade4d3365eba99c2fbba4ad59dccdb3666
Instruction Fuzzy Hash: C7C1C274E00218CFDB19DFA9D954B9DBBB2BF89300F1080A9D409AB369DB359E85CF10

Function 011C2AF0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111feec7ad3f7ab1ab240d4f6810af9980ac7cc7e8d1060193a7f9ab64cd030b
Instruction ID: 6a1066eedf633e3a22469a8966ec8271b9bf6954a5f0a46f550b1b7a5830d3bf
Opcode Fuzzy Hash: 111feec7ad3f7ab1ab240d4f6810af9980ac7cc7e8d1060193a7f9ab64cd030b
Instruction Fuzzy Hash: D9C1B374E00218CFDB18DFA5D954B9DBBB2BF89300F1090A9D809AB359DB359E85CF10

Function 011C7770 Relevance: 5.3, Strings: 4, Instructions: 274COMMON

Download Yara Rule

Strings

(o]q, xrefs: 011C7932
(o]q, xrefs: 011C7869
(o]q, xrefs: 011C7895
(o]q, xrefs: 011C77AE

Memory Dump Source

Source File: 00000002.00000002.3243636749.00000000011C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_11c0000_VSLS SCHEDULE_pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 7524c50def5864fdad8cdac70b3ab7e22ece764830a8faa0194eed7e079ac1f8
Instruction ID: 99fdebd10a939816ffa7e120456a45e66730c0592659495ce309a2264749d7d3
Opcode Fuzzy Hash: 7524c50def5864fdad8cdac70b3ab7e22ece764830a8faa0194eed7e079ac1f8
Instruction Fuzzy Hash: 79C1A930A002099FCB29CF69C984AAEBBF6FF58714F158599E915AB3A1D770EC41CF50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VSLS SCHEDULE_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VSLS SCHEDULE_pdf.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
VSLS SCHEDULE_pdf.exe

Function 0144B298 Relevance: 1.7, APIs: 1, Instructions: 203
COMMON

Function 0144449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0144590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0144D2F8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 09152198 Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Function 0144D780 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 091521A0 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Function 0144B498 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 09151502 Relevance: 1.5, APIs: 1, Instructions: 44
comCOMMON

Function 09151508 Relevance: 1.5, APIs: 1, Instructions: 43
comCOMMON

Function 011C1C58 Relevance: 2.7, Strings: 2, Instructions: 182
COMMON

Function 00DFC168 Relevance: 2.0, APIs: 1, Instructions: 532
COMMON

Function 011C8848 Relevance: 4.6, Strings: 3, Instructions: 824
COMMON

Function 011C6140 Relevance: 2.8, Strings: 2, Instructions: 340
COMMON

Function 011C6600 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre