Edit tour
Windows
Analysis Report
SvmL9tW29w.exe
Overview
General Information
| Sample name: | SvmL9tW29w.exerenamed because original name is a hash value |
| Original sample name: | d34f580b7d5be3be089661d02663d0605cd776008a2301491f11299c13f6642f.exe |
| Analysis ID: | 1587619 |
| MD5: | f189174b0a4a4e9689b6c47693bb6d37 |
| SHA1: | 152a93f75fceb347dd241956bc4836a0b31b9f11 |
| SHA256: | d34f580b7d5be3be089661d02663d0605cd776008a2301491f11299c13f6642f |
| Tags: | exeuser-adrian__luca |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 76 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
SvmL9tW29w.exe (PID: 7624 cmdline:
"C:\Users\ user\Deskt op\SvmL9tW 29w.exe" MD5: F189174B0A4A4E9689B6C47693BB6D37) "C:\Users\ user\Deskt op\SvmL9tW 29w.exe" MD5: F189174B0A4A4E9689B6C47693BB6D37)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-10T15:57:07.035370+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.7 | 49971 | 142.250.184.238 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_0040646B | |
| Source: | Code function: | 0_2_004027A1 | |
| Source: | Code function: | 0_2_004058BF | |
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0040535C | |
| Source: | Process Stats: | ||
| Source: | Code function: | 0_2_00403348 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00406945 | |
| Source: | Code function: | 0_2_0040711C | |
| Source: | Code function: | 0_2_742F1A98 | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00403348 | |
| Source: | Code function: | 0_2_0040460D | |
| Source: | Code function: | 0_2_0040216B | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_742F1A98 | |
| Source: | Code function: | 0_2_742F2F8E | |
| Source: | Code function: | 0_2_0290E330 | |
| Source: | Code function: | 0_2_0290DB5D | |
| Source: | Code function: | 0_2_02910145 | |
| Source: | Code function: | 9_2_01670145 | |
| Source: | Code function: | 9_2_0166DB5D | |
| Source: | Code function: | 9_2_0166E330 | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_0040646B | |
| Source: | Code function: | 0_2_004027A1 | |
| Source: | Code function: | 0_2_004058BF | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-4417 | ||
| Source: | API call chain: | graph_0-4238 | ||
| Source: | Process queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_00403348 | |
| Source: | Code function: | 0_2_742F1A98 | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00403348 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Access Token Manipulation | 11 Masquerading | OS Credential Dumping | 211 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 11 Process Injection | 2 Virtualization/Sandbox Evasion | LSASS Memory | 2 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 23 System Information Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 75% | ReversingLabs | Win32.Trojan.Guloader | ||
| 76% | Virustotal | Browse | ||
| 100% | Avira | TR/Injector.ugdfe |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs |
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.184.238 | true | false | high | |
| drive.usercontent.google.com | 142.250.185.97 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.238 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 142.250.185.97 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1587619 |
| Start date and time: | 2025-01-10 15:52:16 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 8m 49s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | SvmL9tW29w.exerenamed because original name is a hash value |
| Original Sample Name: | d34f580b7d5be3be089661d02663d0605cd776008a2301491f11299c13f6642f.exe |
| Detection: | MAL |
| Classification: | mal76.troj.evad.winEXE@3/8@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212
- Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target SvmL9tW29w.exe, PID 8044 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
| Time | Type | Description |
|---|---|---|
| 11:54:10 | API Interceptor |
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader | Browse |
| |
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | CobaltStrike, Metasploit | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nsi2E71.tmp\System.dll | Get hash | malicious | GuLoader | Browse | ||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse | |||
| Get hash | malicious | Remcos, GuLoader | Browse | |||
| Get hash | malicious | FormBook, GuLoader | Browse | |||
| Get hash | malicious | GuLoader | Browse |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 11776 |
| Entropy (8bit): | 5.854450882766351 |
| Encrypted: | false |
| SSDEEP: | 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4 |
| MD5: | 34442E1E0C2870341DF55E1B7B3CCCDC |
| SHA1: | 99B2FA21AEAD4B6CCD8FF2F6D3D3453A51D9C70C |
| SHA-256: | 269D232712C86983336BADB40B9E55E80052D8389ED095EBF9214964D43B6BB1 |
| SHA-512: | 4A8C57FB12997438B488B862F3FC9DC0F236E07BB47B2BCE6053DCB03AC7AD171842F02AC749F02DDA4719C681D186330524CD2953D33CB50854844E74B33D51 |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 459404 |
| Entropy (8bit): | 2.6518324932533326 |
| Encrypted: | false |
| SSDEEP: | 1536:UX3YycIm8nyFk0mZCMhj9d4tDui9GTEjyNxcPlIp5EXORxlEkO4nvhzleYC9iYlr:idFdJoxn9FuVVb8QMrdBEbUi5nx1e |
| MD5: | CD57843C905DAE48C82E39A4258863FA |
| SHA1: | 44827D630C38FEAEB7E5159D9FD72ED0D02B455E |
| SHA-256: | 1F72CB627C58799924FED6AC72F19582BD1619B3D817EF6208AC8FD621B16AE2 |
| SHA-512: | 50B63691BA51CF7D493F69B44842C53B22EBEBBEC641148818D0D036381B6E0814DFAEB02C295D792F9B2556CC4CC3A2FBA17DF2310A53A9120AF41F0E61C644 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 389868 |
| Entropy (8bit): | 1.2469892412772452 |
| Encrypted: | false |
| SSDEEP: | 768:8mGX5iY6YFC1hSNYG8n6aCKBHwcX7e3ZNrt7qNIxKpGEopKfWOO72cDEDQ+7IF5i:m5ittaAwW6q8KH13QyOgs2w |
| MD5: | 2A500E1219C4894E2D45C32C5A5A11FD |
| SHA1: | AC9A88DE4C84E1EB8A535E1061CBC6584380D24E |
| SHA-256: | C65F223375C6DFE8CE71213D5DD24F39CDE31F772D2C66521BF07B21BE45E6C1 |
| SHA-512: | 89ED91AF91CF969FE7EC087EE107B52959582615EFB2AB72A21D6C3820E5BDDA78EE02EB39BB323FD996D85510627387616DF8917B12052A62D288D8E9448596 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 442363 |
| Entropy (8bit): | 1.2533707838755617 |
| Encrypted: | false |
| SSDEEP: | 1536:f6KFImN7hPg1fMcZ9pkK6m1rmkrDAji7VW9EgfrY:PyMtabPE+7ctfM |
| MD5: | 5465B75724C031B21C018F7D72941F72 |
| SHA1: | 98176B27A41A35401A96D0AAC0859EEC25A4C5FE |
| SHA-256: | 7390780C6FB1F7B57C950A11AE287127CB6144CE9AD1C26E8C242BADB685729B |
| SHA-512: | 7084191B13FF854943DEE9FB6DDC1D7F89D06055FF4DA7E04DA1C359B557AC22762209B8DFE061F3AF628DF077E1D1D1009E9F9A18E3C9441AEE7FD4FDFF1688 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 521 |
| Entropy (8bit): | 4.284169749449499 |
| Encrypted: | false |
| SSDEEP: | 12:7+SriF8i+WUQDJBYqRIE47W0BvM71ARi9ulhji4JDQCr6K:7tuZ+d6/GEUI18jhJsCr6K |
| MD5: | B089BD0CBC944DE0B1023E6CE9318BD3 |
| SHA1: | 715FA74E243D5C3419519E7371ED1836C9BCFA4A |
| SHA-256: | 1E8ABB4A5E85595B0EF2FC73E9012EDDFE1BCB7363E90A2EA46F561DD3742F93 |
| SHA-512: | A164EB2AB02E612E9F96531006C4A71B8D6E8EA6444D86907CB15EF2C1AAB4680EAF3BB580C6A1D5B89A3F454F3E532242FC1DE2B71A9FFF56F812F6E4638885 |
| Malicious: | false |
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 213287 |
| Entropy (8bit): | 7.489603354812552 |
| Encrypted: | false |
| SSDEEP: | 3072:WL9bmzfRKieKf7D+J2fmj2iT+mcc+v9dbGh0OxZL7pETPCgM54LjqqJVbX5Tvth:WL9b2RzZD+J2f6AryJNQ/LjFJppTlh |
| MD5: | 1DD1D79AAFF9507EDDC216B384AECED4 |
| SHA1: | AC335E49694F0CAD10CB7452691EEE5FCFD89EF0 |
| SHA-256: | 0DFBDAB8E6499BD6F6785C14266C6DBB965BCC57B8608FBD76627493A63EE34A |
| SHA-512: | 73831B529EB00BB7257312A26E64982FDEEAFDB7AD0E5FF7E98527B90E61AAA31368CD401751E77A77584BAABF349D30DC8270BE0DCD69B1FCFEE065DD8A0DE9 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 485127 |
| Entropy (8bit): | 1.2565961974341746 |
| Encrypted: | false |
| SSDEEP: | 768:bgBMgq+aLnwfPnz/Km1iLGyDPiU55NCk+T93YpnK77oTpvYP3knePjlW0kwNGL+q:XQ3wvosOsCpxFJrXSBmHzTu58UR |
| MD5: | 580D05E679E74B036B55CA8E5FF32769 |
| SHA1: | 10175C43AB7B725FFFCF770EB2C3555E91D3BA13 |
| SHA-256: | B3E34975017C193D4672BEC42BC52B55F8AE1F1D5F30D56DCFD0B3A4242C3BE4 |
| SHA-512: | 0E26F0084BED372785A5E8C8BE3A0717074AA52C2E8B5413FA9F2CB8DEED40BF8BDBF15C411EFFA432A8B96E50AE6085E8F90A97350827AFAA1BE1AB4B3E1643 |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| File Type: | |
| Category: | modified |
| Size (bytes): | 754 |
| Entropy (8bit): | 3.3027259102800293 |
| Encrypted: | false |
| SSDEEP: | 12:8wl0dsXMlykXuGlnEElkXOEOqkXu3w/g/jNJkKAp4t2YZ/elFlSJm:8OrWvlX3qw/4hHAzqy |
| MD5: | 4CF5311D4D3C7F8529A7444A1BDE92AC |
| SHA1: | 87C97FA322DAB6719FE9111565D34D4849833FF0 |
| SHA-256: | 32B62B1DB267EB609645F136E4D54B38A04D9246C7AEBC2DD9DB4BA5D3213616 |
| SHA-512: | 4F3921FFC4E0DF7DEB2E8AF4BC2C9B4D1645829BFBB205FB22E159AC0234F68DA7A38C8A23DC772DEADF135425B369F11EECAB0A7E69FB8E62C53F7E5B171E1E |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.547557976911724 |
| TrID: |
|
| File name: | SvmL9tW29w.exe |
| File size: | 891'920 bytes |
| MD5: | f189174b0a4a4e9689b6c47693bb6d37 |
| SHA1: | 152a93f75fceb347dd241956bc4836a0b31b9f11 |
| SHA256: | d34f580b7d5be3be089661d02663d0605cd776008a2301491f11299c13f6642f |
| SHA512: | 98c952a97445439ed3cceda2b19e6a7671b82b6c3e940ba3bf6dfeaf332ce9066b63c92c893e3d9723cf5404d1a07706c1510074dc3cbbc869673d246d42c10d |
| SSDEEP: | 24576:OiGFaq43NvCqehuh6OCIujTrlKzUPIEf/RJ/QOeao:OiGFu3Nvsuh6OCHdKzUPIEfJJ/qao |
| TLSH: | CF151262F600EDAAE4358F314C5ED146EBE4BE5929640B6B3F997F0EBEB2440D10F605 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG.*_...PG..PF.IPG.*_...PG..sw..PG..VA..PG.Rich.PG.........PE..L... ..`.................f...|......H3............@ |
 | |
| Icon Hash: | 0e13672535353f1c |
| Entrypoint: | 0x403348 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x60FC9220 [Sat Jul 24 22:20:16 2021 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | ced282d9b261d1462772017fe2f6972b |
| Signature Valid: | false |
| Signature Issuer: | CN="vanterie Basophilic Tempre ", E=Invitingness@Afskrivningsmuli.Tu, L=Hellingen, S=Th\xfcringen, C=DE |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | B9F27A9058DEAD89D3A4ECCE1CDC297C |
| Thumbprint SHA-1: | AB01B77C5DE6BE92E7262C44CBE448F7B654AB24 |
| Thumbprint SHA-256: | 4256B130F34841160418997C1CAFA3D00A2D93945B6E67064E52B7324153C2AB |
| Serial: | 52C815182F6BCC8CD8CEDD3A74D70FE2850BA228 |
| Instruction |
|---|
| sub esp, 00000184h |
| push ebx |
| push esi |
| push edi |
| xor ebx, ebx |
| push 00008001h |
| mov dword ptr [esp+18h], ebx |
| mov dword ptr [esp+10h], 0040A198h |
| mov dword ptr [esp+20h], ebx |
| mov byte ptr [esp+14h], 00000020h |
| call dword ptr [004080B8h] |
| call dword ptr [004080BCh] |
| and eax, BFFFFFFFh |
| cmp ax, 00000006h |
| mov dword ptr [0042F42Ch], eax |
| je 00007FD9D8CAEFB3h |
| push ebx |
| call 00007FD9D8CB2116h |
| cmp eax, ebx |
| je 00007FD9D8CAEFA9h |
| push 00000C00h |
| call eax |
| mov esi, 004082A0h |
| push esi |
| call 00007FD9D8CB2092h |
| push esi |
| call dword ptr [004080CCh] |
| lea esi, dword ptr [esi+eax+01h] |
| cmp byte ptr [esi], bl |
| jne 00007FD9D8CAEF8Dh |
| push 0000000Bh |
| call 00007FD9D8CB20EAh |
| push 00000009h |
| call 00007FD9D8CB20E3h |
| push 00000007h |
| mov dword ptr [0042F424h], eax |
| call 00007FD9D8CB20D7h |
| cmp eax, ebx |
| je 00007FD9D8CAEFB1h |
| push 0000001Eh |
| call eax |
| test eax, eax |
| je 00007FD9D8CAEFA9h |
| or byte ptr [0042F42Fh], 00000040h |
| push ebp |
| call dword ptr [00408038h] |
| push ebx |
| call dword ptr [00408288h] |
| mov dword ptr [0042F4F8h], eax |
| push ebx |
| lea eax, dword ptr [esp+38h] |
| push 00000160h |
| push eax |
| push ebx |
| push 00429850h |
| call dword ptr [0040816Ch] |
| push 0040A188h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8544 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x58000 | 0x41dd0 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0xd8878 | 0x1398 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x29c | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x6457 | 0x6600 | f6e38befa56abea7a550141c731da779 | False | 0.6682368259803921 | data | 6.434985703212657 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x1380 | 0x1400 | 569269e9338b2e8ce268ead1326e2b0b | False | 0.4625 | data | 5.2610038973135005 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x25538 | 0x600 | 17edd496e40111b5a48947c480fda13c | False | 0.4635416666666667 | data | 4.133728555004788 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x30000 | 0x28000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x58000 | 0x41dd0 | 0x41e00 | 51f103b856396aac282c5bd5a24beff1 | False | 0.6063619248102466 | data | 5.8960782160116745 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x583b8 | 0x130ca | PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced | English | United States | 0.998410786148207 |
| RT_ICON | 0x6b488 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.40775464332189754 |
| RT_ICON | 0x7bcb0 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.4554866512507883 |
| RT_ICON | 0x85158 | 0x67e8 | Device independent bitmap graphic, 80 x 160 x 32, image size 26560 | English | United States | 0.462218045112782 |
| RT_ICON | 0x8b940 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.4729667282809612 |
| RT_ICON | 0x90dc8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.46835144071799717 |
| RT_ICON | 0x94ff0 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.5149377593360995 |
| RT_ICON | 0x97598 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.5457317073170732 |
| RT_ICON | 0x98640 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.6073770491803279 |
| RT_ICON | 0x98fc8 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.6719858156028369 |
| RT_DIALOG | 0x99430 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x99530 | 0x11c | data | English | United States | 0.6056338028169014 |
| RT_DIALOG | 0x99650 | 0xc4 | data | English | United States | 0.5918367346938775 |
| RT_DIALOG | 0x99718 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x99778 | 0x92 | Targa image data - Map 32 x 12490 x 1 +1 | English | United States | 0.7191780821917808 |
| RT_VERSION | 0x99810 | 0x27c | data | English | United States | 0.5 |
| RT_MANIFEST | 0x99a90 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States | 0.5542168674698795 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegCreateKeyExA, RegEnumKeyA, RegQueryValueExA, RegSetValueExA, RegCloseKey, RegDeleteValueA, RegDeleteKeyA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, SetFileSecurityA, RegOpenKeyExA, RegEnumValueA |
| SHELL32.dll | SHGetFileInfoA, SHFileOperationA, SHGetPathFromIDListA, ShellExecuteExA, SHGetSpecialFolderLocation, SHBrowseForFolderA |
| ole32.dll | IIDFromString, OleInitialize, OleUninitialize, CoCreateInstance, CoTaskMemFree |
| COMCTL32.dll | ImageList_Create, ImageList_Destroy, ImageList_AddMasked |
| USER32.dll | SetClipboardData, CharPrevA, CallWindowProcA, PeekMessageA, DispatchMessageA, MessageBoxIndirectA, GetDlgItemTextA, SetDlgItemTextA, GetSystemMetrics, CreatePopupMenu, AppendMenuA, TrackPopupMenu, FillRect, EmptyClipboard, LoadCursorA, GetMessagePos, CheckDlgButton, GetSysColor, SetCursor, GetWindowLongA, SetClassLongA, SetWindowPos, IsWindowEnabled, GetWindowRect, GetSystemMenu, EnableMenuItem, RegisterClassA, ScreenToClient, EndDialog, GetClassInfoA, SystemParametersInfoA, CreateWindowExA, ExitWindowsEx, DialogBoxParamA, CharNextA, SetTimer, DestroyWindow, CreateDialogParamA, SetForegroundWindow, SetWindowTextA, PostQuitMessage, SendMessageTimeoutA, ShowWindow, wsprintfA, GetDlgItem, FindWindowExA, IsWindow, GetDC, SetWindowLongA, LoadImageA, InvalidateRect, ReleaseDC, EnableWindow, BeginPaint, SendMessageA, DefWindowProcA, DrawTextA, GetClientRect, EndPaint, IsWindowVisible, CloseClipboard, OpenClipboard |
| GDI32.dll | SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject |
| KERNEL32.dll | GetExitCodeProcess, WaitForSingleObject, GetProcAddress, GetSystemDirectoryA, WideCharToMultiByte, MoveFileExA, ReadFile, GetTempFileNameA, WriteFile, RemoveDirectoryA, CreateProcessA, CreateFileA, GetLastError, CreateThread, CreateDirectoryA, GlobalUnlock, GetDiskFreeSpaceA, GlobalLock, SetErrorMode, GetVersion, lstrcpynA, GetCommandLineA, GetTempPathA, lstrlenA, SetEnvironmentVariableA, ExitProcess, GetWindowsDirectoryA, GetCurrentProcess, GetModuleFileNameA, CopyFileA, GetTickCount, Sleep, GetFileSize, GetFileAttributesA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetShortPathNameA, MoveFileA, CompareFileTime, SetFileTime, SearchPathA, lstrcmpiA, lstrcmpA, CloseHandle, GlobalFree, GlobalAlloc, ExpandEnvironmentStringsA, LoadLibraryExA, FreeLibrary, lstrcpyA, lstrcatA, FindClose, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, SetFilePointer, GetModuleHandleA, FindNextFileA, FindFirstFileA, DeleteFileA, MulDiv |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-10T15:57:07.035370+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.7 | 49971 | 142.250.184.238 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 10, 2025 15:57:05.865165949 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:05.865217924 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:05.865286112 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:05.980515957 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:05.980539083 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:06.644485950 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:06.644732952 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:06.645284891 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:06.645355940 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:06.697398901 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:06.697429895 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:06.697787046 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:06.697846889 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:06.702080011 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:06.743335009 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.035372019 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.035443068 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:07.035470963 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.035526991 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:07.035706997 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:07.035737038 CET | 443 | 49971 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.035784006 CET | 49971 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:07.058865070 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.058914900 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.058989048 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.059309959 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.059329987 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.693686962 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.693813086 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.699172020 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.699186087 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.699475050 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.699911118 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.700583935 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:07.743330002 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.092874050 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.092952013 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.093015909 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:08.093027115 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.094352961 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:08.102031946 CET | 49972 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:08.102055073 CET | 443 | 49972 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.241878986 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.241934061 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.242549896 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.242861986 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.242877960 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.900635958 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.900770903 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.901652098 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.901719093 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.903722048 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.903743982 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.904197931 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:08.904254913 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.904681921 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:08.947340965 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.291043997 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.291167974 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.291194916 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.291237116 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.291251898 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.291296959 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.291332006 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.291349888 CET | 443 | 49973 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.291363955 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.291393995 CET | 49973 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:09.301584959 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.301625013 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.301702976 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.301951885 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.301963091 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.930059910 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.930202007 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.930608988 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.930619001 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:09.930802107 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:09.930809021 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.344460011 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.344528913 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.344593048 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.344609022 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:10.344635010 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:10.344644070 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:10.411978960 CET | 49974 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:10.412020922 CET | 443 | 49974 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.559205055 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:10.559257030 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:10.559387922 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:10.563486099 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:10.563510895 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.308274984 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.308345079 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.308996916 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.309014082 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.309201956 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.309207916 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.717729092 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.717809916 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.717895031 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.717919111 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.718064070 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.718082905 CET | 443 | 49975 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.718094110 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.718934059 CET | 49975 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:11.740874052 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:11.740926027 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:11.742988110 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:11.743417025 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:11.743429899 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.404921055 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.405049086 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.405669928 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.405687094 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.405853987 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.405863047 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.986104965 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.986148119 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.986234903 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.986257076 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.986268997 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.986303091 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.986306906 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:12.986356974 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.987109900 CET | 49976 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:12.987122059 CET | 443 | 49976 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:13.101475954 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.101524115 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:13.102035046 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.102035046 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.102072001 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:13.913198948 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:13.915891886 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.991341114 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.991355896 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:13.991499901 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:13.991507053 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.303448915 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.303575993 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:14.303590059 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.303675890 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:14.303905010 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:14.303939104 CET | 443 | 49977 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.304047108 CET | 49977 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:14.312123060 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.312170982 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.312637091 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.312947035 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.312958956 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.946090937 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.946197033 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.946785927 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.946796894 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:14.946980953 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:14.946988106 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.362287998 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.362356901 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:15.362374067 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.362420082 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:15.362425089 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.362472057 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:15.363066912 CET | 49978 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:15.363085032 CET | 443 | 49978 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.476538897 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:15.476576090 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:15.476744890 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:15.477046967 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:15.477061987 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.215559959 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.215898037 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.216352940 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.216427088 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.218329906 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.218362093 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.218611956 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.218664885 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.219897032 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.263329029 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.616677046 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.616776943 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.616789103 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.616836071 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.617001057 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.617037058 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.617212057 CET | 443 | 49979 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.617253065 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.617253065 CET | 49979 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:16.650754929 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:16.650829077 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:16.650919914 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:16.651190042 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:16.651206017 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.290888071 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.291037083 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.291627884 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.291659117 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.291793108 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.291806936 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.698515892 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.698585987 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.698654890 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.698681116 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.698681116 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.698719025 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.699407101 CET | 49980 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:17.699428082 CET | 443 | 49980 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.851983070 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:17.852054119 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:17.852317095 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:17.853038073 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:17.853049994 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.481798887 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.481944084 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.482528925 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.482610941 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.484097958 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.484108925 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.484339952 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.484400988 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.484724998 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.527340889 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.893218994 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.893384933 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.893409967 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.893471003 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.893604994 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.893639088 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.893802881 CET | 443 | 49981 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.893863916 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.893882990 CET | 49981 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:18.917033911 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:18.917085886 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:18.917162895 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:18.917476892 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:18.917493105 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:19.578403950 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:19.578530073 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:19.579101086 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:19.579123974 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:19.579257011 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:19.579269886 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.006863117 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.007028103 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.007055998 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.007086992 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.007097006 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.007186890 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.007256985 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.007869959 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.007888079 CET | 443 | 49982 | 142.250.185.97 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.007916927 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.007936001 CET | 49982 | 443 | 192.168.2.7 | 142.250.185.97 |
| Jan 10, 2025 15:57:20.166724920 CET | 49983 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:20.166778088 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.167602062 CET | 49983 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:20.167602062 CET | 49983 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:20.167639971 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.814476013 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.814590931 CET | 49983 | 443 | 192.168.2.7 | 142.250.184.238 |
| Jan 10, 2025 15:57:20.815263987 CET | 443 | 49983 | 142.250.184.238 | 192.168.2.7 |
| Jan 10, 2025 15:57:20.815329075 CET | 49983 | 443 | 192.168.2.7 | 142.250.184.238 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 10, 2025 15:57:05.851869106 CET | 54985 | 53 | 192.168.2.7 | 1.1.1.1 |
| Jan 10, 2025 15:57:05.859226942 CET | 53 | 54985 | 1.1.1.1 | 192.168.2.7 |
| Jan 10, 2025 15:57:07.051259995 CET | 54118 | 53 | 192.168.2.7 | 1.1.1.1 |
| Jan 10, 2025 15:57:07.058032990 CET | 53 | 54118 | 1.1.1.1 | 192.168.2.7 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 10, 2025 15:57:05.851869106 CET | 192.168.2.7 | 1.1.1.1 | 0xd1cd | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 10, 2025 15:57:07.051259995 CET | 192.168.2.7 | 1.1.1.1 | 0xc904 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 10, 2025 15:57:05.859226942 CET | 1.1.1.1 | 192.168.2.7 | 0xd1cd | No error (0) | 142.250.184.238 | A (IP address) | IN (0x0001) | false | ||
| Jan 10, 2025 15:57:07.058032990 CET | 1.1.1.1 | 192.168.2.7 | 0xc904 | No error (0) | 142.250.185.97 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.7 | 49971 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:06 UTC | 216 | OUT | |
| 2025-01-10 14:57:07 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.7 | 49972 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:07 UTC | 258 | OUT | |
| 2025-01-10 14:57:08 UTC | 2226 | IN | |
| 2025-01-10 14:57:08 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.7 | 49973 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:08 UTC | 418 | OUT | |
| 2025-01-10 14:57:09 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.7 | 49974 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:09 UTC | 460 | OUT | |
| 2025-01-10 14:57:10 UTC | 1851 | IN | |
| 2025-01-10 14:57:10 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.7 | 49975 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:11 UTC | 418 | OUT | |
| 2025-01-10 14:57:11 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.7 | 49976 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:12 UTC | 460 | OUT | |
| 2025-01-10 14:57:12 UTC | 1851 | IN | |
| 2025-01-10 14:57:12 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.7 | 49977 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:13 UTC | 418 | OUT | |
| 2025-01-10 14:57:14 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.7 | 49978 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:14 UTC | 460 | OUT | |
| 2025-01-10 14:57:15 UTC | 1851 | IN | |
| 2025-01-10 14:57:15 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.7 | 49979 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:16 UTC | 418 | OUT | |
| 2025-01-10 14:57:16 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.7 | 49980 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:17 UTC | 460 | OUT | |
| 2025-01-10 14:57:17 UTC | 1844 | IN | |
| 2025-01-10 14:57:17 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.7 | 49981 | 142.250.184.238 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:18 UTC | 418 | OUT | |
| 2025-01-10 14:57:18 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.7 | 49982 | 142.250.185.97 | 443 | 8044 | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-10 14:57:19 UTC | 460 | OUT | |
| 2025-01-10 14:57:19 UTC | 1851 | IN | |
| 2025-01-10 14:57:19 UTC | 1652 | IN |
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:53:14 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 891'920 bytes |
| MD5 hash: | F189174B0A4A4E9689B6C47693BB6D37 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
| Target ID: | 9 |
| Start time: | 11:54:00 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\SvmL9tW29w.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 891'920 bytes |
| MD5 hash: | F189174B0A4A4E9689B6C47693BB6D37 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 17.1% |
| Dynamic/Decrypted Code Coverage: | 13.9% |
| Signature Coverage: | 16.2% |
| Total number of Nodes: | 1533 |
| Total number of Limit Nodes: | 47 |
Graph
Function 00403348 Relevance: 89.6, APIs: 32, Strings: 19, Instructions: 366stringcomfileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F1A98 Relevance: 20.1, APIs: 13, Instructions: 591stringlibrarymemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004058BF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040646B Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004027A1 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040390A Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402EA1 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040618A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406492 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402476 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405796 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401EC5 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C90 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405761 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F2A38 Relevance: 1.6, APIs: 1, Instructions: 143memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040266D Relevance: 1.6, APIs: 1, Instructions: 76COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040272B Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040239C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D08 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D37 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F2921 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004023E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403300 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040535C Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040460D Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406945 Relevance: .3, Instructions: 334COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040711C Relevance: .3, Instructions: 300COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404B80 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004042E6 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405D66 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F22F1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004041E2 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F24D8 Relevance: 10.6, APIs: 7, Instructions: 124COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404ACE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402DBA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F1837 Relevance: 7.7, APIs: 5, Instructions: 194COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405A8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402E3D Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405192 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405AD6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 742F10E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405BF5 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|