Edit tour

Windows Analysis Report
PDF6UU0CVUO2W-YGVUIO.scr.exe

Overview

General Information

Sample name:	PDF6UU0CVUO2W-YGVUIO.scr.exe
Analysis ID:	1591785
MD5:	9d8bc1bd62ddd6ebe6f9e25a8c73bca3
SHA1:	0a34d97de35ea1c4252bb2bf148c1173666f7343
SHA256:	53744fdba0544f915f43eddad494ea07a405776df30864415d6b1445db042481
Tags:	exescruser-cocaman
Infos:

Detection

MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

PDF6UU0CVUO2W-YGVUIO.scr.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe" MD5: 9D8BC1BD62DDD6EBE6F9E25A8C73BCA3)

PDF6UU0CVUO2W-YGVUIO.scr.exe (PID: 7588 cmdline: "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe" MD5: 9D8BC1BD62DDD6EBE6F9E25A8C73BCA3)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "obgee2025@plavuto.top", "Password": "l~La1~er*~N&          ", "Server": "mail.plavuto.top", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeaa7:$a1: get_encryptedPassword 0xedcf:$a2: get_encryptedUsername 0xe842:$a3: get_timePasswordChanged 0xe963:$a4: get_passwordField 0xeabd:$a5: set_encryptedPassword 0x1040e:$a7: get_logins 0x100bf:$a8: GetOutlookPasswords 0xfeb1:$a9: StartKeylogger 0x1035e:$a10: KeyLoggerEventArgs 0xff0e:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1269663136.0000000005D10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf617:$a1: get_encryptedPassword 0x25c37:$a1: get_encryptedPassword 0xf93f:$a2: get_encryptedUsername 0x25f5f:$a2: get_encryptedUsername 0xf3b2:$a3: get_timePasswordChanged 0x259d2:$a3: get_timePasswordChanged 0xf4d3:$a4: get_passwordField 0x25af3:$a4: get_passwordField 0xf62d:$a5: set_encryptedPassword 0x25c4d:$a5: set_encryptedPassword 0x10f7e:$a7: get_logins 0x2759e:$a7: get_logins 0x10c2f:$a8: GetOutlookPasswords 0x2724f:$a8: GetOutlookPasswords 0x10a21:$a9: StartKeylogger 0x27041:$a9: StartKeylogger 0x10ece:$a10: KeyLoggerEventArgs 0x274ee:$a10: KeyLoggerEventArgs 0x10a7e:$a11: KeyLoggerEventArgsEventHandler 0x2709e:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x188cd7:$a1: get_encryptedPassword 0x188fff:$a2: get_encryptedUsername 0x188a72:$a3: get_timePasswordChanged 0x188b93:$a4: get_passwordField 0x188ced:$a5: set_encryptedPassword 0x18a63e:$a7: get_logins 0x18a2ef:$a8: GetOutlookPasswords 0x18a0e1:$a9: StartKeylogger 0x18a58e:$a10: KeyLoggerEventArgs 0x18a13e:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1266311796.0000000003445000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x645de:$a1: get_encryptedPassword 0x89fc5:$a1: get_encryptedPassword 0x648f7:$a2: get_encryptedUsername 0x8a2de:$a2: get_encryptedUsername 0x6438d:$a3: get_timePasswordChanged 0x89d74:$a3: get_timePasswordChanged 0x644ae:$a4: get_passwordField 0x89e95:$a4: get_passwordField 0x645f4:$a5: set_encryptedPassword 0x89fdb:$a5: set_encryptedPassword 0x65eec:$a7: get_logins 0x8b8d3:$a7: get_logins 0x65b9d:$a8: GetOutlookPasswords 0x8b584:$a8: GetOutlookPasswords 0x6598f:$a9: StartKeylogger 0x8b376:$a9: StartKeylogger 0x65e3c:$a10: KeyLoggerEventArgs 0x8b823:$a10: KeyLoggerEventArgs 0x659ec:$a11: KeyLoggerEventArgsEventHandler 0x8b3d3:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x120d9:$a1: get_encryptedPassword 0x123f2:$a2: get_encryptedUsername 0x11e88:$a3: get_timePasswordChanged 0x11fa9:$a4: get_passwordField 0x120ef:$a5: set_encryptedPassword 0x139e7:$a7: get_logins 0x13698:$a8: GetOutlookPasswords 0x1348a:$a9: StartKeylogger 0x13937:$a10: KeyLoggerEventArgs 0x134e7:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeca7:$a1: get_encryptedPassword 0xefcf:$a2: get_encryptedUsername 0xea42:$a3: get_timePasswordChanged 0xeb63:$a4: get_passwordField 0xecbd:$a5: set_encryptedPassword 0x1060e:$a7: get_logins 0x102bf:$a8: GetOutlookPasswords 0x100b1:$a9: StartKeylogger 0x1055e:$a10: KeyLoggerEventArgs 0x1010e:$a11: KeyLoggerEventArgsEventHandler
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x13c43:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13141:$a3: \Google\Chrome\User Data\Default\Login Data 0x1344f:$a4: \Orbitum\User Data\Default\Login Data 0x14247:$a5: \Kometa\User Data\Default\Login Data
4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeca7:$a1: get_encryptedPassword 0xefcf:$a2: get_encryptedUsername 0xea42:$a3: get_timePasswordChanged 0xeb63:$a4: get_passwordField 0xecbd:$a5: set_encryptedPassword 0x1060e:$a7: get_logins 0x102bf:$a8: GetOutlookPasswords 0x100b1:$a9: StartKeylogger 0x1055e:$a10: KeyLoggerEventArgs 0x1010e:$a11: KeyLoggerEventArgsEventHandler
4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x13c43:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13141:$a3: \Google\Chrome\User Data\Default\Login Data 0x1344f:$a4: \Orbitum\User Data\Default\Login Data 0x14247:$a5: \Kometa\User Data\Default\Login Data
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xcea7:$a1: get_encryptedPassword 0xd1cf:$a2: get_encryptedUsername 0xcc42:$a3: get_timePasswordChanged 0xcd63:$a4: get_passwordField 0xcebd:$a5: set_encryptedPassword 0xe80e:$a7: get_logins 0xe4bf:$a8: GetOutlookPasswords 0xe2b1:$a9: StartKeylogger 0xe75e:$a10: KeyLoggerEventArgs 0xe30e:$a11: KeyLoggerEventArgsEventHandler
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x11e43:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11341:$a3: \Google\Chrome\User Data\Default\Login Data 0x1164f:$a4: \Orbitum\User Data\Default\Login Data 0x12447:$a5: \Kometa\User Data\Default\Login Data
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeca7:$a1: get_encryptedPassword 0x252c7:$a1: get_encryptedPassword 0xefcf:$a2: get_encryptedUsername 0x255ef:$a2: get_encryptedUsername 0xea42:$a3: get_timePasswordChanged 0x25062:$a3: get_timePasswordChanged 0xeb63:$a4: get_passwordField 0x25183:$a4: get_passwordField 0xecbd:$a5: set_encryptedPassword 0x252dd:$a5: set_encryptedPassword 0x1060e:$a7: get_logins 0x26c2e:$a7: get_logins 0x102bf:$a8: GetOutlookPasswords 0x268df:$a8: GetOutlookPasswords 0x100b1:$a9: StartKeylogger 0x266d1:$a9: StartKeylogger 0x1055e:$a10: KeyLoggerEventArgs 0x26b7e:$a10: KeyLoggerEventArgs 0x1010e:$a11: KeyLoggerEventArgsEventHandler 0x2672e:$a11: KeyLoggerEventArgsEventHandler
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x13c43:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2a263:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13141:$a3: \Google\Chrome\User Data\Default\Login Data 0x29761:$a3: \Google\Chrome\User Data\Default\Login Data 0x1344f:$a4: \Orbitum\User Data\Default\Login Data 0x29a6f:$a4: \Orbitum\User Data\Default\Login Data 0x14247:$a5: \Kometa\User Data\Default\Login Data 0x2a867:$a5: \Kometa\User Data\Default\Login Data
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xcea7:$a1: get_encryptedPassword 0xd1cf:$a2: get_encryptedUsername 0xcc42:$a3: get_timePasswordChanged 0xcd63:$a4: get_passwordField 0xcebd:$a5: set_encryptedPassword 0xe80e:$a7: get_logins 0xe4bf:$a8: GetOutlookPasswords 0xe2b1:$a9: StartKeylogger 0xe75e:$a10: KeyLoggerEventArgs 0xe30e:$a11: KeyLoggerEventArgsEventHandler
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x11e43:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11341:$a3: \Google\Chrome\User Data\Default\Login Data 0x1164f:$a4: \Orbitum\User Data\Default\Login Data 0x12447:$a5: \Kometa\User Data\Default\Login Data
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.356288c.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.34a9f20.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.344da0c.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 22 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T13:20:12.854585+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49703	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "obgee2025@plavuto.top", "Password": "l~La1~er*~N& ", "Server": "mail.plavuto.top", "Port": 587}

Multi AV Scanner detection for submitted file

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49731 version: TLS 1.0

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: FZfi.pdbSHA256 source: PDF6UU0CVUO2W-YGVUIO.scr.exe
Source:	Binary string: FZfi.pdb source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 01859731h	4_2_01859480
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 01859E5Ah	4_2_01859A40
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 01859E5Ah	4_2_01859A30
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 01859E5Ah	4_2_01859D87
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2F2A8h	4_2_05A2F000
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A25E15h	4_2_05A25AD8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A28830h	4_2_05A28588
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A247C9h	4_2_05A24520
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A276D0h	4_2_05A27428
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2F700h	4_2_05A2F458
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2E9F8h	4_2_05A2E750
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A25929h	4_2_05A25680
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A283D8h	4_2_05A28130
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2E5A0h	4_2_05A2E2F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A254D1h	4_2_05A25228
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A25079h	4_2_05A24DD0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A27F80h	4_2_05A27CD8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A27278h	4_2_05A26FD0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A24C21h	4_2_05A24978
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2FB58h	4_2_05A2F8B0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A27B28h	4_2_05A27880
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05A2EE50h	4_2_05A2EBA8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF62B5h	4_2_05FF60D8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF6C3Fh	4_2_05FF60D8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF18A0h	4_2_05FF15F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF3840h	4_2_05FF3598
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF0740h	4_2_05FF0498
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF26E0h	4_2_05FF2438
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then mov esp, ebp	4_2_05FF8728
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF49A0h	4_2_05FF46F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then mov esp, ebp	4_2_05FF869F
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_05FF51E8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF1448h	4_2_05FF11A0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF33E8h	4_2_05FF3140
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF02E8h	4_2_05FF0040
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF4548h	4_2_05FF42A0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF0FF0h	4_2_05FF0D48
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF2F90h	4_2_05FF2CE8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF2152h	4_2_05FF1EA8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF40F0h	4_2_05FF3E48
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF3C98h	4_2_05FF39F0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF0B98h	4_2_05FF08F0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF2B38h	4_2_05FF2890
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF4DF8h	4_2_05FF4B50
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4x nop then jmp 05FF1CF8h	4_2_05FF1A50

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49703 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49731 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000345B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000345B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namex
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 0_2_01864204	0_2_01864204
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 0_2_01867018	0_2_01867018
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 0_2_0186D8EC	0_2_0186D8EC
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_0185C530	4_2_0185C530
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_018527B9	4_2_018527B9
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_01852DD1	4_2_01852DD1
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_01859480	4_2_01859480
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_0185C521	4_2_0185C521
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_0185946F	4_2_0185946F
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A26138	4_2_05A26138
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2F000	4_2_05A2F000
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A213A8	4_2_05A213A8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2BC50	4_2_05A2BC50
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2AE78	4_2_05A2AE78
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A289E0	4_2_05A289E0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A20AB8	4_2_05A20AB8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A25AD8	4_2_05A25AD8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A28588	4_2_05A28588
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A24520	4_2_05A24520
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2450F	4_2_05A2450F
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A28579	4_2_05A28579
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27428	4_2_05A27428
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27418	4_2_05A27418
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2F448	4_2_05A2F448
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2F458	4_2_05A2F458
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2E740	4_2_05A2E740
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2E750	4_2_05A2E750
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A25680	4_2_05A25680
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2566F	4_2_05A2566F
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A28120	4_2_05A28120
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A28130	4_2_05A28130
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A26115	4_2_05A26115
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2E170	4_2_05A2E170
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A20320	4_2_05A20320
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A20330	4_2_05A20330
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2E2F8	4_2_05A2E2F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A25228	4_2_05A25228
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2521A	4_2_05A2521A
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A24DC0	4_2_05A24DC0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A24DD0	4_2_05A24DD0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27CC8	4_2_05A27CC8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A20CD8	4_2_05A20CD8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27CD8	4_2_05A27CD8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2EFF0	4_2_05A2EFF0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A26FC3	4_2_05A26FC3
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A26FD0	4_2_05A26FD0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A289D0	4_2_05A289D0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A24969	4_2_05A24969
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A24978	4_2_05A24978
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2F8A0	4_2_05A2F8A0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2F8B0	4_2_05A2F8B0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27880	4_2_05A27880
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A27871	4_2_05A27871
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2EBA8	4_2_05A2EBA8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A2EB98	4_2_05A2EB98
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05A25ACA	4_2_05A25ACA
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF60D8	4_2_05FF60D8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF8030	4_2_05FF8030
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF7390	4_2_05FF7390
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF6D48	4_2_05FF6D48
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF79E0	4_2_05FF79E0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF15F8	4_2_05FF15F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF15E8	4_2_05FF15E8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF3598	4_2_05FF3598
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF358A	4_2_05FF358A
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0498	4_2_05FF0498
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0488	4_2_05FF0488
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2438	4_2_05FF2438
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2427	4_2_05FF2427
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF46F8	4_2_05FF46F8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF46E9	4_2_05FF46E9
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF51E8	4_2_05FF51E8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF51D8	4_2_05FF51D8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF11A0	4_2_05FF11A0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF1190	4_2_05FF1190
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF3140	4_2_05FF3140
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF3132	4_2_05FF3132
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF60C9	4_2_05FF60C9
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0040	4_2_05FF0040
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF8020	4_2_05FF8020
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0007	4_2_05FF0007
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF7380	4_2_05FF7380
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF42A0	4_2_05FF42A0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF4290	4_2_05FF4290
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0D48	4_2_05FF0D48
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF0D39	4_2_05FF0D39
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF6D37	4_2_05FF6D37
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2CE8	4_2_05FF2CE8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2CDA	4_2_05FF2CDA
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF1EA8	4_2_05FF1EA8
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF1E9A	4_2_05FF1E9A
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF3E48	4_2_05FF3E48
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF3E38	4_2_05FF3E38
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF39F0	4_2_05FF39F0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF39E1	4_2_05FF39E1
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF79D0	4_2_05FF79D0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF08F0	4_2_05FF08F0
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF08E1	4_2_05FF08E1
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2890	4_2_05FF2890
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF2882	4_2_05FF2882
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF4B50	4_2_05FF4B50
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF4B40	4_2_05FF4B40
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF1A50	4_2_05FF1A50
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF1A40	4_2_05FF1A40

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: invalid certificate

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1266311796.0000000003445000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1270739606.0000000007A10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1269663136.0000000005D10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1266311796.0000000003371000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000000.1255439503.0000000000EEC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFZfi.exeB vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1264681128.000000000151E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2516116228.00000000011E7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PDF6UU0CVUO2W-YGVUIO.scr.exe
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe	Binary or memory string: OriginalFilenameFZfi.exeB vs PDF6UU0CVUO2W-YGVUIO.scr.exe

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PDF6UU0CVUO2W-YGVUIO.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Mutant created: NULL

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000349E000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2520309790.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000034DD000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000034AE000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000034D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000000.1255376335.0000000000E62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO users (first_name, last_name, email, [password]) VALUES (@firstName, @lastName, @email, @password);

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process created: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process created: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: FZfi.pdbSHA256 source: PDF6UU0CVUO2W-YGVUIO.scr.exe
Source:	Binary string: FZfi.pdb source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: 0xF4D857CA [Thu Mar 4 04:49:14 2100 UTC]

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FF87B0 push esp; iretd		4_2_05FF87B1
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Code function: 4_2_05FFB2E7 push esp; retf		4_2_05FFB321

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe

Static PE information: section name: .text entropy: 7.626848152072666

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 1860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 3370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 8F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 9F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: A160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: B160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 1850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Memory allocated: 53C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe TID: 7456

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2516747881.0000000001607000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Code function: 4_2_05A20AB8 LdrInitializeThunk,LdrInitializeThunk,

4_2_05A20AB8

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Process created: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe "C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.356288c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.34a9f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.344da0c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1269663136.0000000005D10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1266311796.0000000003445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.5d10000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.356288c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.34a9f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.344da0c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1269663136.0000000005D10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1266311796.0000000003445000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.4379970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PDF6UU0CVUO2W-YGVUIO.scr.exe.438ff90.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PDF6UU0CVUO2W-YGVUIO.scr.exe PID: 7588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PDF6UU0CVUO2W-YGVUIO.scr.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeLogger
PDF6UU0CVUO2W-YGVUIO.scr.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.96.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000345B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/DataSet1.xsd	PDF6UU0CVUO2W-YGVUIO.scr.exe	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000345B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	PDF6UU0CVUO2W-YGVUIO.scr.exe	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namex	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, PDF6UU0CVUO2W-YGVUIO.scr.exe, 00000004.00000002.2519139152.000000000343E000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.96.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591785
Start date and time:	2025-01-15 13:19:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PDF6UU0CVUO2W-YGVUIO.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 75 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 13.107.253.45, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:20:00	API Interceptor	1x Sleep call for process: PDF6UU0CVUO2W-YGVUIO.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.96.1	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/kbd2/?EtJTX=_JVX4ryxDRQpLJF&cNPH=ufZ7RYF4yLxNXVSq5Vx/4TYieRbcnKjskkbM3L5RbgB1pAgqHA7sfCNkYWLyXRMMwBB3JLbYKUw1FAOWml6VLpxPVZ4qXf58MsNUIQgw/PJ5HUGIvLQvrl5frN9PrRFpPiAd2cDcH6Sr
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/58m5/
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
193.122.130.0	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b6AGgIJ87g.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
checkip.dyndns.com	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://eventor.orienteering.asn.au/Home/RedirectToLivelox?redirectUrl=https%3A%2F%2Farchive1.diqx8fescpsb0.amplifyapp.com%2Fm1%2Fenvelope%2Fdocument%2Fcontent%2F4086	Get hash	malicious	Unknown	Browse	104.17.25.14
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	Davx2k2025.doc	Get hash	malicious	Unknown	Browse	104.18.95.41
	Setup_BrightSlide_1.0.9.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	9179390927_20250115_155451.html	Get hash	malicious	HTMLPhisher	Browse	104.18.187.31
	Davx2k2025.doc	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://www.pdfforge.org/pdfcreator?srsltid=AfmBOoq1lpA5qNxfcLUyxjmEXAioeKYtqPTpBsIbZ5VOdq3uhOg1WclG	Get hash	malicious	Unknown	Browse	104.21.80.92
	https://kullumanali.org	Get hash	malicious	Anonymous Proxy	Browse	1.1.1.1
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPT0wVekqsfeOZRSaz9d28itE0eTxOetbwlGaCx05rQJywXo_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aRXzCg4yzvno75Wb80hSd5kw8Ua5r4R2pwCFTS4zDFYiEkWB-2BYk1VUWtpkJwb9IQIMAq1SSLT005wiJ2XiGw1jPEr6v61MJQRnC7AeLVtxYgqGlydBoPFbs1IP04-2BxPajuRI3fTsnzWZ9ty3RasYpwuqdrF0E8VoyYkggeeLEm9ENK69uYTCVHWHpxCPkzirQSIkvpt5FNZojg491ibS35IgO0LPU5gnpEaeaUj4-2BZoFUHIAAzMMy-2BYqsZ9F9Ldu1c-3D#X	Get hash	malicious	HTMLPhisher	Browse	104.21.96.1
ORACLE-BMC-31898US	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	m68k.elf	Get hash	malicious	Unknown	Browse	193.122.239.186
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1

Process:	C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.451721899513802
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PDF6UU0CVUO2W-YGVUIO.scr.exe
File size:	639'496 bytes
MD5:	9d8bc1bd62ddd6ebe6f9e25a8c73bca3
SHA1:	0a34d97de35ea1c4252bb2bf148c1173666f7343
SHA256:	53744fdba0544f915f43eddad494ea07a405776df30864415d6b1445db042481
SHA512:	b19a0ce9ebc0c419ce53b5f646d90dc53744480bd40d1c84f7caf29f688deff25503cb20ca709828d10e088d60b43d1ed6687b10aef4d39ee3d2b7c20a64de8d
SSDEEP:	12288:ZYRxA4Y5lyA/BxSPCVZxTEQBae03JIpfsTC6RPBI6RgZOYNCVpveB/B19kR:uRwL9BaZJIpoC6R5I2SOY+pvc/ng
TLSH:	56D4E15052D8D8C2D8531F701D72F2B416687E9DA931CE17AFEA3DAB7A73382247520E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W................0.............2.... ........@.. ....................................@................................

File Icon


Icon Hash:	7534351900049948

Static PE Info

General

Entrypoint:	0x48aa32
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF4D857CA [Thu Mar 4 04:49:14 2100 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
call far 0000h : 003E9999h
aas
int CCh
dec esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a9dd	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0xfb44	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x98c00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8920c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x88a48	0x88c00	2999a5309a2984da123b2ca3bfd97ba7	False	0.893092293190128	data	7.626848152072666	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8c000	0xfb44	0xfc00	1e00d7a5a83fc8e564d73c034d28dab9	False	0.26354786706349204	data	4.340677806585484	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9c000	0xc	0x200	214d8ace13f15f12d8ae10346f9a8324	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x8c130	0xf4c4	Device independent bitmap graphic, 150 x 202 x 32, image size 60600, resolution 3779 x 3779 px/m	0.25759655282476857
RT_GROUP_ICON	0x9b5f4	0x14	data	1.1
RT_VERSION	0x9b608	0x350	data	0.4257075471698113
RT_MANIFEST	0x9b958	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T13:20:12.854585+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49703	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:20:01.573172092 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:20:01.578077078 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:20:01.578140020 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:20:01.578397036 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:20:01.583214998 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:20:11.273300886 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:20:11.281291962 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:20:11.286251068 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:20:12.802160978 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:20:12.814521074 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:12.814563990 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:12.814634085 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:12.852652073 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:12.852673054 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:12.854584932 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:20:13.336136103 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.336314917 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:13.356759071 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:13.356775999 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.357256889 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.401506901 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:13.593390942 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:13.639343977 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.703957081 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.704044104 CET	443	49731	104.21.96.1	192.168.2.7
Jan 15, 2025 13:20:13.704123020 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:20:13.773293972 CET	49731	443	192.168.2.7	104.21.96.1
Jan 15, 2025 13:21:17.801110029 CET	80	49703	193.122.130.0	192.168.2.7
Jan 15, 2025 13:21:17.801213026 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:21:52.808484077 CET	49703	80	192.168.2.7	193.122.130.0
Jan 15, 2025 13:21:52.820784092 CET	80	49703	193.122.130.0	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 13:20:01.559859037 CET	49723	53	192.168.2.7	1.1.1.1
Jan 15, 2025 13:20:01.567037106 CET	53	49723	1.1.1.1	192.168.2.7
Jan 15, 2025 13:20:12.806370020 CET	55269	53	192.168.2.7	1.1.1.1
Jan 15, 2025 13:20:12.813658953 CET	53	55269	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 13:20:01.559859037 CET	192.168.2.7	1.1.1.1	0x4040	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.806370020 CET	192.168.2.7	1.1.1.1	0xb1ca	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:01.567037106 CET	1.1.1.1	192.168.2.7	0x4040	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 13:20:12.813658953 CET	1.1.1.1	192.168.2.7	0xb1ca	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	193.122.130.0	80	7588	C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 13:20:01.578397036 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 13:20:11.273300886 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 12:20:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 871152efd7872a7f88cabea32374f3a7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 13:20:11.281291962 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 13:20:12.802160978 CET	321	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 12:20:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2462871b7f9d14833f1aab5118481376 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49731	104.21.96.1	443	7588	C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 12:20:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 12:20:13 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 12:20:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2258402 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mB7fAHYyV9ULCn4jkMIQe1g0ZJZ899dWqQQmX4wmvDNrYW14eb%2BFafbuDxtCAlqGT%2BBB%2F8JoEL5JYaBsiuN4WQlUX9CViWpNjmNtjIz32HZs%2Fq5vh2M%2BzFtCnG%2F0PMCifRtDbQ51"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9025d1914f23de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&min_rtt=1479&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1889967&cwnd=194&unsent_bytes=0&cid=ea6d5517d3e36f8e&ts=382&x=0"
2025-01-15 12:20:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	07:19:59
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"
Imagebase:	0xe60000
File size:	639'496 bytes
MD5 hash:	9D8BC1BD62DDD6EBE6F9E25A8C73BCA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1269663136.0000000005D10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1267082972.0000000004379000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1267082972.00000000043B7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1266311796.0000000003445000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:20:00
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PDF6UU0CVUO2W-YGVUIO.scr.exe"
Imagebase:	0xfc0000
File size:	639'496 bytes
MD5 hash:	9D8BC1BD62DDD6EBE6F9E25A8C73BCA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.2515751185.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	108
Total number of Limit Nodes:	8

Executed Functions

Function 01864204 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

Ppq, xrefs: 018671F1

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Ppq
API String ID: 0-1927884935
Opcode ID: bbbb2879a43f40eab6bec606d3e3a4c7e19c87e8623c487ef0daa8f543bf49b5
Instruction ID: 906f1609f65c2576b5d05eb9c9a89e931bec8dd351623a4ee1d2678647a4763f
Opcode Fuzzy Hash: bbbb2879a43f40eab6bec606d3e3a4c7e19c87e8623c487ef0daa8f543bf49b5
Instruction Fuzzy Hash: A5819374E002099FDB55DFA9D984AEDBBF6FF88300F208129E819AB354DB345946CF51

Function 01867018 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

Ppq, xrefs: 018671F1

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Ppq
API String ID: 0-1927884935
Opcode ID: efd45d28a697af7f8f0fbe30092a4f292a6b1ada7f16e264c0be9e928a6df2c4
Instruction ID: 3f6276dcaf03511d02358c9247fa2bdf3f3023d6c0047015fc2071f717fdb347
Opcode Fuzzy Hash: efd45d28a697af7f8f0fbe30092a4f292a6b1ada7f16e264c0be9e928a6df2c4
Instruction Fuzzy Hash: 9A81B374E002099FDB15DFA9D984AEDBBF6FF88310F208129D819AB364DB346946CF51

Function 0186B3C1 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0186B626

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: badc9d884b7371b6450c51ebcf5776c6c6c4f1ac47f2d8f9d1cec3472a3272f1
Instruction ID: 3f169e6050ce59d95fb0a0922c657471841eeff7b723f0476bf598975d9ca804
Opcode Fuzzy Hash: badc9d884b7371b6450c51ebcf5776c6c6c4f1ac47f2d8f9d1cec3472a3272f1
Instruction Fuzzy Hash: 64815770A00B058FE725DF69D55479ABBF5FF88308F00892EE58ADBA50D734E905CB91

Function 018644F0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c4ba261207164f34efac74f04a5f6bd5fda09039ac4f93e64cdebe1f9b58820d
Instruction ID: 8287299752ecc8900c791cecaafd3d417ee7d8d8aa54f8d93317e6700520d108
Opcode Fuzzy Hash: c4ba261207164f34efac74f04a5f6bd5fda09039ac4f93e64cdebe1f9b58820d
Instruction Fuzzy Hash: 504190B1C0071DCBEB24DFAAD884B9DBBF5BF49304F20816AD508AB251DB755945CF90

Function 0186590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018659C9

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4028db97c6a73a179ceb2dac4985f1c31b1133effe29634d4616a419c34c1f4f
Instruction ID: c095e816da84717f6ac2960394bbb965d4ce1490c7b57fdf09b8e64f88d6fff6
Opcode Fuzzy Hash: 4028db97c6a73a179ceb2dac4985f1c31b1133effe29634d4616a419c34c1f4f
Instruction Fuzzy Hash: 8341BFB1C01719CBEB24DFA9D885BDDBBF5BF49304F20806AD808AB251DB796946CF50

Function 0591D509 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0591D3FD,?,?), ref: 0591D4AF

Memory Dump Source

Source File: 00000000.00000002.1268821003.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5910000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 266cbfa2f419b26075b2e483ec0f4b256ed0c215f296d3aa16d3784b6ec65614
Instruction ID: e441ea05cdeeeca6862e93305379dcc7cbf52b1e096c028bed519cd3c0fb5c1f
Opcode Fuzzy Hash: 266cbfa2f419b26075b2e483ec0f4b256ed0c215f296d3aa16d3784b6ec65614
Instruction Fuzzy Hash: 132160B2A087544FEB328B6AD444776FFF9AF41228F0DC16BD88AC7552C638D509CB58

Function 0591D410 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0591D3FD,?,?), ref: 0591D4AF

Memory Dump Source

Source File: 00000000.00000002.1268821003.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5910000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: fdbf4c9c77772d3137e639cb527d7d1cad55d533550708c52997201f3983fe23
Instruction ID: 8a22e03ce0451d9368b31e3fd8d3353531a51db83c9d4828348218f44736e202
Opcode Fuzzy Hash: fdbf4c9c77772d3137e639cb527d7d1cad55d533550708c52997201f3983fe23
Instruction Fuzzy Hash: 4231E2B5D003199FDB10CF9AD884AEEBBF9FB48310F14842AE919A7350D775A944CFA4

Function 0591C04C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0591D3FD,?,?), ref: 0591D4AF

Memory Dump Source

Source File: 00000000.00000002.1268821003.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5910000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: de0508bddf3aa2c926a18fb01fbe1b469a28b0c0e088bc1904cc4ef384f8790a
Instruction ID: b5b221c845b522e63d31136f22c3be29697b72c59d70ffe4114fdbd35f2baa7e
Opcode Fuzzy Hash: de0508bddf3aa2c926a18fb01fbe1b469a28b0c0e088bc1904cc4ef384f8790a
Instruction Fuzzy Hash: 3A31DFB5D0031D9FDB10CF9AD884AAEBBF9FB48310F14842AE919A7350D774A944CFA4

Function 0186B3B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0186D586,?,?,?,?,?), ref: 0186DA4F

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d437555468152f584df821ab2dfcf81fcf71fe5fc04df070a625ec82cb98d8cc
Instruction ID: 0bbe5b758d57a52b5537996eda34d508def0f7c10c0405f92e6a4f8e17d5c420
Opcode Fuzzy Hash: d437555468152f584df821ab2dfcf81fcf71fe5fc04df070a625ec82cb98d8cc
Instruction Fuzzy Hash: EB21E5B5D04248DFDB10CFAAD884AEEBBF9EB48314F14841AE954A7350D374A944CFA5

Function 0186D9C1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0186D586,?,?,?,?,?), ref: 0186DA4F

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c086467c3bfd4a8e92d3b94234585ff24039627939f5aa0932b3b353a3bb2370
Instruction ID: f532925201257c475186d4559c0973f91deb9f395b023604b7a8ea6c41ce3b6f
Opcode Fuzzy Hash: c086467c3bfd4a8e92d3b94234585ff24039627939f5aa0932b3b353a3bb2370
Instruction Fuzzy Hash: B22112B5D00248DFDB10CFA9D984AEEBBF4FB48310F14841AE958A3350C338AA54CFA4

Function 0186B5C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0186B626

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 89c3c7525f51cffd3f6284ddc9ec274d440eeff63e9152e2c9eb48737ab61c96
Instruction ID: 14eb99f4a46be50b561de27996ef3cf15f619758d6e0a6cb37840f8562863e36
Opcode Fuzzy Hash: 89c3c7525f51cffd3f6284ddc9ec274d440eeff63e9152e2c9eb48737ab61c96
Instruction Fuzzy Hash: EB11DFB6D002498FDB24DF9AD844ADEFBF8AF88314F10841AD519A7610C379A645CFA5

Function 0591D4F0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,0591D3FD,?,?), ref: 0591D4AF

Memory Dump Source

Source File: 00000000.00000002.1268821003.0000000005910000.00000040.00000800.00020000.00000000.sdmp, Offset: 05910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5910000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 7c0ccf19f4f63e9a281f3f190a883007a2f41a04acb13e317757f7f111522d95
Instruction ID: 64d8ab0def1e2ef10d036dae5d4f6e986b9102a9cbd7dd02db92e7f1cb28d8ed
Opcode Fuzzy Hash: 7c0ccf19f4f63e9a281f3f190a883007a2f41a04acb13e317757f7f111522d95
Instruction Fuzzy Hash: CE01A2728043589FEF118F98E804BDDBBF5EF54318F24841BE5149B290C3755445CB54

Function 0150D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264665830.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2f91bb9166ee315400ece8557edc5ca7002e613bd37a6406893df696dfc00b
Instruction ID: 3a7776db7f5efc0c6e5b864f14156ca686961bfff5f17b7d20174c6bb182dd7c
Opcode Fuzzy Hash: 3e2f91bb9166ee315400ece8557edc5ca7002e613bd37a6406893df696dfc00b
Instruction Fuzzy Hash: DE212871504204DFDB16DFD4D9C0B5ABBB5FB84324F20C56DE9090F296C376E456CAA2

Function 0150D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264665830.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff59fec58589f9d33b5b52595db0c614eb93aaac8247f34714cf8b0b1750dac
Instruction ID: 96701498cbe35d8785a8d17b549051683acd51b4942e327c5645a0dbf6d8047e
Opcode Fuzzy Hash: 9ff59fec58589f9d33b5b52595db0c614eb93aaac8247f34714cf8b0b1750dac
Instruction Fuzzy Hash: FA21A171504244EFDB16DFD4D9C0B2ABBB5FB88318F248569ED090F296C336D456CAA2

Function 0181D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264938470.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d549bb6839f894e334b48001f06fac35cba165ae0dbfb157d8c1084b3ebb816
Instruction ID: f413ffe8ab49ce41cd950596709b2acea352ea9a631f53fce8b242fe57eb0fe9
Opcode Fuzzy Hash: 0d549bb6839f894e334b48001f06fac35cba165ae0dbfb157d8c1084b3ebb816
Instruction Fuzzy Hash: 76216772904304EFDB01DF94D5C8B55BBA9FB84328F20C76DE8098F24AC336E506CA61

Function 0181D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264938470.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50300a245969d713d1a10bff92c077e6768fdece5364c217d34b5b9d58385b86
Instruction ID: e566589c2b3f1211bdb5c2615b95040ca77ea629b1e9468540ee698030edf7b1
Opcode Fuzzy Hash: 50300a245969d713d1a10bff92c077e6768fdece5364c217d34b5b9d58385b86
Instruction Fuzzy Hash: AD212576504304EFDB15DF64D9C8B16BBA9FB84314F20C66DE80A8B24AC33BD547CA62

Function 0150D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264665830.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: daed8456aaa24d0387c31866c07534ff5ff45691552f33677dac208bb4418f1a
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: 7711CD72404240CFCB12CF94D5C4B5ABF71FB84324F2486A9D9090F656C33AE456CBA1

Function 0150D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264665830.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: 628e4d0c002e014bfdea50ada13a3aee76e0f2ba75f97470f009738c41bf9fa7
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: 00119D76504280CFCB16CF94D5C4B1ABF71FB88318F2486A9DD490F696C33AD45ACBA1

Function 0181D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264938470.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 97f16010e23216c89b232ed0eda8441bb1137efb65773e876825fb2a0883a5c5
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 5F11BE76504280CFCB12CF54D5C8B15BBA1FB44314F24C6A9D8098B65AC33BD54ACB62

Function 0181D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1264938470.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_181d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 6a644054baf50e8b8fb2c4b4d3a02bed7ac0b3aa43fe76039285f52ea55911a4
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: A111BB76504280DFCB12CF54D5C8B15BBA2FB84324F24C6A9D8498B69AC33AE40ACB61

Non-executed Functions

Function 0186D8EC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1265120646.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a185748f00c37acd9d6af9190f10f00cdb358a74354d28548ac1e997de6c05
Instruction ID: c9d6aa30859ce6e57c7f3285cf4bd897d0594c696723617a4b89fe7961142e67
Opcode Fuzzy Hash: 16a185748f00c37acd9d6af9190f10f00cdb358a74354d28548ac1e997de6c05
Instruction Fuzzy Hash: 09A18232E002098FCF05DFB8D85459EBBF6FF85301B15856AE905EB265DB71EA46CB40

Analysis Process: PDF6UU0CVUO2W-YGVUIO.scr.exePID: 7588, Parent PID: 7432COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.6%
Total number of Nodes:	77
Total number of Limit Nodes:	13

Executed Functions

Function 0185C530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 0185F910

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 74f9d06461fbe6815f9538c3f714d428aeab390dddab9c9729604018580907ba
Instruction ID: 73d15dd9caf705a6a18c2bfb884d9dccab64276508809f11a94b36669365d210
Opcode Fuzzy Hash: 74f9d06461fbe6815f9538c3f714d428aeab390dddab9c9729604018580907ba
Instruction Fuzzy Hash: 6073D631D1075A8EDB11EF68C944A99FBB1FF99300F51C6DAE4586B221EB70AAC4CF41

Function 05A20AB8 Relevance: 3.5, APIs: 2, Instructions: 529
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05A20D70

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2fdc529f2577b1b2faf1e5eb117573625e327428779b4aade77fb107ad46285c
Instruction ID: 362900bffa727df5b30eb807efe84ff2745b3b0962948fc6d0a4b72cebd598f1
Opcode Fuzzy Hash: 2fdc529f2577b1b2faf1e5eb117573625e327428779b4aade77fb107ad46285c
Instruction Fuzzy Hash: 1C222B74E002298FDB14DFA9C989B9DBBF2BF84304F1481A9D409AB355DB349D86CF50

Function 018527B9 Relevance: 3.1, Strings: 2, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 01852C95
Xq, xrefs: 01852CBE

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: 6e59553bfda9e7075eb1ddf16c0287527c030c56e753ad011c1452f27e0e5f83
Instruction ID: 2e3e351ec9442736784fa2103bfc6f427af06cd51ff3cacb0f5728e9fee49538
Opcode Fuzzy Hash: 6e59553bfda9e7075eb1ddf16c0287527c030c56e753ad011c1452f27e0e5f83
Instruction Fuzzy Hash: 78324C31546796CFC7174F78C5567C677F2EF2A218B2804ECEC91CA06AEB6644A3EB04

Function 01852DD1 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 01852E0F
$q, xrefs: 01852DF6

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: d2a3727053ea7a56c078ce99f2a7fa522796c9792d7a360cc206420ca20b92a8
Instruction ID: 967a9b39fa1c1bb14fcb0ca18987ad8904a6e7a6fa92b081f5912c59dd8489aa
Opcode Fuzzy Hash: d2a3727053ea7a56c078ce99f2a7fa522796c9792d7a360cc206420ca20b92a8
Instruction Fuzzy Hash: EC919431F00318DFDB98DB75985927EBBB7BFC8350B04845DE906D7288DE3589028B91

Function 05A20CD8 Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05A20D70

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 336154f00c1f123838da8ac29e0edab175c850d43f417cabea5e7f244589f3c7
Instruction ID: d185fee7fb9f5a4c99be6097cfeceeda196b597332d9c6d8b5a088d6ae5f584d
Opcode Fuzzy Hash: 336154f00c1f123838da8ac29e0edab175c850d43f417cabea5e7f244589f3c7
Instruction Fuzzy Hash: 9731E8B1D016189BEB18CFAAD988BDDFBF2BF88314F14C16AD418A72A4DB704945CF10

Function 05FF60D8 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2436d98a7df1774a29a4a1264ff80c00260426e23f9ab51b0e922cff685622cd
Instruction ID: 7240cf64238c6bdcde85c459eebae1892811de388e6047af1d70fa3f943fc3ac
Opcode Fuzzy Hash: 2436d98a7df1774a29a4a1264ff80c00260426e23f9ab51b0e922cff685622cd
Instruction Fuzzy Hash: 0572CE74E052298FDB64DF69C984BEDBBB2BF49300F1481E9D509AB265DB349E81CF40

Function 05A25AD8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2aa4d3aa0cc011f5b2a6aae946c4862abdf4be5bab930f062bce5d8cdd1e10e
Instruction ID: 27e2e16164723ac57597618d5726cb9c1580252e086bc5542b7c9757afbacbd5
Opcode Fuzzy Hash: f2aa4d3aa0cc011f5b2a6aae946c4862abdf4be5bab930f062bce5d8cdd1e10e
Instruction Fuzzy Hash: 6EE1B074E01218CFEB64DFA9C944B9DBBB2BF89300F2081A9D409AB394DB755E85CF51

Function 05A2F000 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98962f25b285a9b746eb8a2964383993b8c489a7d27c3671abee51338e3feff
Instruction ID: 8124c0e32c557f575d2eafea80c80fd69c0325c28b004c60f9e824d87f9ba907
Opcode Fuzzy Hash: d98962f25b285a9b746eb8a2964383993b8c489a7d27c3671abee51338e3feff
Instruction Fuzzy Hash: F4C18074E00218CFDB14DFA9C955BADBBB2FB89300F2081A9D809AB355DB359E85CF50

Function 01859480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27217b603bf94306fc2865f14bb20d119784a17cabaed9e368cbddeeff3efc04
Instruction ID: 8eb89fb2e56a6e01f799e80b9c175a7f8c924b30f8c0092c0d595c33472a48b9
Opcode Fuzzy Hash: 27217b603bf94306fc2865f14bb20d119784a17cabaed9e368cbddeeff3efc04
Instruction Fuzzy Hash: 84C19074E00218CFDB64DFA5D954BADBBB2FB88304F1081A9D809AB355DB35AE85CF50

Function 0185C521 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddec6a6d23844b1c5dbad97490cadd32f77e4b627326c4a3c8e8054ef11b08a
Instruction ID: fd866d048b9c2bfbcb1e9fdd27fa3d4d2e9ac0e48683ed5460cbe0be6f502aa0
Opcode Fuzzy Hash: 8ddec6a6d23844b1c5dbad97490cadd32f77e4b627326c4a3c8e8054ef11b08a
Instruction Fuzzy Hash: E1A11571D007198EDB11DFA9C8847DDFBB5EF89304F10C2AAE418AB261EB709A85CF41

Function 01859A30 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706b9fcb4f27fad53f6a918a7fa9f9369edd8f7c6073052ff749dd42dbbf41cd
Instruction ID: 798bdefa32a2eed1114a40cd16c1776b6e876af48e58d55f8baa3c5c5b8b25a3
Opcode Fuzzy Hash: 706b9fcb4f27fad53f6a918a7fa9f9369edd8f7c6073052ff749dd42dbbf41cd
Instruction Fuzzy Hash: F8A1E470D00208CFEB24DFA9C5887DDBBB1FF88304F248269E509AB295DB749A85CF55

Function 01859A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d24f5ab7679fbad7eb3bbd36522b72db0783f143d0a127497242f696fd714a8
Instruction ID: 3a7279e5337760a80c733275d132ebe41daed03b9fceb4c1f7fd419a00c6a496
Opcode Fuzzy Hash: 0d24f5ab7679fbad7eb3bbd36522b72db0783f143d0a127497242f696fd714a8
Instruction Fuzzy Hash: 6FA1F570D00208CFEB24DFA9C5887DDBBB1FF48314F248269E509AB295DB749A85CF55

Function 01859D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf24aa24e8e8486e3b1abfed3c01855c9ed7d2d69eecb40ed610982ac3422d4b
Instruction ID: 06f59ebc172edad3531c5e4e9d4c2cd8fe097b8ad79d8c45f51c8b6092e12889
Opcode Fuzzy Hash: bf24aa24e8e8486e3b1abfed3c01855c9ed7d2d69eecb40ed610982ac3422d4b
Instruction Fuzzy Hash: 4F91F370D00208CFEB60DFA8C588BDCBBB1FF49315F248259E409AB291DB749A85CF55

Function 0185946F Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e1bb0a59cc3445093ab53d2de814ecea86e8d9d405d5e51469d88dbbb7c64d
Instruction ID: 1230d197e9d43093851ec0a580f2fd05b79c3590c18ec4ab2a80cff664d58477
Opcode Fuzzy Hash: b4e1bb0a59cc3445093ab53d2de814ecea86e8d9d405d5e51469d88dbbb7c64d
Instruction Fuzzy Hash: 4B41B274E00208CBEB58CFAAD55469EBBF2EF88304F24D12AD819AB259DB385945CF54

Function 0185B500 Relevance: 6.6, Strings: 5, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 0185B97A
Hq, xrefs: 0185B749
Hq, xrefs: 0185B54E
8q, xrefs: 0185B941
Hq, xrefs: 0185B6EA

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: 8q$Hq$Hq$Hq$TJq
API String ID: 0-768243005
Opcode ID: bfcdaf887ec68b040b6714a82be6f72ba880a3cb97c4476918e3cc64a33a7a59
Instruction ID: 954f75d1f657b5a0926aeaa8437b30f8f46b95ec7413b6cce16de57ea34a2fb0
Opcode Fuzzy Hash: bfcdaf887ec68b040b6714a82be6f72ba880a3cb97c4476918e3cc64a33a7a59
Instruction Fuzzy Hash: 68D1D231B042048FDB55DB6CC895AAD7BF7EF89320F18406AE905EB391CA34DD42CBA1

Function 05FF9462 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05FF94FE
GetCurrentThread.KERNEL32 ref: 05FF953B
GetCurrentProcess.KERNEL32 ref: 05FF9578
GetCurrentThreadId.KERNEL32 ref: 05FF95D1

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8fd12539a781c998b1ba57b79c48f30a1d5a102ef7db87453a6f6657e934579f
Instruction ID: 63e786302b2e183548aab93e9a4c21273a3b16353b92edbc3e2cb30fbb3b5af7
Opcode Fuzzy Hash: 8fd12539a781c998b1ba57b79c48f30a1d5a102ef7db87453a6f6657e934579f
Instruction Fuzzy Hash: BC5145B0D013498FDB14CFA9D948BAEBBF1EF88314F24805AE109A73A0D7786945CB65

Function 05FF9480 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 05FF94FE
GetCurrentThread.KERNEL32 ref: 05FF953B
GetCurrentProcess.KERNEL32 ref: 05FF9578
GetCurrentThreadId.KERNEL32 ref: 05FF95D1

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b9585a93288fa0451e1889e19c579459545f9913534b15a31f684ad96c716c7f
Instruction ID: f5ce5b64cd541104710bdee37be21c8766519da138507d7f817e704769f5996a
Opcode Fuzzy Hash: b9585a93288fa0451e1889e19c579459545f9913534b15a31f684ad96c716c7f
Instruction Fuzzy Hash: C65123B49003098FDB14CFA9D948BAEBBF1FF88314F248459E509A7360DB78A944CB65

Function 0185AD3D Relevance: 5.5, Strings: 4, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 0185B239
Hq, xrefs: 0185B1D3
Hq, xrefs: 0185B206
, xrefs: 0185B015

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: $Hq$Hq$Hq
API String ID: 0-1373062214
Opcode ID: 25e390c0f1cc292196973598847e4c1f4f38f0a5ddb16b13c58aa4483c157983
Instruction ID: f8642fe632716f7f5f03c6a484696a669e4b69997300e7235ab98db2f49d623c
Opcode Fuzzy Hash: 25e390c0f1cc292196973598847e4c1f4f38f0a5ddb16b13c58aa4483c157983
Instruction Fuzzy Hash: 3361E430B046049FEB656F78A45926E7BA3EFC5361F64452AE916C73D0CF358E02CB91

Function 018519B8 Relevance: 5.3, Strings: 4, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 01851AB0
Xq, xrefs: 01851B7C
Xq, xrefs: 01851B2F
Xq, xrefs: 01851A76

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: 768b38243a5c18139f560b7e621423ca3bd4b420d78b1074299ad4c44c96149a
Instruction ID: 920fd3fe6aa664937060ba031af1be0906905e2eaf50678e779ac581f5d3388d
Opcode Fuzzy Hash: 768b38243a5c18139f560b7e621423ca3bd4b420d78b1074299ad4c44c96149a
Instruction Fuzzy Hash: 47C1AC3094132A8FCB569B78858939A77F3EF6A304F2044A9EC45DB258EB314A93DB51

Function 0185AF78 Relevance: 5.2, Strings: 4, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 0185B239
, xrefs: 0185B065
Hq, xrefs: 0185B1D3
Hq, xrefs: 0185B206

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: $Hq$Hq$Hq
API String ID: 0-1373062214
Opcode ID: 667f6851be5d574369d035749dff31dac04f0b2064291af7a6f706a9fdb8e7c7
Instruction ID: ca3c8a893de87be184fbd001b40b30270fd635ae1a0a195c151dd13f3b92adc1
Opcode Fuzzy Hash: 667f6851be5d574369d035749dff31dac04f0b2064291af7a6f706a9fdb8e7c7
Instruction Fuzzy Hash: A37106307006049BEF656F78A45927E7AA3EFD5361F64422AEA26C73D0CF358E02C791

Function 01853F78 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

PHq, xrefs: 018540F2
PHq, xrefs: 018540E1

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: f28063d484164f8499eae043cb807237a1c3ae561533ab394d79afe794bdd7d0
Instruction ID: 85f83172ac6301f1ccd82f0ddc60427afe5443ca25eb684bd9dac6eb7a32867e
Opcode Fuzzy Hash: f28063d484164f8499eae043cb807237a1c3ae561533ab394d79afe794bdd7d0
Instruction Fuzzy Hash: CC51C674E00608DFDB44DFA9D994A9DBBF2FF89310F248469E815AB354EB34A941CF50

Function 0185B869 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

TJq, xrefs: 0185B97A
8q, xrefs: 0185B941

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: 8q$TJq
API String ID: 0-1436491226
Opcode ID: fccfd87f9d9a44b79b47f44ed3da1175a4d7e2d26410534ec60a35347828be96
Instruction ID: 3dca5c3498aab4ba06b6d737ecf73d875eff4f10fae552204f77a653ee03e521
Opcode Fuzzy Hash: fccfd87f9d9a44b79b47f44ed3da1175a4d7e2d26410534ec60a35347828be96
Instruction Fuzzy Hash: E7311535B002098FDB55DBA8C481E9DBBB2EF88320F195184E905EF361DA70ED468BA1

Function 0185B89D Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

TJq, xrefs: 0185B97A
8q, xrefs: 0185B941

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: 8q$TJq
API String ID: 0-1436491226
Opcode ID: 10993b9acbd5d90a933f16bcf71320a49901994784e96f7dfde43eaa578f77b0
Instruction ID: ba7f9f4760d52bdf4669eae5287eb5a483d9fc83e0a3183d151221458b55cd79
Opcode Fuzzy Hash: 10993b9acbd5d90a933f16bcf71320a49901994784e96f7dfde43eaa578f77b0
Instruction Fuzzy Hash: B8312635B002098FDB55DFA8C481EDDBBB2EF88320F194154E505EF361DA71ED468BA1

Function 05FF9AD0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05FF9B57

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aebbc8164cc7f363b7bb9d1efb31b5c2a3c3017ca62ed7cc8ba752ea755a6676
Instruction ID: 5627d396abbf3f9ef6efd49f5846fdf35fca122e07967b9f357c914e7b9b2515
Opcode Fuzzy Hash: aebbc8164cc7f363b7bb9d1efb31b5c2a3c3017ca62ed7cc8ba752ea755a6676
Instruction Fuzzy Hash: 7E21C2B5D002499FDB10CFAAD984ADEBBF8FB48310F14841AE918A7350D379A954CFA5

Function 05FF9AC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05FF9B57

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 280911d9c9a8e0afec6f8af628403df650e71f5fe4b4cdf32eb36d4453d43aff
Instruction ID: 371c933ce04551c112b2fd83819eb791da8f149e95b7944bc11a9196071516b8
Opcode Fuzzy Hash: 280911d9c9a8e0afec6f8af628403df650e71f5fe4b4cdf32eb36d4453d43aff
Instruction Fuzzy Hash: 6321D2B5D002099FDB10CFAAD984ADEBBF8FF48214F14841AE918A7650D378A954CF65

Function 05A210BC Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05A211FE

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bf8e94cdf4aeeaa00bcaed1ee06a39165a07c38bb07039f66ae3caee4ba1ca7
Instruction ID: 157eb14ca645b70c85078a811389e147bee6fd0a660764df21e31e59528f6df1
Opcode Fuzzy Hash: 8bf8e94cdf4aeeaa00bcaed1ee06a39165a07c38bb07039f66ae3caee4ba1ca7
Instruction Fuzzy Hash: BA116D74E042299FDB04DBADD585EADB7F6FB88304F148168E804AB242D7309941CB60

Function 01850B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

LRq, xrefs: 01850B62

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 2b497ad8698826863d49f252bdc0f772ad8861a499f09872678844119aca3904
Instruction ID: 39a7f924cb2b5f7fc248bafba1db2a533964ab53c42735dfc7525be3895f2e17
Opcode Fuzzy Hash: 2b497ad8698826863d49f252bdc0f772ad8861a499f09872678844119aca3904
Instruction Fuzzy Hash: 9EA1E874E00309DFCB54DFA8E984AAEBBB5FB48300F109169E805AB354DB34AD06CF91

Function 01850B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LRq, xrefs: 01850B62

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 49c97e3386ef4259e229631cdb05d08d9878dc0457cf753c6cf99970b96e9ad4
Instruction ID: 2abf80966302b4da546bea96b2843e67367e19b5cadeef064ddd2dd7c59c8ecd
Opcode Fuzzy Hash: 49c97e3386ef4259e229631cdb05d08d9878dc0457cf753c6cf99970b96e9ad4
Instruction Fuzzy Hash: 15A1EA74E00309DFCB54DFA8E984AAEBBB5FB48310F109169E815AB355DB34AD06CF91

Function 0185BDE8 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

Hq, xrefs: 0185BE36

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 05d2223aefe503002f71be4d10c68e8bb7a9e2f35d0dfbb34d3998480b303830
Instruction ID: 136d086cc968a10f5fa74e11e9dfe62ea079d55d6a92fe19d4d5683e7846722f
Opcode Fuzzy Hash: 05d2223aefe503002f71be4d10c68e8bb7a9e2f35d0dfbb34d3998480b303830
Instruction Fuzzy Hash: 352191347042059FD754DF68C995B6EBBB6FF98310F248069DA05CB365CE309E06CB90

Function 0185BD01 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Hq, xrefs: 0185BD2D

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: cd1cda4e9b0953871f450125513b9baac25d84acdbbc79e701af7f038206c6f0
Instruction ID: 1589b2b63e68e349688c49e0f1aa4dd3e80cdb29691c71b100270b4987f732ce
Opcode Fuzzy Hash: cd1cda4e9b0953871f450125513b9baac25d84acdbbc79e701af7f038206c6f0
Instruction Fuzzy Hash: FA218171B002099FDB44EFB8D955AAEBBB6EF88340F544469E105DB255DA309E02CB90

Function 0185BF80 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4278ca6e52421d677d4781dd2e1596fe507c99794ea690d796bac1aa1e4d7e06
Instruction ID: d70a8c9cc45822c4b7f99cd098f504e33d17458b80f7c2dc3e5365c51f72e92d
Opcode Fuzzy Hash: 4278ca6e52421d677d4781dd2e1596fe507c99794ea690d796bac1aa1e4d7e06
Instruction Fuzzy Hash: 9261F672B007059FCB64DB7DD884AAABBF9EBC9324B14853AE919D7340D731D9018BA0

Function 01853168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442b036b800ef7b85c5589b884c37cba053a3b1900f89474de34e9f7ab325317
Instruction ID: c380d60e358fe2ff004784fc470efd9300c6edc28bdcd31434d1b47010a9b7a3
Opcode Fuzzy Hash: 442b036b800ef7b85c5589b884c37cba053a3b1900f89474de34e9f7ab325317
Instruction Fuzzy Hash: 47419274E012089FDB48DFAAD884A9DBBF2FF89300F149129E805B7364DB349945CF55

Function 01859249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211f0d1dd875850ba5f61fc397dd84670f03b9932df253f5bf3a47afa48bd179
Instruction ID: b93cc3ef68b2d20e83db2c42509f7cdf2bc95eb7d87c44cbeb4ef4308e47fae9
Opcode Fuzzy Hash: 211f0d1dd875850ba5f61fc397dd84670f03b9932df253f5bf3a47afa48bd179
Instruction Fuzzy Hash: 8A31C17907A60B8FD2642B21A5AE27A7FE6FB0F31BB086C10F60E81915CF385448DB50

Function 018518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200dcb09b17ca43a6eaae90c618077b09bb5ee85192602f98d2d4686fb6783e3
Instruction ID: 10ae0790541d4873805f8bca3758a4e764529d4f70fd545d54a986b9b0f7fe4f
Opcode Fuzzy Hash: 200dcb09b17ca43a6eaae90c618077b09bb5ee85192602f98d2d4686fb6783e3
Instruction Fuzzy Hash: 91218E35A002199FCB54DF28C844ABE7BB5EF89350BA08159DD19DB384DB35EE06CBD1

Function 0185BC28 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec8370af4a9bc5172610b11b6b816c7a9ac7573667ee52b769892d0a2ab1469
Instruction ID: 57d9f8c8e151761a6cc9d75332db45acd4b8253ac7320deb0b8792aa5862f00c
Opcode Fuzzy Hash: eec8370af4a9bc5172610b11b6b816c7a9ac7573667ee52b769892d0a2ab1469
Instruction Fuzzy Hash: B02105357053414BDB669BB8A85A26D3FB7DFD6341B0804FADA49CB392CC358D018791

Function 0180D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2517746898.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be91e51e8307aff467976233bde1be65fff35c010e7a2a5adf26555c29e5dfd
Instruction ID: 4c09026a98df8a228fa6f2ee09c2dc6882680b0bf5177997b95f57bba99f10e8
Opcode Fuzzy Hash: 3be91e51e8307aff467976233bde1be65fff35c010e7a2a5adf26555c29e5dfd
Instruction Fuzzy Hash: 7F210371504308DFDB56DF94D9C0B16BBA1FB84318F20C66DE80D8B292C336D547CA62

Function 01850EC8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5ac978580248a724019cb960c27037f45ee6cd99b8ac39e3722db47e290d0e
Instruction ID: 85b182988eddd409fc6253d88daa0fa5eee3f8c74974ba19b35ba73366607ae7
Opcode Fuzzy Hash: 9f5ac978580248a724019cb960c27037f45ee6cd99b8ac39e3722db47e290d0e
Instruction Fuzzy Hash: CF215C70E04209DFE745EFB8C8446AEBBB2FF89304F1084A9D9149B394DB795A06CF51

Function 018517B8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d04a08e287bb0cb5debc0b9934191367b5c379edfbc8ae8721b3782e0c1c16
Instruction ID: 1f90473f83d0e5cff962e009c2b64c135e7db7fe4e099b2078c0cad86c3bd247
Opcode Fuzzy Hash: 53d04a08e287bb0cb5debc0b9934191367b5c379edfbc8ae8721b3782e0c1c16
Instruction Fuzzy Hash: 5521E370D1520A8FCB51DFA8D8486EEBFF0EF4A314F0451AAD805F7225E7309A85CBA1

Function 0185BB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b9d1dd004b46047b41d53a002f082f7f96535fc08f84e6afbdb73dac884e59
Instruction ID: adf6eea834fa12287610ba2ffc4e83f62106159de6a3461e31e5ec5f277883ff
Opcode Fuzzy Hash: d9b9d1dd004b46047b41d53a002f082f7f96535fc08f84e6afbdb73dac884e59
Instruction Fuzzy Hash: B4118C35700204CFD764DB6AD984E66B7E6FF98721B20806AE64ACF365CAB1ED01CB51

Function 01854850 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a4061042a8796a78e0c5111398648b06a264998b1b0dfebcf35f53c06e45a7
Instruction ID: c462f4311622364052074070915dcd5404a3cc0bea8610ffef49c9f32c8eaa1d
Opcode Fuzzy Hash: 54a4061042a8796a78e0c5111398648b06a264998b1b0dfebcf35f53c06e45a7
Instruction Fuzzy Hash: D001BC32B003044FDB28ABB9885866F7BEBEF883607154479DD05CB359FE74CA408B91

Function 0180D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2517746898.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180d000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 2272786be9fcfd23dbfd9aae7b2d9932c11689c82c1ebb81c81299b25eb74c51
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 3611BB75504284CFCB12CF94D9C4B15FFA1FB84314F28C6AAD8498B6A7C33AD44ACB62

Function 01854860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4df7ed4ae268d54b468810e2aea13592c4065b9f4711e7055cc7a7483c90b3
Instruction ID: 7f3589a2a7038233971ce88fbbe31c3ff9bd48aeb70d50e9f9ff693f25984b44
Opcode Fuzzy Hash: 6f4df7ed4ae268d54b468810e2aea13592c4065b9f4711e7055cc7a7483c90b3
Instruction Fuzzy Hash: 62014B32B003144BDB28AABE985866F7AEBAF887643144439DE05CB359FE71C9458B91

Function 0185BB37 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae78312c9f598279212ceb86844ca64b89dae7d368af75b730583fe6db2a82c
Instruction ID: d7ab2b23714b00659d97de16e712f7a11d3f6fff5a543b77342331e765dee5a8
Opcode Fuzzy Hash: 6ae78312c9f598279212ceb86844ca64b89dae7d368af75b730583fe6db2a82c
Instruction Fuzzy Hash: 03018B317002008FD764CB69C998B66B7E2EF98721F15806AD949CB729CAB0D901CB11

Function 0185A508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718901e2ecf26aac6016512d75283a96187cbcd3330c78a1bdfa3e1580559efa
Instruction ID: f4958b89f0801ee7c95af4f88ecd0f102f3e56a9ca4f82aa0fd787d8b8698413
Opcode Fuzzy Hash: 718901e2ecf26aac6016512d75283a96187cbcd3330c78a1bdfa3e1580559efa
Instruction Fuzzy Hash: 28014075A102099BDB54DFA9E855AAE7FB5EB88310B50452AFE15D3240DF308D10CBE1

Function 0185A4F9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694d9b7b25efbf133377bb380fcf522388d6111ed59c1e98d41a1fe453bda5dd
Instruction ID: cee0336997bb94838b83439235972c57479c1bc21d131901132c2e5f0f64d3ee
Opcode Fuzzy Hash: 694d9b7b25efbf133377bb380fcf522388d6111ed59c1e98d41a1fe453bda5dd
Instruction Fuzzy Hash: 81017171A0411A9FCF55DFA8D8949EEBFB5EF88310B40413AFD15D3240DB308A11CB91

Function 0185BEF8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683ff921d625d9583405102c24a422201b82e0183c47d4020d8a60018ced5df8
Instruction ID: 575779bd83c1693679cc50ee596ef5864fb9bf119666e98b88bd23d6569ded2a
Opcode Fuzzy Hash: 683ff921d625d9583405102c24a422201b82e0183c47d4020d8a60018ced5df8
Instruction Fuzzy Hash: 8EF0C8327083145BCB151A78A84A56D3F9AEBC9711B18402AFA06C7381DE35CD0697D4

Function 0185BD78 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0c3149a33680543e78213c28ef0c3e97fa5a76eda1cfb1e9f91c389919c4da
Instruction ID: 8b7c9f7e6692ddc748f7275a9faf16ff2d53922f4fe8493321819a1587f99801
Opcode Fuzzy Hash: ce0c3149a33680543e78213c28ef0c3e97fa5a76eda1cfb1e9f91c389919c4da
Instruction Fuzzy Hash: 0AF04F72A00108AFCB40EFA9D8449BFBFF9EF48210B404065F919D7211DA309D118BA1

Function 0185C1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14382227c3b308b4bc69efe9d3efcff2026aa66af741f4a90b5d615728f5f54d
Instruction ID: ece66bbbcd2eceb3a42ab3f720ead71d79fc80f41a1531790d91248414b7fc50
Opcode Fuzzy Hash: 14382227c3b308b4bc69efe9d3efcff2026aa66af741f4a90b5d615728f5f54d
Instruction Fuzzy Hash: 57F02032B006119BCB29566EE41096EBBAEDFC4330700007AE908DB350CF32CD028BA0

Function 0185B9EA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbc21f81069148ebe938b9d0568b8a88a030344d5608f2104f7fd10ef652dda
Instruction ID: bf459b0040f4afd55991cbd2adf4f3b7331eb0011e726888b1d2504c75229b39
Opcode Fuzzy Hash: cdbc21f81069148ebe938b9d0568b8a88a030344d5608f2104f7fd10ef652dda
Instruction Fuzzy Hash: 81F0B475E00208AFCF50DFA9D881ADEB7F6FF58250B04413AD909E3601D73496068BE2

Function 018546C9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7f415ae33b75b30f9299347ad6a13c12a767ba255efde15957548c3d7377cd
Instruction ID: 554f3301bc1b63aa9a1c82fe233ea48bbddb07b1f8cebfc6ab2358e05ca3379b
Opcode Fuzzy Hash: 4d7f415ae33b75b30f9299347ad6a13c12a767ba255efde15957548c3d7377cd
Instruction Fuzzy Hash: 02F0743111574A8FE7A26F24ECBC63A7FA1EF0B303B046C45E05AC6069DB714654CF21

Function 0185B9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a844f930aeae927519ca1ebfec8148f9ff536bac5c02fd0b4916b3adb8a85c6b
Instruction ID: 4428b984037cc99c40fce9bcb947ad0d5ec389af3969fa02e1507de506fa6781
Opcode Fuzzy Hash: a844f930aeae927519ca1ebfec8148f9ff536bac5c02fd0b4916b3adb8a85c6b
Instruction Fuzzy Hash: 62F08271E00208AF8B60DFA998409DFBBF6FB98290B00412AD909D3201E6709A158BE2

Function 018546D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347844a6b8c82f8566b688d878700381b202a364b8b66051fcebe98a3243e385
Instruction ID: a9f2473c8e130c63164d8c7f4e9ace487666205c844ed6e00c57fe336ea20e89
Opcode Fuzzy Hash: 347844a6b8c82f8566b688d878700381b202a364b8b66051fcebe98a3243e385
Instruction Fuzzy Hash: 64E0097506130ACFE7B22F64B9AC23A7BA5EB0B313B406D10B51EC10699F7246548F74

Function 01851877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182909b6def761177a5abbf613e66617c50a27f33d1c97bd0e97f6e6dc5cb108
Instruction ID: df65ae5f93d5e1359c590fe78e844929f445c86f2e7aff6fb244d23106d58774
Opcode Fuzzy Hash: 182909b6def761177a5abbf613e66617c50a27f33d1c97bd0e97f6e6dc5cb108
Instruction Fuzzy Hash: B8E09A319113A68EC7129FB498040EEBF70EE93310B5142A7D010AB190EB70595ACBA0

Function 01851888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7bab32ad80c2690ca34db6ba75db52600482004346fc707d5c9aca54183a4ea
Instruction ID: 01bee33d49dbe891f419d92e91c8902dac4829102c03bb42200e91b9da9e6017
Opcode Fuzzy Hash: c7bab32ad80c2690ca34db6ba75db52600482004346fc707d5c9aca54183a4ea
Instruction Fuzzy Hash: 46D05B31D2033A57CB10E7A5DC044DFFB38EED5321B514666D51437144FB706659C6E1

Function 01854831 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f6ff3b4d3d733461fd8142579e06d4f11fa64ed92ab0546e70b2ec221265db
Instruction ID: 13247cb7f56a9fe3c536a6b9c72b3d1e03889c797248ed8cc32e3095d2d0b426
Opcode Fuzzy Hash: 99f6ff3b4d3d733461fd8142579e06d4f11fa64ed92ab0546e70b2ec221265db
Instruction Fuzzy Hash: 97C04C7140A3D04FCF1BCB748426C577BF1AE0320472508DFC442CB196D9259505CB41

Non-executed Functions

Function 05FF51E8 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c145ab9f37377e934151d2ea0278543e18b4e901f4b07bab89a1daf4e0e875
Instruction ID: 15c858f2ad3b374f186f8e557b9dfc47939dc1121308174eb00bb98dd7abac30
Opcode Fuzzy Hash: 42c145ab9f37377e934151d2ea0278543e18b4e901f4b07bab89a1daf4e0e875
Instruction Fuzzy Hash: DD528C74E01229CFDB64DF65C884B9EBBB2BF89300F1085E9D509AB264DB359E81CF50

Function 05FF15F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b660ebff1cd87bfb55cb2447e7167127889999cd87b7a8f6aaefebe93243d6
Instruction ID: 69d99078e1d22866bbcf9906901d2da20feb55b7468f0b714230ac1a22cc4492
Opcode Fuzzy Hash: a1b660ebff1cd87bfb55cb2447e7167127889999cd87b7a8f6aaefebe93243d6
Instruction Fuzzy Hash: 0FC18074E01218CFDB54DFA9C994BADBBB2BF89300F1081A9D409AB365DB359E85CF50

Function 05FF3598 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe559cd8cf905a5b0dfbf3bde15f8fa4590f15c8629abbc9ef2148c6b3afae9
Instruction ID: 3f7783072f8d2f391030d9d2d7a80f4d680308106f90d9f3199c04a701bdd6d4
Opcode Fuzzy Hash: efe559cd8cf905a5b0dfbf3bde15f8fa4590f15c8629abbc9ef2148c6b3afae9
Instruction Fuzzy Hash: 45C18174E01218CFDB54DFA9C954BADBBB2BF89300F1080A9D409AB365DB399E85CF51

Function 05FF0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35b35b6c48fa7eb4d4d34ad96c5226eea846399e68769ac0188355146166d13
Instruction ID: 51cd2469182a99a57f38cab06ab7312d89e14fcc4a500449e43f698d7aca9b1c
Opcode Fuzzy Hash: b35b35b6c48fa7eb4d4d34ad96c5226eea846399e68769ac0188355146166d13
Instruction Fuzzy Hash: 6DC18174E01218CFDB54DFA9D994BADBBB2BF89300F1080A9D409AB365DB359E85CF50

Function 05FF2438 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1619160803e29e9bf0a253ff59d5a25c295b7a66b764991a11e7665a62441edc
Instruction ID: f7e0f834756fd3841c15bdd01fabe372b7110d1a75e265947a016c63c8626782
Opcode Fuzzy Hash: 1619160803e29e9bf0a253ff59d5a25c295b7a66b764991a11e7665a62441edc
Instruction Fuzzy Hash: 19C19074E01218CFDB54DFA9D994BADBBB2BF89300F1080A9D409AB365DB359E81CF50

Function 05FF46F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf533b486dfd6664fc4a087c0123956ace63ec421a19cda13f654f2c064fd31
Instruction ID: 65441a4202e336891109fa9e4ad74ac364704846abc6ae9322dc42dc2d966dd6
Opcode Fuzzy Hash: 5bf533b486dfd6664fc4a087c0123956ace63ec421a19cda13f654f2c064fd31
Instruction Fuzzy Hash: 93C19174E01218CFDB54DFA9C994BAEBBB2BF89300F1080A9D509AB365DB355E81CF50

Function 05FF11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76f14ccb5f120990e803ed609a2fd361b4d4c1c2186a3ea18e0590c519c20a0
Instruction ID: d925b34a7514d966453c02abd57047ec748c0037b823f8b28a900c9e97644232
Opcode Fuzzy Hash: a76f14ccb5f120990e803ed609a2fd361b4d4c1c2186a3ea18e0590c519c20a0
Instruction Fuzzy Hash: A4C18174E00218CFDB54DFA9C994BADBBB2BF89300F1081A9D409AB365DB359E85CF51

Function 05FF3140 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26e1924c416f96e4e38804cf08d43b8896f618c70fb2d52c039d3f80911e7a2
Instruction ID: 6912a156473288fdbd5fdac5c7889ef540ba2cac0b9f33cc703badb05a9a6370
Opcode Fuzzy Hash: d26e1924c416f96e4e38804cf08d43b8896f618c70fb2d52c039d3f80911e7a2
Instruction Fuzzy Hash: 1BC18074E01218CFDB54DFA9C994BADBBB2BF89300F1080A9D409AB365DB359E85CF50

Function 05FF0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79a19b6c1d0f7e1c7e50418d120ea9ec15d71bb0911d4ef386cea8bf529ff5f
Instruction ID: 91168bdef1d97ada50c03ce8afbb5132554309213acc46abdc50b719815813a5
Opcode Fuzzy Hash: c79a19b6c1d0f7e1c7e50418d120ea9ec15d71bb0911d4ef386cea8bf529ff5f
Instruction Fuzzy Hash: D5C19174E01218CFDB54DFA9C954BADBBB2BF89300F1081A9D409AB365DB356E85CF50

Function 05FF42A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747994a32f482688d0995249efa239cd0c4022278a5d0f9d27d14738e8e3938d
Instruction ID: b5de6d9f7fd4f6f440decab9367dc60d58452c12742e7f8cdf712124135edd42
Opcode Fuzzy Hash: 747994a32f482688d0995249efa239cd0c4022278a5d0f9d27d14738e8e3938d
Instruction Fuzzy Hash: ADC18174E00218CFDB54DFA9C954BADBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 05FF0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b295a7d874bf9e033bd1f3aa09e873c1141b06a583d9296153443c17016de0
Instruction ID: 27e6d08bdd7918455a15fb27ec0dc6f9c0a379da8560f2058da4511e54589df4
Opcode Fuzzy Hash: 30b295a7d874bf9e033bd1f3aa09e873c1141b06a583d9296153443c17016de0
Instruction Fuzzy Hash: E2C19074E00218CFDB54DFA9C994BADBBB2BF89300F1081A9D409AB365DB349E85CF50

Function 05FF2CE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6cf21709ef811b1930691a86024afb9d43d41fedbbcb8a9453af9825280d60
Instruction ID: 9c337456f190a050debff6d7df9e1e2232c5fe4593f3975451283ddc6d63c843
Opcode Fuzzy Hash: 6b6cf21709ef811b1930691a86024afb9d43d41fedbbcb8a9453af9825280d60
Instruction Fuzzy Hash: 6EC18074E01218CFDB54DFA9C994BADBBB2BF89300F1080A9D409AB365DB359E85CF51

Function 05FF1EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4b917ecc3bf1e594c663b5d6224267571e2336e7f050e52083aa10905d9248
Instruction ID: d131c19c3a7da69eb67266b7a1e0682129552ff010f3eace079969c27ec2c12c
Opcode Fuzzy Hash: cc4b917ecc3bf1e594c663b5d6224267571e2336e7f050e52083aa10905d9248
Instruction Fuzzy Hash: 7DC18074E00218CFDB54DFA9D994BADBBB2BF89300F1080A9D409AB365DB356E85CF51

Function 05FF3E48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b35d334ea4e6d51b57e9b9de7c2c9e205eba157908c0fd75d3e040da8d8d68
Instruction ID: de3c7b3a1ffaf54361325ceeea6bf6ead7aaac9a8858311194625474d2c414fb
Opcode Fuzzy Hash: 46b35d334ea4e6d51b57e9b9de7c2c9e205eba157908c0fd75d3e040da8d8d68
Instruction Fuzzy Hash: 31C19074E01218CFDB54DFA9D994BADBBB2BF89300F1080A9D409AB365DB359E85CF50

Function 05FF39F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243f34e100c3abbfda1ae3bf20a748d1925cfde31110b3a57c492a88e4926db4
Instruction ID: 1eae38d60f259c7db1d137b8112d7340bd71e95a0051137c1220db3bc521add1
Opcode Fuzzy Hash: 243f34e100c3abbfda1ae3bf20a748d1925cfde31110b3a57c492a88e4926db4
Instruction Fuzzy Hash: 1BC18074E01218CFDB54DFA9C954BADBBB2BF89300F2080A9D409AB365DB359E85CF51

Function 05FF08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0008020e41ef72ce6587b387a0e313b706a651ac1a0fdc6c1955fc85e095cd
Instruction ID: 148c90ab08138cb9adf7309468084e888704e24c3e8bea31f220111b9abaf8db
Opcode Fuzzy Hash: 3a0008020e41ef72ce6587b387a0e313b706a651ac1a0fdc6c1955fc85e095cd
Instruction Fuzzy Hash: 72C19174E01218CFDB54DFA9C954BADBBB2BF89300F1080A9D809AB355DB355E85CF51

Function 05FF2890 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e03b8ddb82e0d664b9b16a05482f0a10c86d19f8d41d74097f5293691b1ae4
Instruction ID: b434e77783c26572f5e995f6af1334c8f95527a9d3fd2ad8a60fefb68c9782c3
Opcode Fuzzy Hash: 87e03b8ddb82e0d664b9b16a05482f0a10c86d19f8d41d74097f5293691b1ae4
Instruction Fuzzy Hash: AAC18074E01218CFDB54DFA9C994BADBBB2AF89300F1080A9D409AB365DB355E85CF51

Function 05FF4B50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac44f290f04f7aa947926f27210920ca1fb94f1f2322a2efb445fefbe579056
Instruction ID: bd02c7b3e312a9fbc312d8aac179f8a3eea8a8a709a9c7f2fcc0396eee5968cb
Opcode Fuzzy Hash: eac44f290f04f7aa947926f27210920ca1fb94f1f2322a2efb445fefbe579056
Instruction Fuzzy Hash: AEC18174E01218CFDB54DFA9C994BADBBB2BF89300F1080A9D409AB365DB359E85CF51

Function 05FF1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace96521d8bce6bc6b49ab0dd1c60a5c1bb22ef11cceae6aa0fefcc2bd608748
Instruction ID: 43973e5d4775da16b4023352dcc63ca92e9548982bf3a9d6a77a86198d4a9b0b
Opcode Fuzzy Hash: ace96521d8bce6bc6b49ab0dd1c60a5c1bb22ef11cceae6aa0fefcc2bd608748
Instruction Fuzzy Hash: 3DC17174E01218CFDB54DFA9C954BADBBB2BF89300F1080A9D409AB365DB356E85CF51

Function 05A28588 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f44ed6522f6d977d6e52921c8b19b174626ce55d9bc13a5ea339f1d051afa4b
Instruction ID: e614dc3ddccc9d9f14e715fe9222835713d5bc13c8393fbccea66bb0bce12612
Opcode Fuzzy Hash: 4f44ed6522f6d977d6e52921c8b19b174626ce55d9bc13a5ea339f1d051afa4b
Instruction Fuzzy Hash: F1C18074E00218CFDB54DFA9C955BADBBB2BF89300F2080A9D409AB355DB399E85CF51

Function 05A24DD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2371018263af4ac353fac2e25a56cbbcca15c651590b18bc2e1fb877257dcd
Instruction ID: 34bb40d6b1dcb45c77cd232f5896fff452cf384f70f1213727ed5b9bf4c3a4f1
Opcode Fuzzy Hash: 9d2371018263af4ac353fac2e25a56cbbcca15c651590b18bc2e1fb877257dcd
Instruction Fuzzy Hash: C7C18074E00218CFDB14DFA9C955BADBBB2BF89300F2080A9D809AB355DB359E85CF51

Function 05A24520 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8df4e09e6bff5f0308f958b07dbc89b67b3dc5e1daafd57dbfeb8e6239f95e
Instruction ID: e2d750b0a27e817d01a95560cccab8a1e23c5d9b09510bdaff9df4f071f700d4
Opcode Fuzzy Hash: cd8df4e09e6bff5f0308f958b07dbc89b67b3dc5e1daafd57dbfeb8e6239f95e
Instruction Fuzzy Hash: 11C18F74E00218CFDB14DFA9C955BADBBB2BF89300F2080A9D809AB355DB359E85CF51

Function 05A28130 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e519e572a94173a8ac2efa71ffc183f8adbb8b7be8b574afacd65d2b3244507
Instruction ID: 3c10350bcfbc7a0a6efdf5919ea4631a35834fb4510ba100645fd3f2cf72f9fe
Opcode Fuzzy Hash: 0e519e572a94173a8ac2efa71ffc183f8adbb8b7be8b574afacd65d2b3244507
Instruction Fuzzy Hash: FDC18174E00218CFDB54DFA9C955BADBBB2BF89300F1080A9D409AB355DB35AE85CF51

Function 05A24978 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da39816961b15dcd06f757c26547f3b9c4611ef755d4541ec687ccf202ee30b
Instruction ID: 9dbe0336e95a4c8340ec427242c5a560880321ab881d5c38d1e8ddf2b6d3d8a6
Opcode Fuzzy Hash: 1da39816961b15dcd06f757c26547f3b9c4611ef755d4541ec687ccf202ee30b
Instruction Fuzzy Hash: A1C19174E00218CFDB14DFA9D954BADBBB2BF89300F1080A9D809AB355DB359E85CF51

Function 05A2F8B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaceff62cdda071fa7b3690a6b8d13617b56efd11cc2a92b0b861cbd7076d8dd
Instruction ID: 7e6977d0aa144747546deae1e572a87181eda0bbc884e6d6019e0f32ea788c63
Opcode Fuzzy Hash: eaceff62cdda071fa7b3690a6b8d13617b56efd11cc2a92b0b861cbd7076d8dd
Instruction Fuzzy Hash: 8BC19174E01218CFDB14DFA9C955BADBBB2BF89300F2080A9D809AB355DB359E85CF50

Function 05A27880 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46bb773d1186c28e1be57833147fa0f872769804926a7c77345f0eb8fde48bde
Instruction ID: 2e73b909aa9750129d2fe7f17d56e30cc4a0cd033c7cdfd5d8982cf3e59ff8a9
Opcode Fuzzy Hash: 46bb773d1186c28e1be57833147fa0f872769804926a7c77345f0eb8fde48bde
Instruction Fuzzy Hash: 52C18F74E01218CFDB54DFA9C955BADBBB2FB89300F2080A9D409AB355DB356E85CF50

Function 05A27CD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19be9b7ae5a724ad31c65daae96db2ab731d249d5052a90cc8ac489ed98ef204
Instruction ID: f3fd83583328e1aea0407c621c3637346d63feabf290e2ce7d793e6961d6159a
Opcode Fuzzy Hash: 19be9b7ae5a724ad31c65daae96db2ab731d249d5052a90cc8ac489ed98ef204
Instruction Fuzzy Hash: B0C19074E04218CFDB14DFA9C995BADBBB2FB89300F1080A9D809AB355DB346E85CF51

Function 05A27428 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f265468799264fd1fa36372a4b9be0b984a2e8bf9b560962df430e391cb9ad
Instruction ID: e4301da79a4c8ee27add10355cc184af386ba2b544ebcf1acd3ef4c09573c0d1
Opcode Fuzzy Hash: 81f265468799264fd1fa36372a4b9be0b984a2e8bf9b560962df430e391cb9ad
Instruction Fuzzy Hash: 9BC18074E00228CFDB54DFA9C955BADBBB2EB89300F1080A9D409AB355DB346E85CF51

Function 05A2F458 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199569db8394557c2359883cc16f6cd29b2e0a09561593130fd767fcca4f2513
Instruction ID: 585bbf9474620cf6a8652f32b4ae45e1a9b5d72432fc6d8bac43ad0b0e3520d4
Opcode Fuzzy Hash: 199569db8394557c2359883cc16f6cd29b2e0a09561593130fd767fcca4f2513
Instruction Fuzzy Hash: A8C19174E00218CFDB54DFA9C995BADBBB2BF89300F1080A9D809AB355DB349E85CF50

Function 05A2EBA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002af49256dd33ae8047ad6d0a45446dfc0304fb86c469b1d282ee17046812a2
Instruction ID: 80394af8dc6253dacdcb1e134168c8c0ea4fa76fa3312c6e13a5b9cd0231a1d2
Opcode Fuzzy Hash: 002af49256dd33ae8047ad6d0a45446dfc0304fb86c469b1d282ee17046812a2
Instruction Fuzzy Hash: B3C19074E00228CFDB54DFA9C955BADBBB2BF89300F1080A9D809AB355DB349E81CF51

Function 05A26FD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3440ea35731a6c5de235b0705dbdc53b36b97135be2da8609aa39837c48ff78
Instruction ID: 253b60fb51097462839374e156744276ea6c545f977f3c744ee5b5e987dfed96
Opcode Fuzzy Hash: c3440ea35731a6c5de235b0705dbdc53b36b97135be2da8609aa39837c48ff78
Instruction Fuzzy Hash: 91C19074E00218CFDB14DFA9C955BADBBB2FB89300F1080A9D809AB355DB349E85CF51

Function 05A2E750 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257a25e96fa8b3452436fd44d4845d761c9ea79c92b3fae003a567fdaa410642
Instruction ID: 7ec242b3fc859aa58baa3e8095dbe7aa30071af47e299116a9721418ad8c867c
Opcode Fuzzy Hash: 257a25e96fa8b3452436fd44d4845d761c9ea79c92b3fae003a567fdaa410642
Instruction Fuzzy Hash: AFC19074E01218CFDB54DFA9C995BADBBB2BF89300F1080A9D409AB355DB359E85CF50

Function 05A25680 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7e72e8f84a2a4975f58166f385686d773de76da8bfb5951db3d9c946a7d1c1
Instruction ID: 8f9466846bd5c5ef04416da3f03cf065fe7667d13cbf0146468da6c754f27a7b
Opcode Fuzzy Hash: 3f7e72e8f84a2a4975f58166f385686d773de76da8bfb5951db3d9c946a7d1c1
Instruction Fuzzy Hash: B7C19174E00218CFDB14DFA9D995BADBBB2BF89300F1080A9D809AB354DB349E85CF50

Function 05A2E2F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c09f23e2f2570ec9c3dddbe9937a032ecec1c8080f1e8921857692bb668249
Instruction ID: e169151c61370ddf6774b471d1808da6eb9b34586c51bc20aa282dd6a45cc53f
Opcode Fuzzy Hash: 93c09f23e2f2570ec9c3dddbe9937a032ecec1c8080f1e8921857692bb668249
Instruction Fuzzy Hash: 71C18174E00218CFDB54DFA9C955BADBBB2BF89300F1080A9D809AB355DB359E85CF51

Function 05A25228 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2520827063.0000000005A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5a20000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 459804b0e5b09e29a8bac5fc4247b5285aa2b6e6a71c1e3af503a7e429fa6d98
Instruction ID: b1255ea987cb55c91221bbab840da0eeee16132153ad0a510b7e4e4d85fcd017
Opcode Fuzzy Hash: 459804b0e5b09e29a8bac5fc4247b5285aa2b6e6a71c1e3af503a7e429fa6d98
Instruction Fuzzy Hash: 04C19074E00218CFDB14DFA9C954BADBBB2BF89300F1090A9D809AB355DB359E85CF50

Function 05FF869F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c261b7f9da64bc31dd6cf2079f436e9f6cf5c694c9fb84a3ef5b40103187e67
Instruction ID: e95d596b47e402e4b6ad37ee02156403ca3284e8b233acb40c350008eb2c6be9
Opcode Fuzzy Hash: 5c261b7f9da64bc31dd6cf2079f436e9f6cf5c694c9fb84a3ef5b40103187e67
Instruction Fuzzy Hash: 791100719512088FCB61AF60E81C3BE7FB0EB0A302F1069A9E409A3595C7388A44CF60

Function 05FF8728 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2521203119.0000000005FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5ff0000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e363dbc3a1c14646f194b963dcc6829b4455c0a0f649d7bf4f678f0872cc5
Instruction ID: 60f82c5a731a833d64f844f8791e39e3f863c51cafbe40448a017ad790f7144e
Opcode Fuzzy Hash: 5e1e363dbc3a1c14646f194b963dcc6829b4455c0a0f649d7bf4f678f0872cc5
Instruction Fuzzy Hash: 6C018171D11208DFDB55AFA0E45C3BE7BB0EB0A313F106859940AA3194DB344A44CF50

Function 01851A40 Relevance: 5.1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

Xq, xrefs: 01851AB0
Xq, xrefs: 01851B7C
Xq, xrefs: 01851B2F
Xq, xrefs: 01851A76

Memory Dump Source

Source File: 00000004.00000002.2518102897.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1850000_PDF6UU0CVUO2W-YGVUIO.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: a5a160f6240719f257ba65c5fc02ce6c2ca14ae8c95b073e3efab837ef5d6884
Instruction ID: f4b7072001072fe3811afbf7dd7e0dd792725c5fc3d0044fa8b307372695ba25
Opcode Fuzzy Hash: a5a160f6240719f257ba65c5fc02ce6c2ca14ae8c95b073e3efab837ef5d6884
Instruction Fuzzy Hash: 93315670D003198FEFB69B6984593AEB7F6EB84310F1440A58949E7251EF708B85CB93

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to lowest risk score due to lack of data" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PDF6UU0CVUO2W-YGVUIO.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PDF6UU0CVUO2W-YGVUIO.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
PDF6UU0CVUO2W-YGVUIO.scr.exe

Function 0186B3C1 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Function 018644F0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0186590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 0591D509 Relevance: 1.6, APIs: 1, Instructions: 77
COMMON

Function 0591D410 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Function 0591C04C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Function 0186B3B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0186D9C1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 05A20AB8 Relevance: 3.5, APIs: 2, Instructions: 529
libraryCOMMON

Function 018527B9 Relevance: 3.1, Strings: 2, Instructions: 594
COMMON

Function 01852DD1 Relevance: 2.8, Strings: 2, Instructions: 267
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre