Edit tour

Windows Analysis Report
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Overview

General Information

Sample name:	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Analysis ID:	1592411
MD5:	a81a0f916354b1ee0232c5eae992c365
SHA1:	36199281d68f7e2f663e76756d6a5f4561cdf236
SHA256:	3cfe012c870ebeb15a1288b7cdb3b50016e2329c7fbd63ef18f189727269d49c
Tags:	exeuser-threatcat_ch
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe" MD5: A81A0F916354B1EE0232C5EAE992C365)

MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe (PID: 7556 cmdline: "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe" MD5: A81A0F916354B1EE0232C5EAE992C365)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "hubservices@navecepa.com", "Password": "yiwLgN*rC4", "Server": "smtp.navecepa.com", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf061:$a1: get_encryptedPassword 0xf389:$a2: get_encryptedUsername 0xedea:$a3: get_timePasswordChanged 0xef0b:$a4: get_passwordField 0xf077:$a5: set_encryptedPassword 0x109dc:$a7: get_logins 0x1068d:$a8: GetOutlookPasswords 0x1047f:$a9: StartKeylogger 0x1092c:$a10: KeyLoggerEventArgs 0x104dc:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x266c1:$a1: get_encryptedPassword 0x3d4f1:$a1: get_encryptedPassword 0x54111:$a1: get_encryptedPassword 0x269e9:$a2: get_encryptedUsername 0x3d819:$a2: get_encryptedUsername 0x54439:$a2: get_encryptedUsername 0x2644a:$a3: get_timePasswordChanged 0x3d27a:$a3: get_timePasswordChanged 0x53e9a:$a3: get_timePasswordChanged 0x2656b:$a4: get_passwordField 0x3d39b:$a4: get_passwordField 0x53fbb:$a4: get_passwordField 0x266d7:$a5: set_encryptedPassword 0x3d507:$a5: set_encryptedPassword 0x54127:$a5: set_encryptedPassword 0x2803c:$a7: get_logins 0x3ee6c:$a7: get_logins 0x55a8c:$a7: get_logins 0x27ced:$a8: GetOutlookPasswords 0x3eb1d:$a8: GetOutlookPasswords 0x5573d:$a8: GetOutlookPasswords
00000001.00000002.2925288790.00000000032F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1581a:$a1: get_encryptedPassword 0x15b33:$a2: get_encryptedUsername 0x155b7:$a3: get_timePasswordChanged 0x156d8:$a4: get_passwordField 0x15830:$a5: set_encryptedPassword 0x1713c:$a7: get_logins 0x16ded:$a8: GetOutlookPasswords 0x16bdf:$a9: StartKeylogger 0x1708c:$a10: KeyLoggerEventArgs 0x16c3c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x397a0:$a1: get_encryptedPassword 0x39ab9:$a2: get_encryptedUsername 0x3953d:$a3: get_timePasswordChanged 0x3965e:$a4: get_passwordField 0x397b6:$a5: set_encryptedPassword 0x3b0c2:$a7: get_logins 0x3ad73:$a8: GetOutlookPasswords 0x3ab65:$a9: StartKeylogger 0x3b012:$a10: KeyLoggerEventArgs 0x3abc2:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd461:$a1: get_encryptedPassword 0xd789:$a2: get_encryptedUsername 0xd1ea:$a3: get_timePasswordChanged 0xd30b:$a4: get_passwordField 0xd477:$a5: set_encryptedPassword 0xeddc:$a7: get_logins 0xea8d:$a8: GetOutlookPasswords 0xe87f:$a9: StartKeylogger 0xed2c:$a10: KeyLoggerEventArgs 0xe8dc:$a11: KeyLoggerEventArgsEventHandler
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x124b3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x119b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x11cbf:$a4: \Orbitum\User Data\Default\Login Data 0x12ab7:$a5: \Kometa\User Data\Default\Login Data
1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf261:$a1: get_encryptedPassword 0xf589:$a2: get_encryptedUsername 0xefea:$a3: get_timePasswordChanged 0xf10b:$a4: get_passwordField 0xf277:$a5: set_encryptedPassword 0x10bdc:$a7: get_logins 0x1088d:$a8: GetOutlookPasswords 0x1067f:$a9: StartKeylogger 0x10b2c:$a10: KeyLoggerEventArgs 0x106dc:$a11: KeyLoggerEventArgsEventHandler
1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x142b3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x137b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x13abf:$a4: \Orbitum\User Data\Default\Login Data 0x148b7:$a5: \Kometa\User Data\Default\Login Data
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd461:$a1: get_encryptedPassword 0xd789:$a2: get_encryptedUsername 0xd1ea:$a3: get_timePasswordChanged 0xd30b:$a4: get_passwordField 0xd477:$a5: set_encryptedPassword 0xeddc:$a7: get_logins 0xea8d:$a8: GetOutlookPasswords 0xe87f:$a9: StartKeylogger 0xed2c:$a10: KeyLoggerEventArgs 0xe8dc:$a11: KeyLoggerEventArgsEventHandler
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x124b3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x119b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x11cbf:$a4: \Orbitum\User Data\Default\Login Data 0x12ab7:$a5: \Kometa\User Data\Default\Login Data
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf261:$a1: get_encryptedPassword 0x25e81:$a1: get_encryptedPassword 0xf589:$a2: get_encryptedUsername 0x261a9:$a2: get_encryptedUsername 0xefea:$a3: get_timePasswordChanged 0x25c0a:$a3: get_timePasswordChanged 0xf10b:$a4: get_passwordField 0x25d2b:$a4: get_passwordField 0xf277:$a5: set_encryptedPassword 0x25e97:$a5: set_encryptedPassword 0x10bdc:$a7: get_logins 0x277fc:$a7: get_logins 0x1088d:$a8: GetOutlookPasswords 0x274ad:$a8: GetOutlookPasswords 0x1067f:$a9: StartKeylogger 0x2729f:$a9: StartKeylogger 0x10b2c:$a10: KeyLoggerEventArgs 0x2774c:$a10: KeyLoggerEventArgs 0x106dc:$a11: KeyLoggerEventArgsEventHandler 0x272fc:$a11: KeyLoggerEventArgsEventHandler
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x142b3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2aed3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x137b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a3d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x13abf:$a4: \Orbitum\User Data\Default\Login Data 0x2a6df:$a4: \Orbitum\User Data\Default\Login Data 0x148b7:$a5: \Kometa\User Data\Default\Login Data 0x2b4d7:$a5: \Kometa\User Data\Default\Login Data
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf261:$a1: get_encryptedPassword 0x26091:$a1: get_encryptedPassword 0x3ccb1:$a1: get_encryptedPassword 0xf589:$a2: get_encryptedUsername 0x263b9:$a2: get_encryptedUsername 0x3cfd9:$a2: get_encryptedUsername 0xefea:$a3: get_timePasswordChanged 0x25e1a:$a3: get_timePasswordChanged 0x3ca3a:$a3: get_timePasswordChanged 0xf10b:$a4: get_passwordField 0x25f3b:$a4: get_passwordField 0x3cb5b:$a4: get_passwordField 0xf277:$a5: set_encryptedPassword 0x260a7:$a5: set_encryptedPassword 0x3ccc7:$a5: set_encryptedPassword 0x10bdc:$a7: get_logins 0x27a0c:$a7: get_logins 0x3e62c:$a7: get_logins 0x1088d:$a8: GetOutlookPasswords 0x276bd:$a8: GetOutlookPasswords 0x3e2dd:$a8: GetOutlookPasswords
0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x142b3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2b0e3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41d03:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x137b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a5e1:$a3: \Google\Chrome\User Data\Default\Login Data 0x41201:$a3: \Google\Chrome\User Data\Default\Login Data 0x13abf:$a4: \Orbitum\User Data\Default\Login Data 0x2a8ef:$a4: \Orbitum\User Data\Default\Login Data 0x4150f:$a4: \Orbitum\User Data\Default\Login Data 0x148b7:$a5: \Kometa\User Data\Default\Login Data 0x2b6e7:$a5: \Kometa\User Data\Default\Login Data 0x42307:$a5: \Kometa\User Data\Default\Login Data
Click to see the 20 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T05:22:01.198627+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Avira: detected

Found malware configuration

Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "hubservices@navecepa.com", "Password": "yiwLgN*rC4", "Server": "smtp.navecepa.com", "Port": 587}

Multi AV Scanner detection for submitted file

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Virustotal: Detection: 48%			Perma Link
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Stubs Fully\Public\Public Runpe\PR\PR\obj\Debug\Poses.pdb source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688730717.0000000003051000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1689915581.0000000005640000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 01468922h	1_2_01468508
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 014681F9h	1_2_01467F48
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 01468922h	1_2_014684F8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 01468922h	1_2_0146884F
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 0146FAF8h	1_2_0146F7F8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D43861h	1_2_05D435B8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D46768h	1_2_05D464C0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4E798h	1_2_05D4E4F0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4DA90h	1_2_05D4D7E8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D44A55h	1_2_05D44718
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4F8F8h	1_2_05D4F650
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D47470h	1_2_05D471C8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4F4A0h	1_2_05D4F1F8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D43409h	1_2_05D43160
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4E340h	1_2_05D4E098
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D46310h	1_2_05D46068
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4D638h	1_2_05D4D390
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D44569h	1_2_05D442C0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4D1E0h	1_2_05D4CDC0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4F048h	1_2_05D4EDA0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D47018h	1_2_05D46D70
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4DEE8h	1_2_05D4DC40
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D45EB8h	1_2_05D45C10
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D45EB8h	1_2_05D45E55
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D44111h	1_2_05D43E68
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4EBF0h	1_2_05D4E948
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D46BC0h	1_2_05D46918
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D4FD50h	1_2_05D4FAA8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 4x nop then jmp 05D43CB9h	1_2_05D43A10

Source: global traffic

TCP traffic: 192.168.2.4:56925 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000326B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000326B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 0_2_01477AE8	0_2_01477AE8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 0_2_01477AD8	0_2_01477AD8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146AC08	1_2_0146AC08
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146F128	1_2_0146F128
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_014619B8	1_2_014619B8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_01467F48	1_2_01467F48
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146E770	1_2_0146E770
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146E780	1_2_0146E780
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146ABF8	1_2_0146ABF8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_01462DD1	1_2_01462DD1
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146EF08	1_2_0146EF08
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146F7F8	1_2_0146F7F8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_0146F6FE	1_2_0146F6FE
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_01467F37	1_2_01467F37
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D47620	1_2_05D47620
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4A8A0	1_2_05D4A8A0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D49B40	1_2_05D49B40
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D435B8	1_2_05D435B8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D435A7	1_2_05D435A7
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D464C0	1_2_05D464C0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E4F0	1_2_05D4E4F0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E4E1	1_2_05D4E4E1
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D464B0	1_2_05D464B0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4D7D8	1_2_05D4D7D8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4D7E8	1_2_05D4D7E8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D44718	1_2_05D44718
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D44708	1_2_05D44708
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4F650	1_2_05D4F650
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4F641	1_2_05D4F641
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D471C8	1_2_05D471C8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4F1F8	1_2_05D4F1F8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4F1E9	1_2_05D4F1E9
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D471B8	1_2_05D471B8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43150	1_2_05D43150
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43160	1_2_05D43160
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E098	1_2_05D4E098
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E088	1_2_05D4E088
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46059	1_2_05D46059
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D40040	1_2_05D40040
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46068	1_2_05D46068
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D40006	1_2_05D40006
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4D390	1_2_05D4D390
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4D380	1_2_05D4D380
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D442C0	1_2_05D442C0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D442AF	1_2_05D442AF
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4CDC0	1_2_05D4CDC0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4ED90	1_2_05D4ED90
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4EDA0	1_2_05D4EDA0
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46D70	1_2_05D46D70
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D44D78	1_2_05D44D78
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46D60	1_2_05D46D60
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D44D68	1_2_05D44D68
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4DC40	1_2_05D4DC40
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D44C6A	1_2_05D44C6A
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D45C10	1_2_05D45C10
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D45C00	1_2_05D45C00
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4DC30	1_2_05D4DC30
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43E58	1_2_05D43E58
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43E68	1_2_05D43E68
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E948	1_2_05D4E948
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46918	1_2_05D46918
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D46908	1_2_05D46908
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4E938	1_2_05D4E938
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4FA98	1_2_05D4FA98
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D4FAA8	1_2_05D4FAA8
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43A10	1_2_05D43A10
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Code function: 1_2_05D43A00	1_2_05D43A00

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688430987.0000000002E90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAntiBossing.dll8 vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688730717.0000000003051000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1689915581.000000000564C000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688730717.0000000003081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePoses.dll, vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688730717.0000000003081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1687481772.0000000001359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametenE6 vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000000.1684495705.0000000000D2A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametenEleven.exe4 vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1687481772.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923791566.0000000000FC7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Binary or memory string: OriginalFilenametenEleven.exe4 vs MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Mutant created: NULL

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000032BF000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000032AF000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000032CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Virustotal: Detection: 48%
Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process created: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process created: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: 0x95727CE5 [Mon Jun 14 18:31:01 2049 UTC]

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Static PE information: section name: .text entropy: 7.790287157093613

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	File created: \mv. asl rose - vessel's desc.pdf.scr.exe
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	File created: \mv. asl rose - vessel's desc.pdf.scr.exe			Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 5050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 1460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe TID: 7544

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2924455964.00000000014A6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllecture=MSIL"/>

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Code function: 1_2_0146F128 LdrInitializeThunk,LdrInitializeThunk,

1_2_0146F128

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Memory written: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Process created: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe "C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2925288790.00000000032F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.4172290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.415b460.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe PID: 7556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	49%	Virustotal		Browse
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	34%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	100%	Avira	HEUR/AGEN.1308776
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://reallyfreegeoip.orgd	0%	Avira URL Cloud	safe
http://checkip.dyndns.orgd	0%	Avira URL Cloud	safe
http://checkip.dyndns.comd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.48.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.orgd	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000326B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.189d	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000326B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2925288790.000000000324F000.00000004.00000800.00020000.00000000.sdmp, MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe, 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.48.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592411
Start date and time:	2025-01-16 05:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 52.165.164.15, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	ydJaT4b5N8.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/vq3j/
	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
193.122.130.0	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	h8izmpp1ZM.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	x8M2g1Xxhz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	MV Nicos Tomasos Vessel Parts.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	NEWORDER.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
reallyfreegeoip.org	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	NEWORDER.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://guf1.xemirax.ru/6XAVE/#S#ZWRtb25kLmxlZUBpbm5vY2FwLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://yt1s.com/en115	Get hash	malicious	Unknown	Browse	104.21.11.245
	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	Pedang @ P#U00ecsau.exe	Get hash	malicious	Brontok	Browse	104.21.48.1
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://yogalisbon.gitcz.pw/sign-in	Get hash	malicious	Unknown	Browse	104.21.112.1
	http://com-evaluate-fanpage30127.pages.dev/help/contact/671203900952887	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
ORACLE-BMC-31898US	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	MV Nicos Tomasos Vessel Parts.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Execute.ps1	Get hash	malicious	Metasploit	Browse	158.101.196.44
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	NEWORDER.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1

Process:	C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.356231720746034
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCq1KDLI4M6:ML9E4KlKDE4KhKiKhIE4Kx1qE4j
MD5:	96CC94FC13A30D01C0D672AE291242F6
SHA1:	96A1D1362646EB1904805C8D008A1C23B6818CD6
SHA-256:	87AC5F82270362FA03819438BBF1AF7BFE89F3B2116BD08BCCA4836DB38CDDE7
SHA-512:	D70D9B54A67AAD21444B6BDE3FA72AED2BEA5AE851646D1145D6280C0A72C3C0CB643E1930BAE23795A842C7F6B37C3D33104372CF8221B898890710126BC957
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.775341999193462
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
File size:	235'520 bytes
MD5:	a81a0f916354b1ee0232c5eae992c365
SHA1:	36199281d68f7e2f663e76756d6a5f4561cdf236
SHA256:	3cfe012c870ebeb15a1288b7cdb3b50016e2329c7fbd63ef18f189727269d49c
SHA512:	b10f7f9bee31068396d1583b2ee230bb787ad4842eb27f7618a145badf9825aedf4c4f94ba27d6fa1755c06e0a432b133413d90f3d827dd3fe0dfb35cd1b2089
SSDEEP:	3072:B8C9NzwHKpHbwVAeu0Y8GC1UyAd9g8QwOGYpKDBvO6AR+xx7CG9Uv3tSsPT:1NhpHYAbm1Uld9grwpBvO66cZEdn
TLSH:	DF3418D482FC8D0AD96788B479BAA3F711B8788D1735E423230386B50D9176867BCF5B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|r...............0..h..........~.... ........@.. ....................................@................................

File Icon


Icon Hash:	2e272325acd37560

Static PE Info

General

Entrypoint:	0x43867e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x95727CE5 [Mon Jun 14 18:31:01 2049 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38630	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x2bc0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x36684	0x36800	8923e8cb3a8ee727b043c840a2acf707	False	0.7070222907110092	data	7.790287157093613	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3a000	0x2bc0	0x2c00	75aea0495ac80e5dd3730772defbfb97	False	0.9067826704545454	data	7.623650691699043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0xc	0x200	ccd6070a380d8d5eb329b2851ccebc95	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3a130	0x2574	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9800792657488527
RT_GROUP_ICON	0x3c6a4	0x14	data	0.9
RT_VERSION	0x3c6b8	0x31c	data	0.4258793969849246
RT_MANIFEST	0x3c9d4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T05:22:01.198627+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 05:22:00.593323946 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:22:00.599281073 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:22:00.599380016 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:22:00.599602938 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:22:00.605365038 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:22:01.053620100 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:22:01.057292938 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:22:01.062232971 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:22:01.156481981 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:22:01.165532112 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.165589094 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.165824890 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.175362110 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.175401926 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.198626995 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:22:01.636190891 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.636281967 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.642519951 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.642532110 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.642862082 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.682853937 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.692341089 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.735347033 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.801872969 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.801919937 CET	443	49731	104.21.48.1	192.168.2.4
Jan 16, 2025 05:22:01.801975012 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:01.814264059 CET	49731	443	192.168.2.4	104.21.48.1
Jan 16, 2025 05:22:33.800167084 CET	56925	53	192.168.2.4	162.159.36.2
Jan 16, 2025 05:22:33.805073023 CET	53	56925	162.159.36.2	192.168.2.4
Jan 16, 2025 05:22:33.805155039 CET	56925	53	192.168.2.4	162.159.36.2
Jan 16, 2025 05:22:33.810103893 CET	53	56925	162.159.36.2	192.168.2.4
Jan 16, 2025 05:22:34.268959045 CET	56925	53	192.168.2.4	162.159.36.2
Jan 16, 2025 05:22:34.274138927 CET	53	56925	162.159.36.2	192.168.2.4
Jan 16, 2025 05:22:34.274226904 CET	56925	53	192.168.2.4	162.159.36.2
Jan 16, 2025 05:23:06.155477047 CET	80	49730	193.122.130.0	192.168.2.4
Jan 16, 2025 05:23:06.155596018 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:23:41.167717934 CET	49730	80	192.168.2.4	193.122.130.0
Jan 16, 2025 05:23:41.172877073 CET	80	49730	193.122.130.0	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 05:22:00.577281952 CET	55512	53	192.168.2.4	1.1.1.1
Jan 16, 2025 05:22:00.584521055 CET	53	55512	1.1.1.1	192.168.2.4
Jan 16, 2025 05:22:01.157799959 CET	49685	53	192.168.2.4	1.1.1.1
Jan 16, 2025 05:22:01.165002108 CET	53	49685	1.1.1.1	192.168.2.4
Jan 16, 2025 05:22:33.799551010 CET	53	53576	162.159.36.2	192.168.2.4
Jan 16, 2025 05:22:34.312478065 CET	59235	53	192.168.2.4	1.1.1.1
Jan 16, 2025 05:22:34.320681095 CET	53	59235	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 05:22:00.577281952 CET	192.168.2.4	1.1.1.1	0xcc95	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.157799959 CET	192.168.2.4	1.1.1.1	0xe648	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:34.312478065 CET	192.168.2.4	1.1.1.1	0x3ab6	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:00.584521055 CET	1.1.1.1	192.168.2.4	0xcc95	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:01.165002108 CET	1.1.1.1	192.168.2.4	0xe648	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 05:22:34.320681095 CET	1.1.1.1	192.168.2.4	0x3ab6	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.122.130.0	80	7556	C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 05:22:00.599602938 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 16, 2025 05:22:01.053620100 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 04:22:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6946dc2e9c1addb7056957b7c85b22cb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 16, 2025 05:22:01.057292938 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 16, 2025 05:22:01.156481981 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 04:22:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 80593c069250adf48a247b4dc38e1d74 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.48.1	443	7556	C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 04:22:01 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-16 04:22:01 UTC	853	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 04:22:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2316110 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Be6afJhFfPeCshp0QoxlGljg8HfPu329EdySa0pps3N18jOQ8ZdHWES6OTt8Uv2vCYzoQfLRb40gr85AiVkK9ec%2BF0m88elUanOGYyUqHIaDO2p6qlnVBtNobJZhSlifK0%2FjzXNy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902b5274ef13c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1512&min_rtt=1510&rtt_var=570&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1910994&cwnd=214&unsent_bytes=0&cid=f3ff73b1847cb5e5&ts=177&x=0"
2025-01-16 04:22:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	23:21:59
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"
Imagebase:	0xcf0000
File size:	235'520 bytes
MD5 hash:	A81A0F916354B1EE0232C5EAE992C365
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1688815803.0000000004144000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:21:59
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe"
Imagebase:	0xe00000
File size:	235'520 bytes
MD5 hash:	A81A0F916354B1EE0232C5EAE992C365
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2923641724.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2925288790.00000000032F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	81.8%
Total number of Nodes:	33
Total number of Limit Nodes:	0

Executed Functions

Function 01477AE8 Relevance: 1.9, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 0147834C

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 6e46b03258497c141a345201e804bd47d3624cf56257447e58841e982da805eb
Instruction ID: f82c06115e67b66c9c8b759c1b0474f4405b67d947a3b6e12293ef656a7c26f3
Opcode Fuzzy Hash: 6e46b03258497c141a345201e804bd47d3624cf56257447e58841e982da805eb
Instruction Fuzzy Hash: 5A62D474E012288FDB64DF69C954BDDBBB2FB89300F1085EAD409AB295DB359E85CF40

Function 01477AD8 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ebfdd12bb7aa3675c5087aec6e8f930e1d01742b74227c9c83033b5aac3c8d9
Instruction ID: 09f31dc4f3c24f473caabdfc7e412cced35705016c7b39c72d5e8fb64364959c
Opcode Fuzzy Hash: 7ebfdd12bb7aa3675c5087aec6e8f930e1d01742b74227c9c83033b5aac3c8d9
Instruction Fuzzy Hash: 4D42D274E012288FDB64DF69C954BDDBBB2BF89300F1085EAD509AB294DB359E85CF40

Function 0147764F Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0147791F

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7d1545da21077ac93063e31d3c22ec40982cc9e15c251754d9d1f43287123ac9
Instruction ID: 699d3b80247745d7fb6fbc3a5e249cf40ea70991d110324b08702042d341e538
Opcode Fuzzy Hash: 7d1545da21077ac93063e31d3c22ec40982cc9e15c251754d9d1f43287123ac9
Instruction Fuzzy Hash: D6C13771D0022D8FDB20DFA8C945BEEBBB1BF09300F0495AAE549B7250DB749A85CF95

Function 01477658 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0147791F

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 030b26698bcd55af0c74ac2cdc39db42fbe39411f5b9d5a6b733ec65e3dbb376
Instruction ID: 2c03a0320a1db135fe18c13fec5f85361b84f16e3120ef1faf49d0af76791d87
Opcode Fuzzy Hash: 030b26698bcd55af0c74ac2cdc39db42fbe39411f5b9d5a6b733ec65e3dbb376
Instruction Fuzzy Hash: 9AC13770D0022D8FDB20DFA8C945BEEBBB1BF49300F0495AAD549B7250DB749A85CF95

Function 014772CB Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014773A3

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 781600c51448dc9c924a614f83716f97f8054592b91ea239912f38de88f90fb9
Instruction ID: ffdc8c22701c8375eacfb637cbd601ca05071d1a0b176487398ec14e5cd7c42b
Opcode Fuzzy Hash: 781600c51448dc9c924a614f83716f97f8054592b91ea239912f38de88f90fb9
Instruction Fuzzy Hash: 4B419AB5D012589FCF10CFA9D984ADEFBF1BB49310F14902AE819B7250D734AA45CF64

Function 014772D0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014773A3

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e0e62747fa54025153b9062c711a14f7eea6546245193a7d9a54e300aa9ef593
Instruction ID: 600abfa9470c558cc9a88e8c9517776b6c9805b9d80b4cb234aebe150a41fde5
Opcode Fuzzy Hash: e0e62747fa54025153b9062c711a14f7eea6546245193a7d9a54e300aa9ef593
Instruction Fuzzy Hash: EF419BB5D012589FCF10CFA9D984ADEFBF1BB49310F14902AE819B7250D735AA45CF64

Function 01477420 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014774DA

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e80691b480a3a4f21ca530f9ddfd0e9e0feb246719bf9aed7777315f32527897
Instruction ID: b8048f59e5a41e83dd4046b45261cd1f519566ed7bdc5303db1ce122e825fdef
Opcode Fuzzy Hash: e80691b480a3a4f21ca530f9ddfd0e9e0feb246719bf9aed7777315f32527897
Instruction Fuzzy Hash: 2F41C9B9D00258DFCF10CFA9D884AEEFBB1BB49310F10942AE819B7250D734A945CF69

Function 01477428 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014774DA

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 5c90095687f0e816e72ee8f576a2fdba40a3815673d330487af48a51ff67b0c2
Instruction ID: 60aecb458aabe6eda2289218f0904d2f4963078da4d78af82642f04506a15854
Opcode Fuzzy Hash: 5c90095687f0e816e72ee8f576a2fdba40a3815673d330487af48a51ff67b0c2
Instruction Fuzzy Hash: 0741BAB5D04258DFCF10CFA9D984AEEFBB1BB49310F10942AE815B7210C735A945CF68

Function 014771AB Relevance: 1.6, APIs: 1, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0147725A

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 433168d31f448891832962cc00ca01e9e114dc945bd362ec27d484b89d5e594e
Instruction ID: cbeb775294c56916d6a1771ef1d20e65dfb3f17e9b6e965d494569733d5a5ad8
Opcode Fuzzy Hash: 433168d31f448891832962cc00ca01e9e114dc945bd362ec27d484b89d5e594e
Instruction Fuzzy Hash: B73197B9D042589FCF10CFA9D984ADEFBB1BB49310F10902AE815B7210D735A946CFA8

Function 014771B0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0147725A

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f24e0b67f5566e78c1a74c299a955f07ebd3fd90c559f697ee84a841b2d7ee0
Instruction ID: c2be5d9e2599914cc6b3e8d807c31e45e7a3bef0b6935f008e8459363aeb1e1b
Opcode Fuzzy Hash: 5f24e0b67f5566e78c1a74c299a955f07ebd3fd90c559f697ee84a841b2d7ee0
Instruction Fuzzy Hash: 9631A8B8D042589FCF10CFA9D984ADEFBB1BB49310F10902AE815B7210D735A945CFA8

Function 01477080 Relevance: 1.6, APIs: 1, Instructions: 97
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01477137

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9840af16d3e093aa21d52c529a589f3caa9fa1f1b04bf3994595edc4e7977b91
Instruction ID: 9c034318134378226694a6ee71b7dc265c38da5816bf76d33e349104aa40e0f0
Opcode Fuzzy Hash: 9840af16d3e093aa21d52c529a589f3caa9fa1f1b04bf3994595edc4e7977b91
Instruction Fuzzy Hash: 0F41CBB5D002589FCB10CFA9D984AEEFBF1BB49310F14802AE459B7354D738A985CFA4

Function 01477088 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01477137

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f9878a359f808c6db7de7b1f50327810616bc47880c1b5aed16d3014b7946d71
Instruction ID: 4cfec5ad4afaef06be74df2006f0ada96fbb6ec35b0480eb21337dfd7db1690f
Opcode Fuzzy Hash: f9878a359f808c6db7de7b1f50327810616bc47880c1b5aed16d3014b7946d71
Instruction Fuzzy Hash: 9C31BCB4D002589FCB14DFA9D984AEEFBF1BB49310F14802AE418B7350D738A985CF54

Function 01476F90 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 01477016

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1d78e3b8b68638c5e2e0b528d165eb402374bed982eb8078db710d4d7c2a35f6
Instruction ID: 46b8e9044c13a583578531bc108e8f1be538010d1a103728e2db23562d4713b5
Opcode Fuzzy Hash: 1d78e3b8b68638c5e2e0b528d165eb402374bed982eb8078db710d4d7c2a35f6
Instruction Fuzzy Hash: EC31CEB4D012589FCB14DFA9D585ADEFBB5FB49310F10942AE819B7310C735A941CF98

Function 01476F98 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 01477016

Memory Dump Source

Source File: 00000000.00000002.1688270845.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1470000_MV.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9d5cc8fe640400d4601e09d9d43f449538b222bce2e8a89333d7c9a8f55caa6a
Instruction ID: 86115d88f0fa21a39d273f351f0258a219811f5b0efe674d643bf557afbbc05d
Opcode Fuzzy Hash: 9d5cc8fe640400d4601e09d9d43f449538b222bce2e8a89333d7c9a8f55caa6a
Instruction Fuzzy Hash: 4731ACB4D012589FCB14CFA9D984ADEFBB5AB49310F10942AE419B7350C735A945CF94

Analysis Process: MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exePID: 7556, Parent PID: 7524COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.3%
Total number of Nodes:	53
Total number of Limit Nodes:	6

Executed Functions

Function 05D4A8A0 Relevance: 12.1, Strings: 9, Instructions: 880COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05D4ADAF
(o^q, xrefs: 05D4AD9F
,bq, xrefs: 05D4AD40
(o^q, xrefs: 05D4A9B5
(o^q, xrefs: 05D4A989
,bq, xrefs: 05D4AD30
(o^q, xrefs: 05D4AA52
(o^q, xrefs: 05D4A8CE
(o^q, xrefs: 05D4AE61

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2735749406
Opcode ID: d82b8fbb38d17f6c4ebf43807f22da1de4496dd7ebd219882b70437507cc5b8a
Instruction ID: 8fd85217f87cda6bd6e13230590155c5e23cfb9ed926bb7471bb41379a01a425
Opcode Fuzzy Hash: d82b8fbb38d17f6c4ebf43807f22da1de4496dd7ebd219882b70437507cc5b8a
Instruction Fuzzy Hash: C2823C31A04209DFDB15CF69C988AAEBBF2FF48314F15855AE456AB2A1DB30ED41CF50

Function 05D49B40 Relevance: 8.4, Strings: 6, Instructions: 893COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05D4A3C0
(o^q, xrefs: 05D4A3B2
Hbq, xrefs: 05D49F42
(o^q, xrefs: 05D4A076
,bq, xrefs: 05D4A42A
,bq, xrefs: 05D4A438

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-56095411
Opcode ID: 5a15299d476d08154ebd528fdae52dba639c4738455451f7f1306a241e131478
Instruction ID: 5eb60ec166312ba58282b0ae5d74c73544fbab52d468bae906c091bf0393a072
Opcode Fuzzy Hash: 5a15299d476d08154ebd528fdae52dba639c4738455451f7f1306a241e131478
Instruction Fuzzy Hash: F7724D70A402199FDB15CF69C894AAEBBF7BF88300F14846AE855AB3A5DB30DD41CF50

Function 0146F128 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9024f6b005daa532fa09f41d663688fad048f65184a1a0494c2608b339d816
Instruction ID: 0b3420e7cafa50c97337343e3686b7a8bc3d602e130484803241d530eec3fe26
Opcode Fuzzy Hash: 1b9024f6b005daa532fa09f41d663688fad048f65184a1a0494c2608b339d816
Instruction Fuzzy Hash: DEF11674E01218CFDB14CFA9D894B9DBBB6BF88304F14C1AAE448AB365DB309985CF51

Function 05D47620 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6810f18fec5ae5eab8a4b73d208bd14ec3e9c7a917667e050f0df0876734a574
Instruction ID: 63458e4094e317de06cda2268a0ee34611d2b6561a714cbb44181c6d0477179e
Opcode Fuzzy Hash: 6810f18fec5ae5eab8a4b73d208bd14ec3e9c7a917667e050f0df0876734a574
Instruction Fuzzy Hash: 7C826D74E012288FDB64DF69C998BDDBBB2BB89300F1081EA941DA7265DB315EC5CF41

Function 01467F48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b379cd51984cff1a495464679f123a54533e2b9fabc1b77a4d9b92821748cb
Instruction ID: 91baebd83a730a1b249ef5ceaa5cfbd408a8498be6472bc5b1203b392d968ba6
Opcode Fuzzy Hash: d2b379cd51984cff1a495464679f123a54533e2b9fabc1b77a4d9b92821748cb
Instruction Fuzzy Hash: 46C1A174E01218CFDB14DFA9D994B9DBBB2FB88304F1480AAD819A7364DB359E85CF11

Function 014684F8 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18a2fdb2ba5ff1c4b0bb6545d03d575d7cda35699735d98ecb444f91555c196
Instruction ID: 56629195d0e74f426f78cd5aad6019aaaa2d4d238cfd003a3f9cb9560740ffb2
Opcode Fuzzy Hash: d18a2fdb2ba5ff1c4b0bb6545d03d575d7cda35699735d98ecb444f91555c196
Instruction Fuzzy Hash: 52A12570D002098FEB14DFA9D984BADBFB1FF88304F24926AE508A73A1DB745985CF55

Function 01468508 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443e243190437801425a1f0a6e95f5c5a8ab4952f025c3739b0081a49730aee5
Instruction ID: 36976c4416662c67c76ad78d4276571fca6feec6889cf150a61714c81d4244a0
Opcode Fuzzy Hash: 443e243190437801425a1f0a6e95f5c5a8ab4952f025c3739b0081a49730aee5
Instruction Fuzzy Hash: 4EA11370D00209CFEB14DFA9D988B9DBBB1FF88304F24926AE509A73A1DB745984CF55

Function 0146884F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa68f6db9f5af0a3c719410b6879f770d0d9de631c065138e249e68a627c176
Instruction ID: 3f34b12b0e4bb26330b5f804e6f87787aeedbe54bd088f8a2d1ecd0ff058a08c
Opcode Fuzzy Hash: eaa68f6db9f5af0a3c719410b6879f770d0d9de631c065138e249e68a627c176
Instruction Fuzzy Hash: 0F910370D00309CFDB10DFA9D984BADBBB1FF48304F20926AE509A72A1DB749984CF15

Function 05D4B968 Relevance: 3.3, Strings: 2, Instructions: 786
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05D4C48C
$^q, xrefs: 05D4C4AF

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 762cd8989a3d76d58d7728c4aaf3428c15c4f5b5ac948024f4845b1e6e83f036
Instruction ID: ac3d0b44df20329a9af3864637270c6c8aa7707b7c6cf49e153385e8998e4d3a
Opcode Fuzzy Hash: 762cd8989a3d76d58d7728c4aaf3428c15c4f5b5ac948024f4845b1e6e83f036
Instruction Fuzzy Hash: 8C623F74A002198FDB159FA5C8A4BAEBF76FB94300F1080AED10A6B3A5CF359D85DF51

Function 05D49260 Relevance: 2.8, Strings: 2, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05D4934B
Hbq, xrefs: 05D4937E

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 72eb58b9cb472b77a578d7b61a142b70fa150118f1da93e1b37d3a819b7b2d33
Instruction ID: 40eab65b1438c91d973c6aaa26e81ce46b1f6b5c4a8a88884d3a17b3d55afb07
Opcode Fuzzy Hash: 72eb58b9cb472b77a578d7b61a142b70fa150118f1da93e1b37d3a819b7b2d33
Instruction Fuzzy Hash: 0FC1B3303052558FDB159F6AD8A4A3F7BE6FB89200F18856AE94ACB394CF35CC41CB95

Function 05D49720 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 05D49800
,bq, xrefs: 05D497F6

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 63202110ebb38ea3812e7449af4bc0eb456add15ef7878af993d1b232cfa463b
Instruction ID: a85294894c1f53ccaab4793663a70c0c7953af8bc7608a9d30d2f329711cd2b4
Opcode Fuzzy Hash: 63202110ebb38ea3812e7449af4bc0eb456add15ef7878af993d1b232cfa463b
Instruction Fuzzy Hash: 6A815E35A04105DFCB14CF6EC8A4A6BBBB2BF89220B15816AD41AE7365DB31E841CF91

Function 0146F50C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 0146F64E

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 707735181c6f321103c05d78e1a2ed9e0c9849653db1eeec4af3b43bd09a50b2
Instruction ID: 4952082dee25b854c531cc84e3f9920d8da8e85c773f69ea86bada9b0e281715
Opcode Fuzzy Hash: 707735181c6f321103c05d78e1a2ed9e0c9849653db1eeec4af3b43bd09a50b2
Instruction Fuzzy Hash: 2C118474E011099FDB04DFA8E494EADBBB9FB88308F14D126E944E7262DB30AC46CF51

Function 05D4B428 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05D4B4A3

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 246f5a8b2d615ea3b052aa292dc77503c6554876c546ec31dc1674f848013d83
Instruction ID: 56e45507de25f185c3ba86a54cac8e59de1d3536a5ec4d14ee5439d1991ad6d0
Opcode Fuzzy Hash: 246f5a8b2d615ea3b052aa292dc77503c6554876c546ec31dc1674f848013d83
Instruction Fuzzy Hash: 414147746001099FDF04DF69D888AAA7BB6FB58315F00006AF91ACB3A1CB30DC91CF90

Function 05D4B760 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05D4B7DA

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 0e1591ca6cc1372b4b72e1e54973aace7259bab06cdb4008964c5cbdcf9088fc
Instruction ID: 5820f1677be81d836e1b8336852ec1f1f6394489bc15702344d406bfe31c0d82
Opcode Fuzzy Hash: 0e1591ca6cc1372b4b72e1e54973aace7259bab06cdb4008964c5cbdcf9088fc
Instruction Fuzzy Hash: 672194317082598BEF14CE6AAC8467B7FEAFBA5240B044427E856C7242DB35DC80CFA1

Function 05D4C6A8 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca89f117527965d8cbb13ece140f9b4ac1981e2454df0f0b541096513dc83914
Instruction ID: 2199a1a8e4c22d3f9c6231d12a05e93c4b6b53c94c00885a1c8e2a4f954888e7
Opcode Fuzzy Hash: ca89f117527965d8cbb13ece140f9b4ac1981e2454df0f0b541096513dc83914
Instruction Fuzzy Hash: F7F1FC75A11614DFCB14CFA9D5889ADBBF6BF88310B1980AAE415AB371DB31EC41CF60

Function 05D4B619 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01100e6ab910adc9600b6dde01228b62f86917ba734d25e5b62182a0df366b1c
Instruction ID: 2db3d84a9689270eef7796019dfa80ce61a729f325f5b7cd9061aa9f9cff29ec
Opcode Fuzzy Hash: 01100e6ab910adc9600b6dde01228b62f86917ba734d25e5b62182a0df366b1c
Instruction Fuzzy Hash: 825158357142159FEF14DF39D884A3B7BEABF9864071944ABE44ACB361EB21EC01CB50

Function 05D47610 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce6119329745d50b3f3307d27ff540bc82b2cbbf5c81362f3ee32ce4cce0434
Instruction ID: 1e3150adeec0993a322025bb6023cc7a302e8f19c77641f2d021b0a1328f0fcf
Opcode Fuzzy Hash: 6ce6119329745d50b3f3307d27ff540bc82b2cbbf5c81362f3ee32ce4cce0434
Instruction Fuzzy Hash: 8281A474E062299FDB65DF25D980BEDBBB2BB89300F1080EAD85DA7250DB315E81CF41

Function 05D48988 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13695aded9bc1b9188051f265214453afb2378814d490e8d65ff1a8286dd1d19
Instruction ID: ff7f514209c6397bc98bdb38b18113f45e011a6b6d5966f161d5edf5c98f555e
Opcode Fuzzy Hash: 13695aded9bc1b9188051f265214453afb2378814d490e8d65ff1a8286dd1d19
Instruction Fuzzy Hash: 45319E3160520ADFCB05DF65D855A7F3FA2FB98240F04802AF9199B294CB79CD61DFA1

Function 05D4B858 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31095d333fde71f6a879469af669a257cd0c545e6c4f5426faccc5bfd33d0dc8
Instruction ID: 1c7278aade64d65cb01adb3ec20cfdb0814c925b30165b1b7648956762fe70f3
Opcode Fuzzy Hash: 31095d333fde71f6a879469af669a257cd0c545e6c4f5426faccc5bfd33d0dc8
Instruction Fuzzy Hash: 1B2192317082059BFF146A2AC85473E799BBFD4615F18803BD54ACB394EE75CC42EB85

Function 05D4B849 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4491227194f9295490df32797c460a46cbcd7ddc9baea0139f3779ac655d85
Instruction ID: 83bb3a3e4b6ca7564944e68e35207b2104e18c86739b775479f66432993fb614
Opcode Fuzzy Hash: ea4491227194f9295490df32797c460a46cbcd7ddc9baea0139f3779ac655d85
Instruction Fuzzy Hash: 3121C5313082058BEF156B3A889463D7AA7BFD5615B18407BE54ACB395EE35C842EB82

Function 05D4C698 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab3c10d5c2584bdc9aa8562bc48c5e44c87b48027f22d02c450177cb45ffc75
Instruction ID: aca6290e37d3f21a3ffddc3b4a65c50b34cd4dcc30a9f59382c768ad96a9eb17
Opcode Fuzzy Hash: aab3c10d5c2584bdc9aa8562bc48c5e44c87b48027f22d02c450177cb45ffc75
Instruction Fuzzy Hash: C6315275A106058FCB14DF69C8889AFBBF6FF88210B15855AE515973B1DB34DC41CF90

Function 0141D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924128877.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_141d000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5455c55ba267f4f4523c2e454f349a13b6c0a945983c28d9039a9448a16d0b0b
Instruction ID: de33875749a917b2715f0ba186a93f8506f8d09f49eb1e57066657fdc8df52f0
Opcode Fuzzy Hash: 5455c55ba267f4f4523c2e454f349a13b6c0a945983c28d9039a9448a16d0b0b
Instruction Fuzzy Hash: 412125F1904200DFCB15DF58D988B26BFA5EB84318F20C66ED80A4B36AC336D447CA62

Function 05D48978 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5266e4fee56031ac7ba8ad9ab2758b72de2c71c3ff698af9594ef47bee5e9582
Instruction ID: 246be7706cb4d38ff651167390a6c526ec051e994b6d426c00552e909bf3e581
Opcode Fuzzy Hash: 5266e4fee56031ac7ba8ad9ab2758b72de2c71c3ff698af9594ef47bee5e9582
Instruction Fuzzy Hash: 7621DE326062499FDB01DF25D845B7B3FA2FB94350F04402AF8199B280CB78CEA1DBA1

Function 0141D006 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924128877.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_141d000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780fc246396d6f358f44620235526ced279bef77e5a46127f454dbac1aa8424b
Instruction ID: 192127c6cb7ffbdd2da938ab060520e6ed86759ba28f432d87aba40bf1965b0b
Opcode Fuzzy Hash: 780fc246396d6f358f44620235526ced279bef77e5a46127f454dbac1aa8424b
Instruction Fuzzy Hash: 5E216B7550D3C08FDB07CF64C994711BF71AB46214F29C5EBD8898F2A7C23A980ACB62

Function 05D4A158 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6dcbc37b694265ee5519bc7f6092f06a48a89b51d23e396819ee6e69c65e40
Instruction ID: 0999b4e3b976f947ac07b5ee400bb5fed5645af1a83efc5dbf885f8085c3c4e2
Opcode Fuzzy Hash: 3a6dcbc37b694265ee5519bc7f6092f06a48a89b51d23e396819ee6e69c65e40
Instruction Fuzzy Hash: 8D21CA31A402489FDB20CF94C848FABBBF6FB44310F40856BE85A8B651E771E984CF90

Function 05D491D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4a0c41c02afc59c68859e17b4245a2a4eaa5056a44a7c327703539e66e67a0
Instruction ID: 0a4fe34c3ec1382870e13da169caf735576829a1dd23e4dacf442381cd97e12d
Opcode Fuzzy Hash: cb4a0c41c02afc59c68859e17b4245a2a4eaa5056a44a7c327703539e66e67a0
Instruction Fuzzy Hash: DC01D632B001186BDB05DF5A9810ABF3FABEBC8A50F54802AF519D7284DE71CC118BA0

Function 05D491C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd04b9953cb46a69fca47312e13ce01b3ffe14cfa17458daa72cd137aa64c424
Instruction ID: 8cadd699c253851e517feb3c410996f86b6ce9f6a110de634edcbd521ae5bd9b
Opcode Fuzzy Hash: dd04b9953cb46a69fca47312e13ce01b3ffe14cfa17458daa72cd137aa64c424
Instruction Fuzzy Hash: ED01D6326041486BDB02DF56AC14FBB3FAAEBC4750F54802AF519C7140DB31D8119B90

Function 05D4FF70 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fd164409daf6cbd8f36f049e28d8779435cb42f3caf6cb7f6c08badb3e2284
Instruction ID: 60a50323f4a4543d550603bae08673d938a34c207194118791a80ed56fa3a3b1
Opcode Fuzzy Hash: 28fd164409daf6cbd8f36f049e28d8779435cb42f3caf6cb7f6c08badb3e2284
Instruction Fuzzy Hash: F4E0DF306166048FD700AF78F40D3AA7BB8FB82201F414E3AF506A7618EF7598808BD7

Function 05D4FF80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6317bab8246dda5b8736e11c1e989575dd24525c287e450002c2f6c545534b
Instruction ID: 70e821aa7574c9f2e943cd5d8ad260f4bc8a024d76469c22f623552110d724b0
Opcode Fuzzy Hash: 4c6317bab8246dda5b8736e11c1e989575dd24525c287e450002c2f6c545534b
Instruction Fuzzy Hash: D4E0C2316156048FD7117F79F40815A7BF8FB86245F41063BE505A7358EF359C8087D6

Function 05D499C1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f240217cca757302897d8e792a892140c2b77a89a026ff9739a6f962f16337e8
Instruction ID: f36048b31d30d18c395136a157694d3e69dfe098d4eec5bc422f1c727cfd4f6c
Opcode Fuzzy Hash: f240217cca757302897d8e792a892140c2b77a89a026ff9739a6f962f16337e8
Instruction Fuzzy Hash: 66D02B3000B3884FF342E73FB801A627F59A791200F048568A0454626ACFB44CC98B81

Function 05D4C59D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f5625ba3dd9172dc2f73e01d69157301ec99683a28e2ac6baef2022bc12673
Instruction ID: f1a051ec26556dc75a803700dcd16631f130d0966052bb9a31193e7a17d0b286
Opcode Fuzzy Hash: 09f5625ba3dd9172dc2f73e01d69157301ec99683a28e2ac6baef2022bc12673
Instruction Fuzzy Hash: 49D0677AB40018DFCB049F99E840CDDFBB6FB98221B148126F925A3261CA31A925DB54

Function 05D499D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d08ec338c9e7ec81abef966ec7a43383a2c7950daeee73d6d07b33ff6bbe5cf
Instruction ID: b872e14ea068e5b522643c36e6b475174313c4c395a9407de9be5ad409050f7d
Opcode Fuzzy Hash: 4d08ec338c9e7ec81abef966ec7a43383a2c7950daeee73d6d07b33ff6bbe5cf
Instruction Fuzzy Hash: BEC0123045630D4EC641E76BE9455567F6EE6A0300B449570A0090A26DDF785CCA4A90

Non-executed Functions

Function 05D4CDC0 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4b6d30fc77c77b51001b612d159cf80bf04e7f972e243b155296421be0a17f
Instruction ID: a2ee2726a5f6022fc4c24313bd9b304754fa00a3cf7c7eba251055950d61a686
Opcode Fuzzy Hash: 7a4b6d30fc77c77b51001b612d159cf80bf04e7f972e243b155296421be0a17f
Instruction Fuzzy Hash: D002C874A01218CFDB14DFA9C984B9DBBB2FF49300F1484AAD819AB365DB359D81CF50

Function 05D44718 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b819b6c41b27def91bf2689bdea02748728acd14f92c7170952618fb4a726fe
Instruction ID: 984b75dc97bcb776c98a8333c6574c7b53f02f612b064bd3e38e86555f956030
Opcode Fuzzy Hash: 9b819b6c41b27def91bf2689bdea02748728acd14f92c7170952618fb4a726fe
Instruction Fuzzy Hash: D7E1C174E01218CFEB24DFA5D944B9DBBB2FF89304F2081AAD409A7394DB755A85CF11

Function 0146F7F8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2924433508.0000000001460000.00000040.00000800.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1460000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d33ea4768722959d9b77c31abcfb3250361f406e6f482753e4f8fcb9b8f873
Instruction ID: da99c3b04aa78229d618b208447fe51b18f790b83d825b5e2a5844587d1ae336
Opcode Fuzzy Hash: 86d33ea4768722959d9b77c31abcfb3250361f406e6f482753e4f8fcb9b8f873
Instruction Fuzzy Hash: F7D1B174E01218CFDB14DFA9D954B9DBBB2FB89304F2080AAD809AB365DB359D85CF11

Function 05D471C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9da8bceff7f712642c09aa7d784a007388a1ebfb9c44bc4886980a4d1a6cff6
Instruction ID: 23290f829ffee89cc9b3bb2d11c570e1f7b1b8490cdc78e6b81e8f90046d74ec
Opcode Fuzzy Hash: a9da8bceff7f712642c09aa7d784a007388a1ebfb9c44bc4886980a4d1a6cff6
Instruction Fuzzy Hash: DFC1A074E01218CFDB14DFA9D994B9DBBB2FB89300F1080AAD409AB364DB359E85CF51

Function 05D4F1F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30808a14711139ae193025cd1cf7a2f8b18151ba5403c9f99a8d96c564c88e8
Instruction ID: 516b7b25963da73940f220e1fb29dc598353d9fad80a96f89f651feac92119d5
Opcode Fuzzy Hash: b30808a14711139ae193025cd1cf7a2f8b18151ba5403c9f99a8d96c564c88e8
Instruction Fuzzy Hash: 6BC19074E01218CFDB14DFA9D994B9DBBB2EB89300F1080AAD409AB365DB359E85CF11

Function 05D435B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee858d3e2f605f1aac7367c5f872faa097be5ac92d627b99739e3729c01f3cef
Instruction ID: 3fab9ff8e8d72cc7d81294d738d33089e84ce07810253cd3143822553f79c940
Opcode Fuzzy Hash: ee858d3e2f605f1aac7367c5f872faa097be5ac92d627b99739e3729c01f3cef
Instruction Fuzzy Hash: 31C1A074E01218CFDB14DFA9D954B9DBBB2FB89300F2084AAD809A7364DB359E85CF11

Function 05D4EDA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6d176805d6d3a4c7f8d5de38006ee1e5c497e032421c4ea72a26b8a77f443c
Instruction ID: b161e38a596024860afbe1872c5b18e16b9228fecf1f12053fb31f82caa7785d
Opcode Fuzzy Hash: 0b6d176805d6d3a4c7f8d5de38006ee1e5c497e032421c4ea72a26b8a77f443c
Instruction Fuzzy Hash: F6C18F74E01218CFDB14DFA9D994B9DBBB2FB89300F1080AAD409AB365DB359E85CF51

Function 05D4E948 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d0256e6b719b042e00997047059ef310f10f08a1d91a1fa7154eeabcf88a8a
Instruction ID: e8ad6030041b1ea96b38f5158771c102c32b139bc0848aaf1497e7d03714bb7b
Opcode Fuzzy Hash: 34d0256e6b719b042e00997047059ef310f10f08a1d91a1fa7154eeabcf88a8a
Instruction Fuzzy Hash: 63C1AF74E01218DFDB14DFA9D994B9DBBB2FB89300F1080AAD409AB365DB359E85CF11

Function 05D46D70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be4d06c6b686a3975132881c1f7fc1202756ea2d71d00a11431c55f7483bb4e
Instruction ID: 3cabbb66eef193c430000f95c453f086e78958ea652c250d4cbf088d0be61394
Opcode Fuzzy Hash: 4be4d06c6b686a3975132881c1f7fc1202756ea2d71d00a11431c55f7483bb4e
Instruction Fuzzy Hash: 30C19074E01218CFDB14DFA5D994B9DBBB2EB89300F1080AAD419AB364DB359E85CF51

Function 05D43160 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b6b5b2f993ec4ce3b2795092605f00c5358764ea7813776c4d893c7888486c
Instruction ID: e82a2fb3c0a53fcb6e1454142f847e8de261ba57e6161ceaf6687a8554335cf2
Opcode Fuzzy Hash: 61b6b5b2f993ec4ce3b2795092605f00c5358764ea7813776c4d893c7888486c
Instruction Fuzzy Hash: FEC19274E01218CFDB14DFA9D954B9DBBB2FB89300F1084AAD809A7364DB359E85CF11

Function 05D46918 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dced24ec4c90192c33a0b3a0d3ca7dd1a2c339f89097f631cc9fd2e7a8696f2
Instruction ID: 618c3bf41688aa50a715242b03dd75482732309dc2d27a4fd9f3c7ddec18b998
Opcode Fuzzy Hash: 6dced24ec4c90192c33a0b3a0d3ca7dd1a2c339f89097f631cc9fd2e7a8696f2
Instruction Fuzzy Hash: 0FC19174E01218CFDB14DFA5D994B9DBBB2EB89304F1080AAD409AB364DB359E85CF11

Function 05D464C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da1437badc266ebc494d875478eeb91b350897c1c3178b361500c38f45d3bfb
Instruction ID: fb8c3e9bb2e73481c7459ba485b55c981a12855011b7fdd94d8149cb4b6d13d8
Opcode Fuzzy Hash: 1da1437badc266ebc494d875478eeb91b350897c1c3178b361500c38f45d3bfb
Instruction Fuzzy Hash: 81C18F74E01218CFDB14DFA9D994B9DBBB2EB89300F1080AAD419AB364DB359E85CF11

Function 05D4E4F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f7250612c26ec2a338bffe3fb97548138fa8dede149b0acdef75f3e5cc91f0
Instruction ID: 3db8407debb434a444700967537b2a99c271a967ac49ee1bcf44b64da59979f1
Opcode Fuzzy Hash: d8f7250612c26ec2a338bffe3fb97548138fa8dede149b0acdef75f3e5cc91f0
Instruction Fuzzy Hash: 50C19074E01218DFDB14DFA9D994B9DBBB2FB89300F1080AAD409AB365DB359E85CF11

Function 05D4E098 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a07b8f2bebbd14f30d314395246a93d18056a4e2938ef5abb957d57e7e621a1
Instruction ID: ad9c24400947f4d37beace7facd7ff1f60e6d7b05934605f416041a760272834
Opcode Fuzzy Hash: 9a07b8f2bebbd14f30d314395246a93d18056a4e2938ef5abb957d57e7e621a1
Instruction Fuzzy Hash: A8C1AF74E01218DFDB14DFA9D994B9DBBB2FB89300F1080AAD409AB364DB359E85CF11

Function 05D4DC40 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc08c2efa3ee12d347fcebb0fe8bdb632ea658edc19a4632ad815ee7c4c7d622
Instruction ID: e2ac9a9c02d36132f7fb9c4ba38ef6ebbf704b6722499bd02933b24600857197
Opcode Fuzzy Hash: bc08c2efa3ee12d347fcebb0fe8bdb632ea658edc19a4632ad815ee7c4c7d622
Instruction Fuzzy Hash: E8C1A074E01218CFDB14DFA9D994B9DBBB2FB89300F1080AAD419AB365DB359E85CF11

Function 05D46068 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34658e1f7d75cdd91e9ddc8b44ccd8199ea905b459fc09d457447e8c0854420
Instruction ID: ca723babc9ebebaffb9810733670d80efd71ba33ffd2c197423d79dccb14ed06
Opcode Fuzzy Hash: f34658e1f7d75cdd91e9ddc8b44ccd8199ea905b459fc09d457447e8c0854420
Instruction Fuzzy Hash: 39C19074E01218CFDB14DFA5D994B9DBBB2EB89300F1080AAD409AB365DB359E85CF11

Function 05D45C10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18dee874e14c5c86525598d702dd3ab7c620cf4c92b28b36e1e23748a53207ab
Instruction ID: 2fbf46586421c2a972ca0262808378b12aabe91e6f04a09bd66bbca9c799f084
Opcode Fuzzy Hash: 18dee874e14c5c86525598d702dd3ab7c620cf4c92b28b36e1e23748a53207ab
Instruction Fuzzy Hash: 3EC19174E01218CFDB14DFA5D994B9DBBB2EF89300F1081AAD409AB364DB359E85CF11

Function 05D4D7E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfadc9ad0e200d0eea22087eb41265897245de4995a581e963690516387e7c9b
Instruction ID: daef3ed75c3f6fd81cf2e899e9993635c490956b9f384551e12f74eeb518634f
Opcode Fuzzy Hash: cfadc9ad0e200d0eea22087eb41265897245de4995a581e963690516387e7c9b
Instruction Fuzzy Hash: 23C18074E01218CFDB14DFA9D994B9DBBB2EF89300F1081AAD409AB365DB359E85CF11

Function 05D4D390 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bf92d42445168d2a0c30f9d18ca9575ee33c772088670c6c592e99319f827e
Instruction ID: 14494e3a07891d16777e5674523af1b24a4754f96c36b63b78a4d218875a72e4
Opcode Fuzzy Hash: 89bf92d42445168d2a0c30f9d18ca9575ee33c772088670c6c592e99319f827e
Instruction Fuzzy Hash: A8C1A274E01218CFDB14DFA5D954B9DBBB2EF89304F2080AAD409AB364DB359E85CF51

Function 05D442C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01dbada8c94d5b81d482f2f6b659f41223c7254223b8e40d2edfe4c3f4797c77
Instruction ID: ccfebdb91d634909da962b27c6a7f88f5f9f11d0a54855900b030fefd0f8879b
Opcode Fuzzy Hash: 01dbada8c94d5b81d482f2f6b659f41223c7254223b8e40d2edfe4c3f4797c77
Instruction Fuzzy Hash: 4AC18074E01218CFDB14DFA5D994B9DBBB2FB89304F2081AAD809A7364DB359E85CF11

Function 05D4FAA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ee8934e2939d0e36c547ea09c251b89763414ab6535b9344ff30417356f093
Instruction ID: 1a5f40a596c6a241d5a1f15573ca7b8bc467a706cedeb615e39b16014685f482
Opcode Fuzzy Hash: f6ee8934e2939d0e36c547ea09c251b89763414ab6535b9344ff30417356f093
Instruction Fuzzy Hash: 1CC19174E01218CFDB14DFA9D994B9DBBB2EF89300F1080AAD409AB365DB359E85CF11

Function 05D4F650 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cda576adc96ab956d8348083e9c033845821d05d47bbe7fa0489201037fcd5
Instruction ID: 911f29446bd170cef612b578802cda49e328f6d2aabf26bac1389ebf34f29b05
Opcode Fuzzy Hash: 93cda576adc96ab956d8348083e9c033845821d05d47bbe7fa0489201037fcd5
Instruction Fuzzy Hash: 86C19074E01218CFDB14DFA9D994B9DBBB2EF89304F1080AAD409AB365DB359E85CF11

Function 05D43E68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48ce2b1ed635196dd79bdcf28642ba0f931d758ee1d326e7316970288a6d963
Instruction ID: b4a76f16032e9b6223856addd4509f98c3393dcf77a77afb98ae4aec1d448b83
Opcode Fuzzy Hash: c48ce2b1ed635196dd79bdcf28642ba0f931d758ee1d326e7316970288a6d963
Instruction Fuzzy Hash: CCC19074E01218CFDB14DFA9D994B9DBBB2FB89304F1080AAD819A7364DB359E85CF11

Function 05D43A10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec187075a1167af663562de0a4f4530a7823fad09c44eda561563269b908f96
Instruction ID: 3a79e2d66eee97568a2b02c5a4f9562047a3fcd6184ff62e2720f31618896034
Opcode Fuzzy Hash: 2ec187075a1167af663562de0a4f4530a7823fad09c44eda561563269b908f96
Instruction Fuzzy Hash: 92C19174E01218CFDB14DFA9D994B9DBBB2FB89300F2085AAD809A7354DB359E85CF11

Function 05D45E55 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3e075b489d6a06743b90139453cbe68c94b90ad4c0bce16161312cf190085a
Instruction ID: 1a6ed9a02854461e5dc72c1ff0d3c9aa0c667a871035d258a045d84c700cd194
Opcode Fuzzy Hash: cc3e075b489d6a06743b90139453cbe68c94b90ad4c0bce16161312cf190085a
Instruction Fuzzy Hash: E4310774E01218DFDB15DFA4D994BADBBB2EB89300F1080A6E80977394C7359E85CF11

Function 05D4A890 Relevance: 5.3, Strings: 4, Instructions: 272COMMON

Download Yara Rule

Strings

(o^q, xrefs: 05D4A9B5
(o^q, xrefs: 05D4A989
(o^q, xrefs: 05D4AA52
(o^q, xrefs: 05D4A8CE

Memory Dump Source

Source File: 00000001.00000002.2926779761.0000000005D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5d40000_MV.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q
API String ID: 0-1978863864
Opcode ID: 9ce12118039a540c307e5f25e40d4155b65f26702db6ee8dbdeaa964977f1915
Instruction ID: 707b0171801071aff7a14c29e05b96d3958cdd134b7613adc4be7843816db9f5
Opcode Fuzzy Hash: 9ce12118039a540c307e5f25e40d4155b65f26702db6ee8dbdeaa964977f1915
Instruction Fuzzy Hash: 2AC13830A402589FCB14CFA9C984AAEBBF3BF48314F15855AE85AAB261D730ED41CF50

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe

Function 01477AE8 Relevance: 1.9, Strings: 1, Instructions: 650
COMMON

Function 0147764F Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Function 01477658 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Function 014772CB Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Function 014772D0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 01477420 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 01477428 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Function 014771AB Relevance: 1.6, APIs: 1, Instructions: 102
memoryCOMMON

Function 014771B0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Function 01477080 Relevance: 1.6, APIs: 1, Instructions: 97
threadCOMMON

Function 01477088 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Function 01476F90 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Function 01476F98 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Function 0146F128 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Function 05D4B968 Relevance: 3.3, Strings: 2, Instructions: 786
COMMON

Function 05D49260 Relevance: 2.8, Strings: 2, Instructions: 341
COMMON

Function 05D49720 Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre