Windows Analysis Report
https://aistreamx.com/67db9a04702992c391d24ddb

Signatures

Detect drive by download via clipboard copy & paste

AI detected suspicious Javascript

HTML page adds supicious text to clipboard

Signatures

Tries to load missing DLLs

Signatures

Spawns processes

Signatures

Allocates a big amount of memory (probably used for heap spraying)

Signatures

Creates files inside the system directory

Creates files inside the user directory

Signatures

May sleep (evasive loops) to hinder dynamic analysis

Signatures

Deletes files inside the Windows folder

Signatures

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Signatures

Reads software policies

Reads internet explorer settings

Signatures

Searches for the Microsoft Outlook file path

Signatures

Uses HTTPS

Signatures

Downloads files from webservers via HTTP

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Signatures

Downloads files from webservers via HTTP

Performs DNS lookups

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Signatures

Downloads files from webservers via HTTP

Performs DNS lookups

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Uses HTTPS

Execution Graphs are highly condensed control flow graphs which give the user a synthetic view of the code detected during Hybrid Code Analysis. They include additional runtime information such as the execution status which is highlighted with different colors and shapes.

Entrypoint

Program entry point, most likely the entry point of the PE file.

Key Decision

A code location where a decision has been made to avoid execution of potentially malicious behavior.

Dynamic / Decrypted

Code which has been generated at runtime, often referred to as unpacked or self-modifying code.

Unpacker / Decrypter

Code section which is responsible for unpacking or decrypting a portion of dynamic code.

Executed

Code which has been executed at runtime.

Not Executed

Code which has not been executed at runtime.

Unknown

Code for which it is unknown if it has been executed or not at runtime.

Signature Matched

Code which matches a behavioral signature.

Rich Path

Path through the execution graph which shows a lot of behavior (e.g. with respect to called API functions).

Thread / callback entry

Code corresponding to a thread or callback entry point.

Thread / callback creation

Edges denoting either a thread creation (e.g. using CreateThread) or a callback registration (e.g. EnumWindows).

Entrypoint

VBA program entry point such as Document_Open.

Decryption Function

Function likely responsible for string decryption.

Executed

This line was executed during analysis.

Not Executed

This line was likely not executed during analysis.