Edit tour

Windows Analysis Report
ExpressVideoConverter.exe

Overview

General Information

Sample name:	ExpressVideoConverter.exe
Analysis ID:	1671514
MD5:	9199fac04355998413a251ed0fac52be
SHA1:	2a88f9c89383480c926f8ce726fe7f33fe71f473
SHA256:	92b61a307ac342e66b3685d4d1f2b073ce3d47b92362e3aae65e7cedf523a562
Tags:	exeuser-FelloBoiYuuka
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Allocates memory with a write watch (potentially for evading sandboxes)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

ExpressVideoConverter.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\ExpressVideoConverter.exe" MD5: 9199FAC04355998413A251ED0FAC52BE)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ExpressVideoConverter.exe

Virustotal: Detection: 8%

Perma Link

Source: ExpressVideoConverter.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ExpressVideoConverter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\xtreme\Documents\Visual Studio 2008\Projects\Express Video Converter\Express Video Converter\obj\Debug\Express Video Converter.pdb source: ExpressVideoConverter.exe

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

Code function: 4x nop then jmp 00007FF88B5360ABh

0_2_00007FF88B535E69

Source: ExpressVideoConverter.exe

String found in binary or memory: https://arjie89.000webhostapp.com/evc.php

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Code function: 0_2_00007FF88B53143C		0_2_00007FF88B53143C
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Code function: 0_2_00007FF88B531492		0_2_00007FF88B531492

Source: ExpressVideoConverter.exe, 00000000.00000000.1178315468.0000000000B46000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExpress Video Converter.exeP vs ExpressVideoConverter.exe
Source: ExpressVideoConverter.exe	Binary or memory string: OriginalFilenameExpress Video Converter.exeP vs ExpressVideoConverter.exe

Source: ExpressVideoConverter.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ExpressVideoConverter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

Mutant created: NULL

Source: ExpressVideoConverter.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ExpressVideoConverter.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ExpressVideoConverter.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Automated click: Continue

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: ExpressVideoConverter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ExpressVideoConverter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ExpressVideoConverter.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\xtreme\Documents\Visual Studio 2008\Projects\Express Video Converter\Express Video Converter\obj\Debug\Express Video Converter.pdb source: ExpressVideoConverter.exe

Source: ExpressVideoConverter.exe

Static PE information: section name: .text entropy: 7.934585066242869

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Memory allocated: 1B0E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\ExpressVideoConverter.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ExpressVideoConverter.exe	8%	Virustotal		Browse
ExpressVideoConverter.exe	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://arjie89.000webhostapp.com/evc.php	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://arjie89.000webhostapp.com/evc.php	ExpressVideoConverter.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1671514
Start date and time:	2025-04-22 23:31:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ExpressVideoConverter.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 11 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ExpressVideoConverter.exe, PID 6464 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8866783716425095
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	ExpressVideoConverter.exe
File size:	275'456 bytes
MD5:	9199fac04355998413a251ed0fac52be
SHA1:	2a88f9c89383480c926f8ce726fe7f33fe71f473
SHA256:	92b61a307ac342e66b3685d4d1f2b073ce3d47b92362e3aae65e7cedf523a562
SHA512:	acd38de0585626198c33bd9e520930ffc8d65f2f43062fe4faff851c4c441d57e55088fb2a672afe046fc1e7b95069057e4107356b7e54562c341cc97f228b92
SSDEEP:	6144:CueEdc/h2rqo0rclTAcKHgkU/B8ba5Od3pgCEL5U:Cueoyto9R4UKbasd3pREL
TLSH:	2744126862E48F56EE7D0B38092A772003F8D95E872DE78B7CDE215D9FD2398431071A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c............................>5... ...@....@.. ....................................@................................

File Icon


Icon Hash:	0f395d8c1d313b0f

Static PE Info

General

Entrypoint:	0x44353e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63E1C5D9 [Tue Feb 7 03:30:33 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x434e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x1500	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x48000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44000	0x1c	.sdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x41544	0x41600	454799a43e8b49a5c37569d732f1e5b5	False	0.9198770614244742	data	7.934585066242869	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x44000	0xc0	0x200	52f3df9f74e795dccadf307d53b372a4	False	0.298828125	data	2.670364923994363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x46000	0x1500	0x1600	c96019484c75cb160b024c1b7945f3b4	False	0.43110795454545453	data	4.647680885544932	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x48000	0xc	0x200	b14a33b8681c4c6ff3bad145981cd3d8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x464f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	0.5777027027027027
RT_ICON	0x46620	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	0.5505780346820809
RT_ICON	0x46b88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5886524822695035
RT_GROUP_ICON	0x46ff0	0x30	data	0.9375
RT_VERSION	0x46190	0x368	data	0.39105504587155965
RT_MANIFEST	0x47020	0x4df	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.4041700080192462

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
CompanyName	Microsoft
FileDescription	Express Video Converter
FileVersion	1.0.0.0
InternalName	Express Video Converter.exe
LegalCopyright	Copyright Microsoft 2023
OriginalFilename	Express Video Converter.exe
ProductName	Express Video Converter
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

• ExpressVideoConverter.exe

Click to jump to process

Memory Usage

• ExpressVideoConverter.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	17:32:02
Start date:	22/04/2025
Path:	C:\Users\user\Desktop\ExpressVideoConverter.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ExpressVideoConverter.exe"
Imagebase:	0xb00000
File size:	275'456 bytes
MD5 hash:	9199FAC04355998413A251ED0FAC52BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00007FF88B53143C Relevance: 8.6, Strings: 4, Instructions: 3563COMMON

Download Yara Rule

Strings

h1, xrefs: 00007FF88B5333AD
h1, xrefs: 00007FF88B5320A0
h1, xrefs: 00007FF88B533995
h1, xrefs: 00007FF88B5324B0

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID: h1$h1$h1$h1
API String ID: 0-1019880495
Opcode ID: 93ef5cce80b77768f3bc4d43504850d39ea75e60dae9ec2bfda1f7702be80091
Instruction ID: 9a50301694380c1a7126d662e2f3f67253e1d6e30e65a856f71cfbb4b3dd3ba8
Opcode Fuzzy Hash: 93ef5cce80b77768f3bc4d43504850d39ea75e60dae9ec2bfda1f7702be80091
Instruction Fuzzy Hash: 2D63647061CB888FE7B5EB18C494B9AB7E1FF99301F454969D08DD72A2CF74A840CB52

Function 00007FF88B531492 Relevance: 8.6, Strings: 4, Instructions: 3558COMMON

Download Yara Rule

Strings

h1, xrefs: 00007FF88B5333AD
h1, xrefs: 00007FF88B5320A0
h1, xrefs: 00007FF88B533995
h1, xrefs: 00007FF88B5324B0

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID: h1$h1$h1$h1
API String ID: 0-1019880495
Opcode ID: 73b4000a476aec53e86165dc57af35604b77cd996a004746ecd470b5d8777551
Instruction ID: 94e2576b36e95467e14f45c2c34c91d5d3ed70228911eaa5c43efb45fc4fad03
Opcode Fuzzy Hash: 73b4000a476aec53e86165dc57af35604b77cd996a004746ecd470b5d8777551
Instruction Fuzzy Hash: 8163647061CB888FE7B5EB18C494B9AB7E1FF99301F454969E08DD72A1CF74A840CB52

Function 00007FF88B53569D Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

`Y, xrefs: 00007FF88B535742

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID: `Y
API String ID: 0-3978992056
Opcode ID: e39ae25b7135d9233c95ba800d0747df3a696263b20b9290d9415ebe874ba759
Instruction ID: 50a86152909a91997acc83c658eb82fed6feeb777e5cda55a929a27d0e2c6c98
Opcode Fuzzy Hash: e39ae25b7135d9233c95ba800d0747df3a696263b20b9290d9415ebe874ba759
Instruction Fuzzy Hash: FD21657191DA899FD381DB289455725BFE0FF9A380F4409AAE08DC72B3DA24A844C712

Function 00007FF88B535ACD Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afd479738acaefca9cc0edfc41684f0d2c4d689997b447f51a5074b5a4a2a00
Instruction ID: 5934beab991c00d35d30d1eea772af998e5581d418134337a42bcfc2f2b255a3
Opcode Fuzzy Hash: 4afd479738acaefca9cc0edfc41684f0d2c4d689997b447f51a5074b5a4a2a00
Instruction Fuzzy Hash: 0581CD3061CBC88FD791EB28C495B5ABBE1FF9A340F5545A9E08DC7262DB34E844CB12

Function 00007FF88B530AF8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952555e7cf574c3559d5fa8bc4493c48e2bfe5ada477dc515184a6afb8fb298f
Instruction ID: 7c7541a9dc00afc919d5c3666485b4e8c0bd6ac3f0b7590947bb39f04aa35d07
Opcode Fuzzy Hash: 952555e7cf574c3559d5fa8bc4493c48e2bfe5ada477dc515184a6afb8fb298f
Instruction Fuzzy Hash: 51716170918A8D8FEBA1DF28C854BE97BE1FF5A340F544066E84DC72A2DB78D944CB01

Function 00007FF88B530C00 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b2ad9015035c220477647f1e2b1f5647ef3e60cbd61973a815b24a9cd7797a
Instruction ID: 44ecf0c43854e7417574b15721d21d03ae39c4640540722dd2b187f55818c8d2
Opcode Fuzzy Hash: 90b2ad9015035c220477647f1e2b1f5647ef3e60cbd61973a815b24a9cd7797a
Instruction Fuzzy Hash: C351C770A18A8D8FEBA4EF6CC898BE977E1FF59341F544065E80DC7262DA34A941CB01

Function 00007FF88B5311B9 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7547498340ebdba567be94715ef3d78f26b0345bdd5e03d14f9ad3d2ed8f1e2b
Instruction ID: 6deadad2fb64e0b50793ffad92b97410928d36d33926e28b6c76e5a1f9ae12f1
Opcode Fuzzy Hash: 7547498340ebdba567be94715ef3d78f26b0345bdd5e03d14f9ad3d2ed8f1e2b
Instruction Fuzzy Hash: 3D41B46194C98E5FEB81EF28CC917E93BE1FF5A380F4501A6E84DC72A3DA64E845C741

Function 00007FF88B53077D Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4dc3adb435f167808a4dfef3f956a42e77fbb6091d931d2ba3c2b8a87999ebb
Instruction ID: 7621c7eb7aac07a3435bb96932cef4b2e7dba24e671e1bcfde8e038ea5843886
Opcode Fuzzy Hash: c4dc3adb435f167808a4dfef3f956a42e77fbb6091d931d2ba3c2b8a87999ebb
Instruction Fuzzy Hash: 04417370919A8D9FEB81EF68C851BA87BE1FF5A340F8514A5F449C72A3DA78E840C741

Function 00007FF88B530179 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934c54e2627de85245da27f3e983477bb4e604e47df6af975403f93ebab4e765
Instruction ID: aaa992a9bab59598150029bfc7f6ffd36d626fbd6d413746a677dfdca3a80a25
Opcode Fuzzy Hash: 934c54e2627de85245da27f3e983477bb4e604e47df6af975403f93ebab4e765
Instruction Fuzzy Hash: 9A01C461C5CACE5FEB01AF249C517F93BA0FF5B280F4804A6E44DDB2A3DA28A505C351

Function 00007FF88B3EA0C1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433260012.00007FF88B3EA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B3EA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b3ea000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0439df506c063a7ae3b6bab11ad0799d1448a1deb852ed6d09963c368ff16b
Instruction ID: f401f3e78be5d1567bc2d7413a4b1bf4ede846a6403592e7ce99a88d46681f64
Opcode Fuzzy Hash: bf0439df506c063a7ae3b6bab11ad0799d1448a1deb852ed6d09963c368ff16b
Instruction Fuzzy Hash: 56116D3250CE088FDBA8EF6EE886D5277E0FB98360710059BD409C7566D631F895CB91

Function 00007FF88B5303F1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eab1a439cfe8a2a4382ad7ddc3014df76bbbde2a9888ed667419355c611c299
Instruction ID: f9cc42b1ad14f91babf28dfe1bf534b533082318d250bcf8e37719887561ad01
Opcode Fuzzy Hash: 4eab1a439cfe8a2a4382ad7ddc3014df76bbbde2a9888ed667419355c611c299
Instruction Fuzzy Hash: EE01756194DBC95FE381DB1C88047257FE0FF9A280F4905AAE0CCC73B3D6289945C712

Non-executed Functions

Function 00007FF88B535E69 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2433488195.00007FF88B530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF88B530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff88b530000_ExpressVideoConverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f56de75a46d6a2dfa2b181a58b8c649d3a40c34e690d8e1eb770e8acc7792e2
Instruction ID: 8bc9dff465f9276f556ab89a7e84cd81a737688f427709c262463cba0f65fde7
Opcode Fuzzy Hash: 0f56de75a46d6a2dfa2b181a58b8c649d3a40c34e690d8e1eb770e8acc7792e2
Instruction Fuzzy Hash: 2B71FC3461D7898FD791EB28C455B6ABBE0FF9A341F4409ADE0C9C72A2CA24D944CB13

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ExpressVideoConverter.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: ExpressVideoConverter.exePID: 6464, Parent PID: 496

General

File Activities

File Opened

File Created

File Read

File Attributes Queried

Volume Information Queried

Windows Analysis Report
ExpressVideoConverter.exe