Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
ReversingLabs: Detection: 50% |
Source: Submited Sample |
Integrated Neural Analysis Model: Matched 99.6% probability |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_0040687E FindFirstFileW,FindClose, |
0_2_0040687E |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00405C2D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C2D |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00402910 FindFirstFileW, |
0_2_00402910 |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_004056E5 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, |
0_2_004056E5 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Process Stats: CPU usage > 49% |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_004034FC EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034FC |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00406C3F |
0_2_00406C3F |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_6F941BFF |
0_2_6F941BFF |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000000.2008225620.000000000044C000.00000002.00000001.01000000.00000003.sdmp |
Binary or memory string: OriginalFilenamenygifte.exe4 vs SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Binary or memory string: OriginalFilenamenygifte.exe4 vs SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
Source: classification engine |
Classification label: mal64.troj.evad.winEXE@1/9@0/0 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_004034FC EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034FC |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00404991 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, |
0_2_00404991 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_004021AF CoCreateInstance, |
0_2_004021AF |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
File created: C:\Users\user\polaritets |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
File created: C:\Users\user\AppData\Local\Temp\nsr12B.tmp |
Jump to behavior |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
ReversingLabs: Detection: 50% |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: propsys.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: dwmapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: oleacc.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: ntmarta.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: shfolder.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: riched20.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: usp10.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: msls31.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: textshaping.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: textinputframework.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: coreuicomponents.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: coremessaging.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Section loaded: wintypes.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 |
Jump to behavior |
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
Source: Yara match |
File source: 00000000.00000002.4457010077.00000000069E2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_6F941BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6F941BFF |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_6F9430C0 push eax; ret |
0_2_6F9430EE |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
File created: C:\Users\user\AppData\Local\Temp\nsd4C7.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
RDTSC instruction interceptor: First address: 702C00A second address: 702C00A instructions: 0x00000000 rdtsc 0x00000002 cmp edi, 6691C563h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F18847DDF8Fh 0x0000000c cmp dh, ch 0x0000000e inc ebp 0x0000000f cmp bh, FFFFFFC3h 0x00000012 inc ebx 0x00000013 rdtsc |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd4C7.tmp\System.dll |
Jump to dropped file |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_0040687E FindFirstFileW,FindClose, |
0_2_0040687E |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00405C2D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, |
0_2_00405C2D |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_00402910 FindFirstFileW, |
0_2_00402910 |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
API call chain: ExitProcess graph end node |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_6F941BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, |
0_2_6F941BFF |
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe |
Code function: 0_2_004034FC EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, |
0_2_004034FC |