Windows Analysis Report
Harbor Freight Department.png

Overview

General Information

Sample name: Harbor Freight Department.png
Analysis ID: 1522668
MD5: eeadcea0a9e132e58ee1f1cafaeb4889
SHA1: 66da94f5b8241db5f310d2ad7b8458809487c58e
SHA256: b130965087b4af0207c893a68aa5beebe1120816a1ab6d195d74f4c26156b9cc
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Harbor Freight Department.png Virustotal: Detection: 17% Perma Link
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\mspaint.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: classification engine Classification label: mal48.winPNG@1/0@0/0
Source: C:\Windows\SysWOW64\mspaint.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Harbor Freight Department.png Virustotal: Detection: 17%
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: odbc32.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: wiatrace.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: uiribbonres.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mspaint.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\mspaint.exe TID: 3484 Thread sleep time: -240000s >= -30000s Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\mspaint.exe Queries volume information: C:\Users\user\Desktop\Harbor Freight Department.png VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522668 Sample: Harbor Freight Department.png Startdate: 30/09/2024 Architecture: WINDOWS Score: 48 7 Multi AV Scanner detection for submitted file 2->7 5 mspaint.exe 27 1 2->5         started        process3
⊘No contacted IP infos