Windows Analysis Report
fcl52nBWuY.exe

Overview

General Information

Sample name: fcl52nBWuY.exe
renamed because original name is a hash value
Original sample name: 86549cf9c343d0533ef80be2f080a7e3c38c77a1dfbde0a2f89048127979ec2a.exe
Analysis ID: 1522691
MD5: f80c1317f5043d991a91e5fb6399e658
SHA1: b62f2cfb8d9856dd59416675bc5d0bfaa748a1be
SHA256: 86549cf9c343d0533ef80be2f080a7e3c38c77a1dfbde0a2f89048127979ec2a
Tags: exeUAC-0099user-JAMESWT_MHT
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
File is packed with WinRar
Found evasive API chain (date check)
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious LNK Double Extension File Created
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: fcl52nBWuY.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: fcl52nBWuY.exe ReversingLabs: Detection: 65%
Uses 32bit PE files
Source: fcl52nBWuY.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: fcl52nBWuY.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fcl52nBWuY.exe
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_0004BA94
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005D410 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_0005D410
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0006C4F8 FindFirstFileExA, 0_2_0006C4F8
Contains functionality to call native functions
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005B080 SetWindowLongW,NtdllDefWindowProc_W, 0_2_0005B080
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00047AAF: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 0_2_00047AAF
Detected potential crypto function
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000492C6 0_2_000492C6
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00057DCC 0_2_00057DCC
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00055001 0_2_00055001
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00058243 0_2_00058243
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00055272 0_2_00055272
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00066298 0_2_00066298
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000502F7 0_2_000502F7
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000513F6 0_2_000513F6
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005741E 0_2_0005741E
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000664C7 0_2_000664C7
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000555A0 0_2_000555A0
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0006E5F0 0_2_0006E5F0
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000507A0 0_2_000507A0
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004D833 0_2_0004D833
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005889F 0_2_0005889F
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004395A 0_2_0004395A
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00044A8E 0_2_00044A8E
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0006EA9E 0_2_0006EA9E
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00072BA4 0_2_00072BA4
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004FCCC 0_2_0004FCCC
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00042EB6 0_2_00042EB6
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: String function: 00060790 appears 31 times
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: String function: 0005FEEC appears 42 times
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: String function: 0005FFC0 appears 56 times
Sample file is different than original file name gathered from version info
Source: fcl52nBWuY.exe, 00000000.00000003.1445859652.00000000032DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameD3D10Warp.dllj% vs fcl52nBWuY.exe
Source: fcl52nBWuY.exe, 00000000.00000003.1444405246.00000000032DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameD3D10Warp.dllj% vs fcl52nBWuY.exe
Source: fcl52nBWuY.exe, 00000000.00000003.1446310731.00000000032DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameD3D10Warp.dllj% vs fcl52nBWuY.exe
Source: fcl52nBWuY.exe, 00000000.00000003.1445469986.00000000032DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameD3D10Warp.dllj% vs fcl52nBWuY.exe
Source: fcl52nBWuY.exe, 00000000.00000002.1455282468.00000000032DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameD3D10Warp.dllj% vs fcl52nBWuY.exe
Uses 32bit PE files
Source: fcl52nBWuY.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal56.winEXE@1/1@0/0
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00047727 GetLastError,FormatMessageW, 0_2_00047727
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005B0BE CLSIDFromString,CoCreateInstance, 0_2_0005B0BE
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005B6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_0005B6C2
Source: C:\Users\user\Desktop\fcl52nBWuY.exe File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_4905281 Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Command line argument: sfxname 0_2_0005F04C
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Command line argument: sfxstime 0_2_0005F04C
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Command line argument: STARTDLG 0_2_0005F04C
Source: fcl52nBWuY.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\fcl52nBWuY.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: fcl52nBWuY.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\fcl52nBWuY.exe File read: C:\Users\user\Desktop\fcl52nBWuY.exe Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dxgidebug.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: fcl52nBWuY.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: fcl52nBWuY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fcl52nBWuY.exe
Source: fcl52nBWuY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: fcl52nBWuY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: fcl52nBWuY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: fcl52nBWuY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: fcl52nBWuY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
File is packed with WinRar
Source: C:\Users\user\Desktop\fcl52nBWuY.exe File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_4905281 Jump to behavior
PE file contains sections with non-standard names
Source: fcl52nBWuY.exe Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000607E0 push ecx; ret 0_2_000607F3
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005FEEC push eax; ret 0_2_0005FF0A
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Memory allocated: 79A0000 memory reserve | memory write watch Jump to behavior
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Evasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_0004BA94
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005D410 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_0005D410
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0006C4F8 FindFirstFileExA, 0_2_0006C4F8
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005F81F VirtualQuery,GetSystemInfo, 0_2_0005F81F
Source: fcl52nBWuY.exe, 00000000.00000002.1455074358.0000000003271000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\fcl52nBWuY.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000609FA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000609FA
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000691A0 mov eax, dword ptr fs:[00000030h] 0_2_000691A0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0006D1E0 GetProcessHeap, 0_2_0006D1E0
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_000609FA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_000609FA
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00060B8D SetUnhandledExceptionFilter, 0_2_00060B8D
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00060D7A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00060D7A
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00064FDF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00064FDF
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_00060816 cpuid 0_2_00060816
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_0005C083
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0005F04C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle, 0_2_0005F04C
Source: C:\Users\user\Desktop\fcl52nBWuY.exe Code function: 0_2_0004C365 GetVersionExW, 0_2_0004C365
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1522691 Sample: fcl52nBWuY.exe Startdate: 30/09/2024 Architecture: WINDOWS Score: 56 7 Antivirus / Scanner detection for submitted sample 2->7 9 Multi AV Scanner detection for submitted file 2->9 5 fcl52nBWuY.exe 17 2->5         started        process3
⊘No contacted IP infos