Edit tour

Windows Analysis Report
3.dll

Overview

General Information

Sample name:	3.dll
Analysis ID:	1524657
MD5:	9e4e3ae279401f9e0b2d2818d422081d
SHA1:	ae134efc864b5b8af1c7d2dee50c8542521ff109
SHA256:	93fca55f68b6d490087850b8f321f108ca4aa193ee8312b3c6bcf727828e965d
Tags:	dllMekotiouser-Merlax_
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Hides threads from debuggers

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Switches to a custom stack to bypass stack traces

Tries to evade analysis by execution special instruction (VM detection)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4916 cmdline: loaddll32.exe "C:\Users\user\Desktop\3.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 4256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6192 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\3.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 3576 cmdline: rundll32.exe "C:\Users\user\Desktop\3.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3608 cmdline: rundll32.exe C:\Users\user\Desktop\3.dll,TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6420 cmdline: rundll32.exe C:\Users\user\Desktop\3.dll,__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1408 cmdline: rundll32.exe C:\Users\user\Desktop\3.dll,b1oc1ab00u045627q07f MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 736 cmdline: rundll32.exe "C:\Users\user\Desktop\3.dll",TMethodImplementationIntercept MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5360 cmdline: rundll32.exe "C:\Users\user\Desktop\3.dll",__dbk_fcall_wrapper MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7036 cmdline: rundll32.exe "C:\Users\user\Desktop\3.dll",b1oc1ab00u045627q07f MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1352 cmdline: rundll32.exe "C:\Users\user\Desktop\3.dll",dbkFCallWrapperAddr MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3.dll

Avira: detected

Multi AV Scanner detection for domain / URL

Source: strogonoff.xyz

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for submitted file

Source: 3.dll	ReversingLabs: Detection: 13%
Source: 3.dll	Virustotal: Detection: 23%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: 3.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Performs DNS queries to domains with low reputation

Source:

DNS query: strogonoff.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: paradoxine.sbs
Source: global traffic	DNS traffic detected: DNS query: strogonoff.xyz
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdfS
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdfU
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdfS
Source: 3.dll	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: loaddll32.exe, 00000000.00000003.3489486246.0000000004B2A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000617A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005F0A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4008990503.00000000060AA000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/http/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/#
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/SV
Source: rundll32.exe, 00000004.00000002.4072050972.0000000005DD5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4107198361.0000000006685000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.4123516856.00000000058A5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.4071921649.0000000005D45000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008436389.0000000005ED5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000005FEA000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.4070707435.00000000060B5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://tempuri.org/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://tempuri.org/U
Source: rundll32.exe, 0000000A.00000002.4008990503.0000000006094000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/iY
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://tools.ietf.org/html/rfc1321
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://tools.ietf.org/html/rfc4648S
Source: rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.000000000608D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: rundll32.exe, 0000000A.00000002.4008990503.0000000006017000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types-IAppServerSOAP
Source: rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.borland.com/namespaces/Types-IAppServerSOAPU
Source: loaddll32.exe, 00000000.00000003.3489486246.0000000004A97000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.00000000060E7000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005E77000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types-IAppServerSOAPq
Source: rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000006017000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.borland.com/namespaces/Types-IWSDLPublish
Source: loaddll32.exe, 00000000.00000003.3489486246.0000000004B0D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000615D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesA
Source: loaddll32.exe, 00000000.00000003.3489486246.0000000004B0D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000615D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesa
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.borland.com/rootpart.xml
Source: 3.dll	String found in binary or memory: http://www.componentace.com
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdfS
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.ietf.org/rfc/rfc3447.txtS
Source: loaddll32.exe, 00000000.00000003.3489486246.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000003.2218000145.00000000060E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005E70000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000006010000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.indyproject.org/
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.itl.nist.gov/fipspubs/fip180-1.htm
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.movable-type.co.uk/scripts/xxtea.pdfS
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.schneier.com/paper-blowfish-fse.htmlS
Source: rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	String found in binary or memory: http://www.schneier.com/paper-twofish-paper.pdfS

System Summary

PE file contains section with special chars

Source: 3.dll	Static PE information: section name: ,V8h(]j
Source: 3.dll	Static PE information: section name: 2Oi.bZ"
Source: 3.dll	Static PE information: section name: -1T<]EC
Source: 3.dll	Static PE information: section name: gPH9iZ]
Source: 3.dll	Static PE information: section name: o8`CYVL)
Source: 3.dll	Static PE information: section name: :87,Pg0>
Source: 3.dll	Static PE information: section name: 4&WkOMbO
Source: 3.dll	Static PE information: section name: [m(rRncT
Source: 3.dll	Static PE information: section name: aR_M S9
Source: 3.dll	Static PE information: section name: N2D,95K
Source: 3.dll	Static PE information: section name: JlJ T26
Source: 3.dll	Static PE information: section name: X=<];BL+

Source: 3.dll

Static PE information: Number of sections : 13 > 10

Source: 3.dll

Binary or memory string: OriginalFileName vs 3.dll

Source: 3.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal96.troj.evad.winDLL@20/0@3/0

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\b1oc1ab00u045627q07f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4256:120:WilError_03

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",#1

Source: 3.dll	ReversingLabs: Detection: 13%
Source: 3.dll	Virustotal: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\3.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\3.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,b1oc1ab00u045627q07f
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",TMethodImplementationIntercept
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",__dbk_fcall_wrapper
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",b1oc1ab00u045627q07f
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",dbkFCallWrapperAddr
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\3.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\3.dll,b1oc1ab00u045627q07f	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",TMethodImplementationIntercept	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",__dbk_fcall_wrapper	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",b1oc1ab00u045627q07f	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",dbkFCallWrapperAddr	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: 3.dll

Static file information: File size 25784320 > 1048576

Source: 3.dll	Static PE information: Raw size of ,V8h(]j is bigger than: 0x100000 < 0x510c00
Source: 3.dll	Static PE information: Raw size of 0VRn0YJr is bigger than: 0x100000 < 0x98aa00
Source: 3.dll	Static PE information: Raw size of N2D,95K is bigger than: 0x100000 < 0x934000

Source: initial sample

Static PE information: section where entry point is pointing to: N2D,95K

Source: 3.dll	Static PE information: section name: ,V8h(]j
Source: 3.dll	Static PE information: section name: 2Oi.bZ"
Source: 3.dll	Static PE information: section name: -1T<]EC
Source: 3.dll	Static PE information: section name: gPH9iZ]
Source: 3.dll	Static PE information: section name: o8`CYVL)
Source: 3.dll	Static PE information: section name: :87,Pg0>
Source: 3.dll	Static PE information: section name: 4&WkOMbO
Source: 3.dll	Static PE information: section name: [m(rRncT
Source: 3.dll	Static PE information: section name: 0VRn0YJr
Source: 3.dll	Static PE information: section name: aR_M S9
Source: 3.dll	Static PE information: section name: N2D,95K
Source: 3.dll	Static PE information: section name: JlJ T26
Source: 3.dll	Static PE information: section name: X=<];BL+

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 4916 base: 13E0007 value: E9 EB DF FD 75	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 4916 base: 773BDFF0 value: E9 1E 20 02 8A	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 3608 base: 35B0007 value: E9 EB DF E0 73	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 3608 base: 773BDFF0 value: E9 1E 20 1F 8C	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 6420 base: 2D50007 value: E9 EB DF 66 74	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 6420 base: 773BDFF0 value: E9 1E 20 99 8B	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 1408 base: 510007 value: E9 EB DF EA 76	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 1408 base: 773BDFF0 value: E9 1E 20 15 89	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 5360 base: 2A30007 value: E9 EB DF 98 74	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 5360 base: 773BDFF0 value: E9 1E 20 67 8B	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7036 base: 2AD0007 value: E9 EB DF 8E 74	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7036 base: 773BDFF0 value: E9 1E 20 71 8B	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2938FB0
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2E3C81F
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2E297E9
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 269395B
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2752D75
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2785812
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2777AE9
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 28120A2
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 274C188
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2E5D978
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 27F15DC
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 2EA6987

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Windows\System32\loaddll32.exe

Special instruction interceptor: First address: 281D61F instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 0000000A.00000002.3998007562.0000000002CAA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq

Source: C:\Windows\System32\loaddll32.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\System32\loaddll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\3.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Rundll32	1 Credential API Hooking	311 Security Software Discovery	Remote Services	1 Credential API Hooking	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3.dll	13%	ReversingLabs
3.dll	24%	Virustotal		Browse
3.dll	100%	Avira	HEUR/AGEN.1327619

Source	Detection	Scanner	Link
strogonoff.xyz	7%	Virustotal	Browse
paradoxine.sbs	0%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://www.borland.com/namespaces/Types-IWSDLPublish	0%	Virustotal		Browse
http://tempuri.org/iY	1%	Virustotal		Browse
http://www.borland.com/rootpart.xml	0%	Virustotal		Browse
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf	0%	Virustotal		Browse
http://tempuri.org/	0%	Virustotal		Browse
http://www.schneier.com/paper-blowfish-fse.htmlS	0%	Virustotal		Browse
http://tools.ietf.org/html/rfc1321	0%	Virustotal		Browse
http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdfS	0%	Virustotal		Browse
http://tools.ietf.org/html/rfc4648S	0%	Virustotal		Browse
http://www.borland.com/namespaces/TypesA	0%	Virustotal		Browse
http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdfS	0%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/soap/	0%	Virustotal		Browse
http://www.borland.com/namespaces/Types-IAppServerSOAP	0%	Virustotal		Browse
http://www.borland.com/namespaces/Types-IAppServerSOAPq	0%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/soap12/SV	0%	Virustotal		Browse
http://www.itl.nist.gov/fipspubs/fip180-1.htm	0%	Virustotal		Browse
http://www.borland.com/namespaces/Types	0%	Virustotal		Browse
http://www.movable-type.co.uk/scripts/xxtea.pdfS	0%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/http/	0%	Virustotal		Browse
http://tempuri.org/U	1%	Virustotal		Browse
http://www.schneier.com/paper-twofish-paper.pdfS	0%	Virustotal		Browse
http://schemas.xmlsoap.org/soap/http	0%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/soap/#	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strogonoff.xyz	141.98.169.154	true	true	7%, Virustotal, Browse	unknown
paradoxine.sbs	95.164.37.66	true	false	0%, Virustotal, Browse	unknown
pastebin.com	104.20.3.235	true	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.borland.com/namespaces/Types-IWSDLPublish	rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000006017000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/encoding/	loaddll32.exe, 00000000.00000003.3489486246.0000000004B2A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000617A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005F0A000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4008990503.00000000060AA000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	URL Reputation: safe	unknown
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf	3.dll	false	0%, Virustotal, Browse	unknown
http://tools.ietf.org/html/rfc1321	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/envelope/	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	URL Reputation: safe	unknown
http://www.borland.com/rootpart.xml	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://tempuri.org/iY	rundll32.exe, 0000000A.00000002.4008990503.0000000006094000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://www.schneier.com/paper-blowfish-fse.htmlS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://tempuri.org/	rundll32.exe, 00000004.00000002.4072050972.0000000005DD5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4107198361.0000000006685000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.4123516856.00000000058A5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.4071921649.0000000005D45000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008436389.0000000005ED5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000005FEA000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.4070707435.00000000060B5000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdfS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.indyproject.org/	loaddll32.exe, 00000000.00000003.3489486246.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000003.2218000145.00000000060E0000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005E70000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.0000000006010000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	URL Reputation: safe	unknown
http://tools.ietf.org/html/rfc4648S	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.borland.com/namespaces/Types-IAppServerSOAPq	loaddll32.exe, 00000000.00000003.3489486246.0000000004A97000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.00000000060E7000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005E77000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/soap12/SV	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.itl.nist.gov/fipspubs/fip180-1.htm	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdfS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/soap/	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.borland.com/namespaces/TypesA	loaddll32.exe, 00000000.00000003.3489486246.0000000004B0D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000615D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.borland.com/namespaces/Types-IAppServerSOAP	rundll32.exe, 0000000A.00000002.4008990503.0000000006017000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.movable-type.co.uk/scripts/xxtea.pdfS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.borland.com/namespaces/Types	rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.4008990503.000000000608D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/http	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/soap/#	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://www.schneier.com/paper-twofish-paper.pdfS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/http/	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	0%, Virustotal, Browse	unknown
http://tempuri.org/U	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false	URL Reputation: safe	unknown
http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdfU	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false		unknown
http://www.componentace.com	3.dll	false		unknown
http://schemas.xmlsoap.org/wsdl/mime/	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false		unknown
http://www.borland.com/namespaces/Types-IAppServerSOAPU	rundll32.exe, 00000004.00000002.3997706734.0000000004AE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000005390000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000045B0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004A50000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.0000000004BE0000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.0000000004DC0000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false		unknown
http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdfS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false		unknown
http://www.borland.com/namespaces/Typesa	loaddll32.exe, 00000000.00000003.3489486246.0000000004B0D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2218000145.000000000615D000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3964928757.0000000005EED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.ietf.org/rfc/rfc3447.txtS	rundll32.exe, 00000004.00000002.3997706734.00000000045D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3998043142.0000000004E81000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000007.00000002.3998033139.00000000040A1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.3997902066.0000000004541000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.3999333385.00000000046D1000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.3997674723.00000000048B1000.00000020.00000001.01000000.00000003.sdmp, 3.dll	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524657
Start date and time:	2024-10-03 03:38:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3.dll
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@20/0@3/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paradoxine.sbs	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	95.164.37.66
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	95.164.37.66
	FETBMCbtmD.mup.dll	Get hash	malicious	Unknown	Browse	95.164.37.66
pastebin.com	5.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	dropbox.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	dropbox.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	104.20.3.235
	q71n2VrEY3.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	lvHIHLt0b2.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	envifa.vbs	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win32.MalwareX-gen.14926.30373.exe	Get hash	malicious	MicroClip	Browse	104.20.4.235
	AS5AB7c08n.exe	Get hash	malicious	MicroClip	Browse	172.67.19.24
strogonoff.xyz	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	141.98.169.154
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	141.98.169.154
	FETBMCbtmD.mup.dll	Get hash	malicious	Unknown	Browse	141.98.169.154

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.3914599455310785
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40% Win16/32 Executable Delphi generic (2074/23) 0.21% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3.dll
File size:	25'784'320 bytes
MD5:	9e4e3ae279401f9e0b2d2818d422081d
SHA1:	ae134efc864b5b8af1c7d2dee50c8542521ff109
SHA256:	93fca55f68b6d490087850b8f321f108ca4aa193ee8312b3c6bcf727828e965d
SHA512:	efa0763296dd3a46c51132527c07fa70dc362b3914ca7ba241f7457b908fcab1b7f0c1dce7964f7fb40b8d5cb75b8c4673ec38b4f12c3d14d2450687e55fea4b
SSDEEP:	196608:lqOlK4t0Zss6yDdAV8EZGKUJe4fHdIpPSaPh9/C6bks9DwwGR1/RtjFGWZw/hhN0:lql4+as6Qw3Ujfbqs/5IdJxwi1Z
TLSH:	0A470257B68A80FEC0820D79863BE7D2163BF67119068C677BC0290C5F71EB1663E697
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x14e3427
Entrypoint Section:	N2D,95K
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x66FDCD03 [Wed Oct 2 22:45:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9a6d12fce3bb7f25c3b57d1fb6ad19d7

Entrypoint Preview

Instruction
push ebx
pushfd
mov ebx, A32141B0h
lea ebx, dword ptr [8484098Dh+ebx*4]
shr ebx, 14h
lea ebx, dword ptr [F6997D88h+ebx*8]
mov ebx, dword ptr [esp+ebx*8+4B33CFC4h]
mov dword ptr [esp+04h], 4E6C29D8h
push dword ptr [esp+00h]
popfd
lea esp, dword ptr [esp+04h]
call 00007F89F9683B97h
inc ecx
ror ch, 1
call 00007F89F9AE5688h
sar cl, FFFFFFE3h
dec edx
mov ebx, dword ptr [esp+08h]
dec edx
mov dword ptr [esp+08h], 32162B17h
inc esp
movsx edx, al
inc esp
movsx eax, dl
dec ebp
arpl bp, bp
pop esi
dec ecx
add edi, ebp
inc cx
sal ecx, cl
inc cx
xadd ecx, ecx
inc ecx
mov eax, dword ptr [esp+ebp]
inc ecx
inc dl
inc ecx
push eax
dec esi
lea eax, dword ptr [esp+000000D4h]
inc ecx
btr esp, 25h
inc ebx
mov dword ptr [esp+eax], eax
inc ecx
mov ebp, 018E879Ah
dec esi
lea eax, dword ptr [esp+68h]
dec edx
sub dword ptr [esp+08h], esi
dec esp
lea esi, dword ptr [ecx+21B01890h]
dec edi
mov ecx, dword ptr [esp+eax]
inc ecx
bts edi, FFFFFFADh
dec esi
mov dword ptr [ebp-04h], ecx
inc esp
xadd esi, edx
dec edx
lea esi, dword ptr [1F98F92Dh+edi*2]
dec ecx
lea ebp, dword ptr [esp+ebp-04h]
inc esi
movzx eax, word ptr [esp+03h]
pop esi
inc ecx
pop ebp
jbe 00007F89F9B64606h
inc ecx
dec al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x543000	0xbe	4&WkOMbO
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17de85c	0x168	N2D,95K
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1805000	0x2ed54	JlJ T26
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1834000	0x746f8	X=<];BL+
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xed0000	0x8c	aR_M S9
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xf7af2c	0x1e0	N2D,95K
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
,V8h(]j	0x1000	0x510ad8	0x510c00	bfb7d0dba95f4e0c6f491bbb2a76197d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
2Oi.bZ"	0x512000	0x40ac	0x4200	a1583c9198a13e830acda224006c8b90	False	0.4950875946969697	data	6.076925604998549	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
-1T<]EC	0x517000	0x1a59c	0x1a600	0e94d09bd88e2a04a000615ad7347609	False	0.4634737855450237	data	6.751263581985054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gPH9iZ]	0x532000	0xa080	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
o8`CYVL)	0x53d000	0x4240	0x4400	ddfc43336e843f68a0cccead079adb3b	False	0.9511144301470589	data	7.81430795283375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
:87,Pg0>	0x542000	0xd7c	0xe00	734a3c1d3e7a6ebc0958b92a8966d4cd	False	0.3443080357142857	data	4.287121561304592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4&WkOMbO	0x543000	0xbe	0x200	f26463f99406a9878c1cb149384d34f2	False	0.328125	data	2.384639178597468	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
[m(rRncT	0x544000	0x45	0x200	4ae75964954652113b5bc6e6bf8e2eec	False	0.158203125	ASCII text, with no line terminators	1.1775367479159162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0VRn0YJr	0x545000	0x98a8b6	0x98aa00	bd5ee95c033f08f2a20f82e91579c6be	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
aR_M S9	0xed0000	0xa4	0x200	784801326915359943ad0109105dbf33	False	0.193359375	data	1.2022146162546936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
N2D,95K	0xed1000	0x933e40	0x934000	103decbea7eaba79a41d16a1dc2cfcc4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
JlJ T26	0x1805000	0x2ed54	0x2ee00	a199f6d6efb15bfdaf143e101e2af2ee	False	0.22091145833333334	data	5.250419495997808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
X=<];BL+	0x1834000	0x746f8	0x74800	459e1c87d9562cc04c70549cc3d26f80	False	0.5586188975321889	data	6.720500604160903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x18075cc	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1807700	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x1807834	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x1807968	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x1807a9c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x1807bd0	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x1807d04	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0x1807e38	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1807f6c	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x18080a0	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x18081d4	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1808308	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x180843c	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1808570	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x18086a4	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x18087d8	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x180890c	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1808a40	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1808b74	0x134	data	Portuguese	Brazil	0.12012987012987013
RT_CURSOR	0x1808ca8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_BITMAP	0x1808ddc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x1808fac	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x1809190	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x1809360	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x1809530	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x1809700	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x18098d0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x1809aa0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x1809c70	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x1809e40	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x180a010	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0x180a0d0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0x180a1b0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0x180a290	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0x180a370	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0x180a430	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0x180a4f0	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0x180a5d0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0x180a690	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0x180a770	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0x180a830	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_STRING	0x180a910	0x3e8	data			0.4
RT_STRING	0x180acf8	0x538	data			0.34505988023952094
RT_STRING	0x180b230	0x654	data			0.2580246913580247
RT_STRING	0x180b884	0xa38	data			0.27446483180428133
RT_STRING	0x180c2bc	0x974	data			0.2756198347107438
RT_STRING	0x180cc30	0x50c	data			0.34365325077399383
RT_STRING	0x180d13c	0x440	data			0.4108455882352941
RT_STRING	0x180d57c	0x46c	data			0.39399293286219084
RT_STRING	0x180d9e8	0x3f0	data			0.38591269841269843
RT_STRING	0x180ddd8	0x488	data			0.30689655172413793
RT_STRING	0x180e260	0x494	data			0.32849829351535836
RT_STRING	0x180e6f4	0x604	data			0.30324675324675326
RT_STRING	0x180ecf8	0x414	data			0.407088122605364
RT_STRING	0x180f10c	0x31c	data			0.46608040201005024
RT_STRING	0x180f428	0x43c	data			0.34870848708487084
RT_STRING	0x180f864	0x768	data			0.36550632911392406
RT_STRING	0x180ffcc	0x438	data			0.39814814814814814
RT_STRING	0x1810404	0x4c4	data			0.37540983606557377
RT_STRING	0x18108c8	0x44c	data			0.3927272727272727
RT_STRING	0x1810d14	0x574	data			0.37822349570200575
RT_STRING	0x1811288	0x3f4	data			0.4150197628458498
RT_STRING	0x181167c	0xe04	data			0.24442586399108138
RT_STRING	0x1812480	0xb40	data			0.2635416666666667
RT_STRING	0x1812fc0	0xae4	data			0.3134863701578192
RT_STRING	0x1813aa4	0x8ac	data			0.3063063063063063
RT_STRING	0x1814350	0x798	data			0.2890946502057613
RT_STRING	0x1814ae8	0x4d0	data			0.4082792207792208
RT_STRING	0x1814fb8	0x44c	data			0.3836363636363636
RT_STRING	0x1815404	0x4b0	data			0.365
RT_STRING	0x18158b4	0x43c	data			0.39206642066420666
RT_STRING	0x1815cf0	0x3a8	data			0.4230769230769231
RT_STRING	0x1816098	0x3a0	data			0.4040948275862069
RT_STRING	0x1816438	0x40c	data			0.4015444015444015
RT_STRING	0x1816844	0x3f8	data			0.42322834645669294
RT_STRING	0x1816c3c	0x374	data			0.39819004524886875
RT_STRING	0x1816fb0	0x378	data			0.33783783783783783
RT_STRING	0x1817328	0x2e0	data			0.4470108695652174
RT_STRING	0x1817608	0x3ec	data			0.3396414342629482
RT_STRING	0x18179f4	0x3f4	data			0.3824110671936759
RT_STRING	0x1817de8	0x448	data			0.38321167883211676
RT_STRING	0x1818230	0x3e8	data			0.427
RT_STRING	0x1818618	0x134	data			0.6006493506493507
RT_STRING	0x181874c	0xcc	data			0.6764705882352942
RT_STRING	0x1818818	0x23c	data			0.486013986013986
RT_STRING	0x1818a54	0x2a0	data			0.48214285714285715
RT_STRING	0x1818cf4	0x3f4	data			0.3705533596837945
RT_STRING	0x18190e8	0x3b8	data			0.38130252100840334
RT_STRING	0x18194a0	0x560	data			0.32848837209302323
RT_STRING	0x1819a00	0x2b4	data			0.30057803468208094
RT_STRING	0x1819cb4	0x37c	data			0.4327354260089686
RT_STRING	0x181a030	0x49c	data			0.39152542372881355
RT_STRING	0x181a4cc	0x4f8	data			0.39544025157232704
RT_STRING	0x181a9c4	0x404	data			0.3667315175097276
RT_STRING	0x181adc8	0x384	data			0.33666666666666667
RT_STRING	0x181b14c	0x410	data			0.3836538461538462
RT_STRING	0x181b55c	0x2f0	data			0.3896276595744681
RT_STRING	0x181b84c	0xc0	data			0.625
RT_STRING	0x181b90c	0x9c	data			0.6282051282051282
RT_STRING	0x181b9a8	0x380	data			0.4341517857142857
RT_STRING	0x181bd28	0x498	data			0.29336734693877553
RT_STRING	0x181c1c0	0x2f8	data			0.45263157894736844
RT_STRING	0x181c4b8	0x2f0	data			0.3776595744680851
RT_STRING	0x181c7a8	0x3c0	data			0.259375
RT_RCDATA	0x181cb68	0x10	data			1.5
RT_RCDATA	0x181cb78	0x1c24	data			0.5448362021099389
RT_RCDATA	0x181e79c	0x2	data	English	United States	5.0
RT_RCDATA	0x181e7a0	0x556	Delphi compiled form 'Tah1s1zi0j45ibpzqnfsi07j8zl6277i80c2z'			0.5629575402635432
RT_RCDATA	0x181ecf8	0x15b	Delphi compiled form 'Tauip045ybf08p0t03xn6sn37o9rh381n7h18dad'			0.7348703170028819
RT_RCDATA	0x181ee54	0x100a	Delphi compiled form 'Tbcjm9zs1p0il4350yjd1hcy3m0pdra5hq85'			0.29201169020944956
RT_RCDATA	0x181fe60	0x132	Delphi compiled form 'Tbf9c20s46354qp4up3ex347w31o3ac1854e'			0.7549019607843137
RT_RCDATA	0x181ff94	0x168c	Delphi compiled form 'Tel0a93kfiy4xfu6h1ex021iwsyg'			0.29504504504504503
RT_RCDATA	0x1821620	0x430e	Delphi compiled form 'Tem4k3b0ifeilpk71y3l62l2iz903j0'			0.20866829779797275
RT_RCDATA	0x1825930	0x1490	Delphi compiled form 'Tfy907jem8l3h1i64thb872t0ss8wcgg26d1s74qg'			0.2693768996960486
RT_RCDATA	0x1826dc0	0xadd	Delphi compiled form 'Tgqz106039np0h23wjxj3tlms7ytm3kcgc652f5440'			0.414599065084502
RT_RCDATA	0x18278a0	0x126e	Delphi compiled form 'Tgtzgid10h43t0nfwh09dd745f0c7'			0.31475201356506993
RT_RCDATA	0x1828b10	0x1ded	Delphi compiled form 'Tjk42gmd452t90tr65q2s4mqcpbp20at'			0.4695209502675891
RT_RCDATA	0x182a900	0x455	Delphi compiled form 'Tkhkb1ne8qk46e9516xf0li8am1rese5n1ydak'			0.5536519386834986
RT_RCDATA	0x182ad58	0xcf8	Delphi compiled form 'Tnwrsa168k69lp6py222c5pfl4r7y39i'			0.3545180722891566
RT_RCDATA	0x182ba50	0xf65	Delphi compiled form 'Todp9uq21udd85uja0253xr4c66xn0rl8f'			0.3521948743973611
RT_RCDATA	0x182c9b8	0x1de0	Delphi compiled form 'Tof741gcknpqj4ri8y3o5cp81hs1tub468rer6yjj'			0.26908995815899583
RT_RCDATA	0x182e798	0xba6	Delphi compiled form 'Tpg0x4ew0sz502i1t3epk6j9cj8k87u1j'			0.3876592890677398
RT_RCDATA	0x182f340	0x813	Delphi compiled form 'Tpp5710tq6n652x7ki5bwr75ykugey705q792'			0.49733913884857284
RT_RCDATA	0x182fb54	0x116b	Delphi compiled form 'Trjk7e5615ykye703dn3sy32w28s7c50'			0.3110562906481274
RT_RCDATA	0x1830cc0	0x3a6	Delphi compiled form 'Twy732ql8l5913il7qjkp0n2x3243ah659z1ag28g3'			0.5899357601713062
RT_RCDATA	0x1831068	0x109c	Delphi compiled form 'Txx0iz313wmx49chasfu2f60k7yn6430a'			0.3179680150517404
RT_RCDATA	0x1832104	0x15ac	Delphi compiled form 'Tycnqyr019g40z27r7gc70m21pwa23ce1'			0.2939798125450613
RT_RCDATA	0x18336b0	0x2f9	Delphi compiled form 'Tzg61c95p7p9o4uejp0jaq92x8y5r416mdym'			0.6097240473061761
RT_GROUP_CURSOR	0x18339ac	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.25
RT_GROUP_CURSOR	0x18339c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x18339d4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x18339e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x18339fc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a10	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a24	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a38	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a60	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a74	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a88	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833a9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Portuguese	Brazil	1.3
RT_GROUP_CURSOR	0x1833ab0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1833ac4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1833ad8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1833aec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1833b00	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1833b14	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1833b28	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_VERSION	0x1833b3c	0x218	data	English	United States	0.47574626865671643

Imports

DLL	Import
winmm.dll	PlaySoundW
wininet.dll	InternetCloseHandle
comctl32.dll	FlatSB_SetScrollInfo
shell32.dll	Shell_NotifyIconW
user32.dll	DdeSetUserHandle
version.dll	GetFileVersionInfoSizeW
oleaut32.dll	SafeArrayPutElement
advapi32.dll	RegSetValueExW
netapi32.dll	NetWkstaGetInfo
msvcrt.dll	memcpy
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser
kernel32.dll	GetVersion, GetVersionExW
SHFolder.dll	SHGetFolderPathW
wsock32.dll	gethostbyaddr
ole32.dll	IsAccelerator
gdi32.dll	Pie
ntdll.dll	RtlCompressBuffer

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x46a0b4
__dbk_fcall_wrapper	2	0x412460
b1oc1ab00u045627q07f	4	0x902584
dbkFCallWrapperAddr	1	0x935640

Possible Origin

Language of compilation system	Country where language is spoken	Map
Portuguese	Brazil
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 03:42:55.569783926 CEST	52281	53	192.168.2.6	1.1.1.1
Oct 3, 2024 03:42:55.583667040 CEST	53	52281	1.1.1.1	192.168.2.6
Oct 3, 2024 03:42:55.749996901 CEST	62335	53	192.168.2.6	1.1.1.1
Oct 3, 2024 03:42:55.784858942 CEST	53	62335	1.1.1.1	192.168.2.6
Oct 3, 2024 03:42:57.503473043 CEST	53583	53	192.168.2.6	1.1.1.1
Oct 3, 2024 03:42:57.509912014 CEST	53	53583	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 03:42:55.569783926 CEST	192.168.2.6	1.1.1.1	0x4078	Standard query (0)	paradoxine.sbs	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:55.749996901 CEST	192.168.2.6	1.1.1.1	0x3f0	Standard query (0)	strogonoff.xyz	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:57.503473043 CEST	192.168.2.6	1.1.1.1	0xb942	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 03:42:55.583667040 CEST	1.1.1.1	192.168.2.6	0x4078	No error (0)	paradoxine.sbs	95.164.37.66	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:55.784858942 CEST	1.1.1.1	192.168.2.6	0x3f0	No error (0)	strogonoff.xyz	141.98.169.154	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:57.509912014 CEST	1.1.1.1	192.168.2.6	0xb942	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:57.509912014 CEST	1.1.1.1	192.168.2.6	0xb942	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 3, 2024 03:42:57.509912014 CEST	1.1.1.1	192.168.2.6	0xb942	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	21:39:47
Start date:	02/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\3.dll"
Imagebase:	0xdf0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:39:47
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	21:39:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\3.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	21:39:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\3.dll",#1
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:39:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\3.dll,TMethodImplementationIntercept
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:39:50
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\3.dll,__dbk_fcall_wrapper
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:39:54
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\3.dll,b1oc1ab00u045627q07f
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:40:00
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\3.dll",TMethodImplementationIntercept
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:40:00
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\3.dll",__dbk_fcall_wrapper
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:40:00
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\3.dll",b1oc1ab00u045627q07f
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:40:01
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\3.dll",dbkFCallWrapperAddr
Imagebase:	0x620000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 4916, Parent PID: 4004

General

Chronological Activities

Windows Analysis Report
3.dll