Windows Analysis Report
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Overview

General Information

Sample name:	1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
Analysis ID:	1525927
MD5:	4e9ff90c6ded1a8c1e1eb52006a0a8dc
SHA1:	192055ae0a6398531b4ed2b998abf33b172c607b
SHA256:	f80400459be849fddbd8eab9d922d356e289d23c13af4f49e09a8b7df4f41b17
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

AI detected suspicious sample

Machine Learning detection for sample

PE file has a writeable .text section

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to read the PEB

Found potential string decryption / allocating functions

One or more processes crash

PE file does not import any functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

PE file has a writeable .text section

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Code function: String function: 00404778 appears 32 times

One or more processes crash

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204

PE file does not import any functions

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: No import functions for PE file found

Uses 32bit PE files

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6072

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\829167bd-126e-43a6-8e55-464957240845

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe "C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe"
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Section loaded: apphelp.dll

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040AD12 push eax; retf	1_2_0040AD13
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040A5F7 pushad ; iretd	1_2_0040A5F8
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_00406670 pushfd ; ret	1_2_00406671
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040667F pushfd ; ret	1_2_00406680
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040668E pushfd ; ret	1_2_0040668F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Code function: 1_2_0041A57E mov eax, dword ptr fs:[00000030h]

1_2_0041A57E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe PID: 6072, type: MEMORYSTR

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1525927
Product:	CloudBasic
Start time:	16:41:10
Start date:	04.10.2024
Sample:	1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	4e9ff90c6ded1a8c1e1eb52006a0a8dc
SHA1:	192055ae0a6398531b4ed2b998abf33b172c607b
SHA256:	f80400459be849fddbd8eab9d922d356e289d23c13af4f49e09a8b7df4f41b17
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1728051010049c89_8378edbd9a5ae273677a90ea09276385aff130_85a4951b_66965332-0ad7-4bee-8a71-5a777a0a9dcb\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9F1BD2715668F97C5B4427B2A895241A	DA86A9D0DA72B78E5F5393445BB2E170FB1CC84C	F90FFAEF0294043BD86D8FA429FDE976C04D38E338030F1B0E95865E8451C90A
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4088.tmp.dmp	Mini DuMP crash report, 14 streams, Fri Oct 4 14:42:44 2024, 0x1205a4 type	F85D5AFE6FDB1D575365319F4707DCD4	D956FEA6239D21A0039694F5DCC19300CBD569FB	C9BB28BBF95D59E2FF4598187EAC9C55FD821D4883AAC54F544CB09E5D11D7DD
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4154.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	D1BEF527C49739DFBC61D2AD94050494	DBC6873DDAA33FA99F1DEF62EDB4474C24CD4924	119748433D48AFC8F05FB371F099CBFA31A80D1682CA1F69753252114EC62C0C
C:\ProgramData\Microsoft\Windows\WER\Temp\WER425F.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	8C26C99609BA2D316E0D592B9262170A	0DCF88F22D9BF83370B948BBD9E1F30861E2213D	89D9C2EBF9C511EA8B42C8B0F337C5305EBE3A473A0800524C0807AE2C2AEA15
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	AC1E75E2E0623B63B27226EECE11820F	64A37BD08113C4F9F85389BD8C1059D1DE217F0B	4D346C47FACAE9C0A1091CEF6EA98D7FC680ED875C27C495828917A48DA5A6C1

Windows Analysis Report
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe