Windows Analysis Report
FsJfRO0W9w.exe

ID:	1530950
Product:	CloudBasic
Start time:	18:12:06
Start date:	10.10.2024
Sample:	FsJfRO0W9w.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	efc41a0887fd65246cda9323035f9746
SHA1:	a0280ffadcf844386f7cc656e5f46fb5941e0eae
SHA256:	c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97
Filetype:	Win64 Executable GUI (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256

AV Detection

Source: FsJfRO0W9w.exe

Avira: detected

Source: FsJfRO0W9w.exe

ReversingLabs: Detection: 55%

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.4% probability

Cryptography

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe

Code function: 0_2_00007FF73C2343C0 ?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?copy@QFile@@SA_NAEBVQString@@0@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??0QString@@QEAA@PEBD@Z,?addDatabase@QSqlDatabase@@SA?AV1@AEBVQString@@0@Z,??1QString@@QEAA@XZ,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,?setDatabaseName@QSqlDatabase@@QEAAXAEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QSqlDatabase@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlDatabase@@QEAA@XZ,??1QString@@QEAA@XZ,??1QByteArray@@QEAA@XZ,??0QSqlQuery@@QEAA@AEBVQSqlDatabase@@@Z,??0QString@@QEAA@PEBD@Z,?prepare@QSqlQuery@@QEAA_NAEBVQString@@@Z,??1QString@@QEAA@XZ,?exec@QSqlQuery@@QEAA_NXZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,??1QDebug@@QEAA@XZ,??0QMessageLogger@@QEAA@PEBDH0@Z,?debug@QMessageLogger@@QEBA?AVQDebug@@XZ,??6QDebug@@QEAAAEAV0@PEBD@Z,?lastError@QSqlDatabase@@QEBA?AVQSqlError@@XZ,?text@QSqlError@@QEBA?AVQString@@XZ,??1QString@@QEAA@XZ,??1QSqlError@@QEAA@XZ,??1QDebug@@QEAA@XZ,??1QSqlQuery@@QEAA@XZ,?next@QSqlQuery@@QEAA_NXZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toByteArray@QVariant@@QEBA?AVQByteArray@@XZ,??1QVariant@@QEAA@XZ,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?length@QByteArray@@QEBA_JXZ,?right@QByteArray@@QEGBA?AV1@_J@Z,?left@QByteArray@@QEHAA?AV1@_J@Z,??1QByteArray@@QEAA@XZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?data@QByteArray@@QEAAPEADXZ,?length@QByteArray@@QEBA_JXZ,EVP_DecryptInit_ex,?fromRawData@QByteArray@@SA?AV1@PEBD_J@Z,?homePath@QDir@@SA?AVQString@@XZ,??YQString@@QEAAAEAV0@PEBD@Z,??0QString@@QEAA@$$QEAV0@@Z,??0QFile@@QEAA@AEBVQString@@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,?value@QSqlQuery@@QEBA?AVQVariant@@H@Z,?toString@QVariant@@QEBA?AVQString@@XZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QString@@QEAAAEAV1@AEBV1@@Z,??1QString@@QEAA@XZ,??1QString@@QEAA@XZ,??1QVariant@@QEAA@XZ,??0QChar@@QEAA@D@Z,?size@QByteArray@@QEBA_JXZ,?isNull@QByteArray@@QEBA_NXZ,?data@QByteArray@@QEBAPEBDXZ,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromLocal8Bit@QString@@SA?AV1@VQByteArrayView@@@Z,?castHelper@QByteArrayView@@CAPEBDPEBD@Z,?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z,?append@QStrin

0_2_00007FF73C2343C0

Compliance

Source: FsJfRO0W9w.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Source: FsJfRO0W9w.exe	String found in binary or memory: http://185.235.241.208:1224
Source: FsJfRO0W9w.exe	String found in binary or memory: https://hello.freeconference.com/login/access-code
Source: FsJfRO0W9w.exe	String found in binary or memory: https://hello.freeconference.com/login/access-code&HideSho&w&Close:/logo.icohttp://185.235.241.208:1

System Summary

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C234DF0		0_2_00007FF73C234DF0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C232AD0		0_2_00007FF73C232AD0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C233360		0_2_00007FF73C233360
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C2343C0		0_2_00007FF73C2343C0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C236420		0_2_00007FF73C236420

Source: FsJfRO0W9w.exe	Binary or memory string: OriginalFilename vs FsJfRO0W9w.exe
Source: FsJfRO0W9w.exe, 00000000.00000000.2047422005.00007FF73C24F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFCCCall.exe0 vs FsJfRO0W9w.exe
Source: FsJfRO0W9w.exe	Binary or memory string: OriginalFilenameFCCCall.exe0 vs FsJfRO0W9w.exe

Source: classification engine

Classification label: mal60.winEXE@1/0@0/0

Source: FsJfRO0W9w.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FsJfRO0W9w.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: libcrypto-1_1-x64.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6webenginewidgets.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6widgets.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6webenginecore.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6gui.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6sql.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6network.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: qt6core.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: vcruntime140_1.dll			Jump to behavior
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Section loaded: vcruntime140.dll			Jump to behavior

Source: FsJfRO0W9w.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FsJfRO0W9w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FsJfRO0W9w.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: FsJfRO0W9w.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: FsJfRO0W9w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FsJfRO0W9w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FsJfRO0W9w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FsJfRO0W9w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FsJfRO0W9w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Malware Analysis System Evasion

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe

Code function: 0_2_00007FF73C239014 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF73C239014

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C2391F8 SetUnhandledExceptionFilter,		0_2_00007FF73C2391F8
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C238BB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF73C238BB0
Source: C:\Users\user\Desktop\FsJfRO0W9w.exe	Code function: 0_2_00007FF73C239014 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF73C239014

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\FsJfRO0W9w.exe

Code function: 0_2_00007FF73C239264 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF73C239264