Edit tour

Windows Analysis Report
SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe
Analysis ID:	1544040
MD5:	de33be5614d00e60edcc7f0188826233
SHA1:	c4d3b63dbae6226ad2c71d22f8afc729c38af2ec
SHA256:	fc57a1e56ec50da6e17a351bb29d6598d5f8ddb043e28331e474e0d8efac73a5
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Initial sample is a PE file and has a suspicious name

Contains functionality to check if a debugger is running (IsDebuggerPresent)

HTTP GET or POST without a user agent

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe" MD5: DE33BE5614D00E60EDCC7F0188826233)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

ReversingLabs: Detection: 13%

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: certificate valid

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: global traffic

HTTP traffic detected: POST /v1/log?product=imageshow&version=1.2.3.8&timestamp=1730137026&sign=8c9ca8f6cf36d8135001e1e08ebb1e21 HTTP/1.1Content-Type: application/jsonHost: report.pdfxd.comContent-Length: 171Connection: Keep-AliveCache-Control: no-cacheData Raw: 7b 22 61 63 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 39 65 35 35 37 64 63 32 66 38 66 63 37 37 31 36 39 63 32 33 66 66 32 66 33 37 38 32 30 31 63 38 22 2c 22 6f 73 22 3a 22 31 36 33 38 34 32 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 69 6d 61 67 65 73 68 6f 77 22 2c 22 71 64 22 3a 22 48 6f 6d 65 22 2c 22 72 61 6e 64 6f 6d 22 3a 22 37 31 34 31 38 32 38 22 2c 22 73 74 61 74 75 73 22 3a 22 73 74 61 72 74 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 2e 32 2e 33 2e 38 22 7d Data Ascii: {"action":"install","device_id":"9e557dc2f8fc77169c23ff2f378201c8","os":"163842","product":"imageshow","qd":"Home","random":"7141828","status":"start","version":"1.2.3.8"}

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: report.pdfxd.com

Source: unknown

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	String found in binary or memory: http://api.pdfxd.com/pdf-service/v1/reportSwa94oarrFLiR6DxVTXxgsP5In8oeidPtimestamp%I64dsend_date%s?
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://report.pdfxd.com/v1/log
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://report.pdfxd.com/v1/log?product=imageshow
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://report.pdfxd.com/v1/log?product=imageshow&version=1.2.3.8&timestamp=1730137026&sign=8c9ca8f6c
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://report.pdfxd.com/v1/logs
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/auth/code
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/forgetpwd/step/first?
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/forgetpwd/step/second?
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/forgetpwd/step/submit?
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/passport/logout
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/registert
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/user/bind
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/user/bind/list
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v1/api/user/info/
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v3/mobile/login
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v3/passport/login/bind%
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/account/v3/passport/loginRPCRT4
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/app/cloud
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/cloud/v1/api/upgradep#
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/customer/cloud/active
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/customer/dump/uploadB
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/customer/support
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/third/anonymous
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/third/phone/sms/codep#
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/third/qq/login/connect5
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/third/wx/qrcode/login#
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.pdfxd.com/third/wx/qrcode/login/noticel
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	String found in binary or memory: https://dev.pdfxd.com/account/v1/api/forgetpwd/step/submit?
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	String found in binary or memory: https://dev.pdfxd.com/third/wx/qrcode/login/noticehttps://dev.pdfxd.com/third/wx/qrcode/loginhttps:/
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passport.pdfxd.com/bind_phone_pic
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passport.pdfxd.com/coupon_pic
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passport.pdfxd.com/login_pic
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passport.pdfxd.com/pay_pic
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passport.pdfxd.com/pic-interests
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	String found in binary or memory: https://pic.pdfxd.com/protocol.html

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: Resource name: RT_RCDATA type: 7-zip archive data, version 0.4

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

File created: C:\Users\user\AppData\Roaming\XDImageShowData

Jump to behavior

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

ReversingLabs: Detection: 13%

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

String found in binary or memory: </InstallEnd>

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: certificate valid

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static file information: File size 43003376 > 1048576

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x27eea00

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Code function: 0_2_00F520DC push ecx; ret

0_2_00F520EF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

File opened: PhysicalDrive0

Jump to behavior

Source: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EC5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Code function: 0_2_00F567F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00F567F3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Code function: 0_2_00F567F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F567F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	Code function: 0_2_00F5192D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00F5192D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Code function: 0_2_00F524C8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F524C8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	13%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
report.pdfxd.com	123.56.218.178	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://report.pdfxd.com/v1/log?product=imageshow&version=1.2.3.8&timestamp=1730137026&sign=8c9ca8f6cf36d8135001e1e08ebb1e21	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://apis.pdfxd.com/account/v3/passport/loginRPCRT4	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://report.pdfxd.com/v1/logs	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dev.pdfxd.com/third/wx/qrcode/login/noticehttps://dev.pdfxd.com/third/wx/qrcode/loginhttps:/	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	false	unknown
https://passport.pdfxd.com/coupon_pic	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/auth/code	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/user/bind/list	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://passport.pdfxd.com/bind_phone_pic	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/forgetpwd/step/second?	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/third/wx/qrcode/login#	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E40000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/passport/logout	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/third/anonymous	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://passport.pdfxd.com/pay_pic	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/customer/dump/uploadB	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://report.pdfxd.com/v1/log?product=imageshow&version=1.2.3.8&timestamp=1730137026&sign=8c9ca8f6c	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EC5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/registert	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/app/cloud	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v3/mobile/login	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://passport.pdfxd.com/pic-interests	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://passport.pdfxd.com/login_pic	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dev.pdfxd.com/account/v1/api/forgetpwd/step/submit?	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	false	unknown
https://apis.pdfxd.com/account/v1/api/user/bind	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/third/qq/login/connect5	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://report.pdfxd.com/v1/log?product=imageshow	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003EC5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/forgetpwd/step/submit?	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	false	unknown
https://apis.pdfxd.com/third/wx/qrcode/login/noticel	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/cloud/v1/api/upgradep#	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://api.pdfxd.com/pdf-service/v1/reportSwa94oarrFLiR6DxVTXxgsP5In8oeidPtimestamp%I64dsend_date%s?	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	false	unknown
https://apis.pdfxd.com/account/v3/passport/login/bind%	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/customer/support	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/customer/cloud/active	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://report.pdfxd.com/v1/log	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/third/phone/sms/codep#	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://apis.pdfxd.com/account/v1/api/forgetpwd/step/first?	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://pic.pdfxd.com/protocol.html	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe	false	unknown
https://apis.pdfxd.com/account/v1/api/user/info/	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe, 00000000.00000002.3396318509.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
123.56.218.178	report.pdfxd.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544040
Start date and time:	2024-10-28 18:36:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe
Detection:	MAL
Classification:	mal52.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	server.exe	Get hash	malicious	GhostRat	Browse	121.196.49.217
	server.exe	Get hash	malicious	GhostRat	Browse	121.196.49.217
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	8.188.166.164
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	39.106.134.67
	nabmips.elf	Get hash	malicious	Unknown	Browse	8.169.152.46
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	42.120.57.84
	splmpsl.elf	Get hash	malicious	Unknown	Browse	39.98.53.190
	nabarm7.elf	Get hash	malicious	Unknown	Browse	8.139.253.84
	splarm7.elf	Get hash	malicious	Unknown	Browse	123.57.234.16
	splarm5.elf	Get hash	malicious	Unknown	Browse	8.159.149.218

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.995877630321369
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe
File size:	43'003'376 bytes
MD5:	de33be5614d00e60edcc7f0188826233
SHA1:	c4d3b63dbae6226ad2c71d22f8afc729c38af2ec
SHA256:	fc57a1e56ec50da6e17a351bb29d6598d5f8ddb043e28331e474e0d8efac73a5
SHA512:	9e1df0cb90054d732c6cd9083eba7561e491cd55fb715fe01336f35ae9af1b2d3c74f7ba0c6e39b8ddf2b38c7832e5533eeba26bab9f630d61d41832c694c8a9
SSDEEP:	786432:zgmnUmofP4fKDo72GORr/X2fnW4GmDDAU2dzg1vTfG1RmwXf/8DlrWnX:rnUtwfKDo7REMnW9U2dM1vT4zf/8DxWX
TLSH:	74973373299E4034E95100729678DF7ED0AF63290B2F8DC797C00B690967BC16A7AE5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........vo...<...<...<...=...<...=...<.c.=...<.c.=...<.c.=...<...=...<...=...<...=...<...<...<.d.=V..<.d.=...<.d.<...<...<...<.d.=...

File Icon


Icon Hash:	619a14960b292109

Static PE Info

General

Entrypoint:	0x4a1d9c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E2E9FB [Thu Sep 12 13:17:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0a7217542690edbbd6c792caac85a70c

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	04/03/2024 01:00:00 27/08/2025 01:59:59
Subject Chain	CN="Chengdu Aishang Office Technology Co., Ltd.", OU=R&D department, O="Chengdu Aishang Office Technology Co., Ltd.", L=\u6210\u90fd\u5e02, S=\u56db\u5ddd\u7701, C=CN, SERIALNUMBER=91510100MA7EUJ0408, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=\u56db\u5ddd\u5929\u5e9c\u65b0\u533a, OID.1.3.6.1.4.1.311.60.2.1.2=\u56db\u5ddd\u7701, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	B1DB425DAFF1EE9F34BFCDCD9CB68DF4
Thumbprint SHA-1:	D9185C2F47829D062DDCE1C387F13D96A40EBF37
Thumbprint SHA-256:	A58F9C0E4DF0109F1443CE86FF4795F924BB4FA6D8141DB24CD37B04AAF98204
Serial:	073AD6CAE07689A7F4334C3698FBF405

Entrypoint Preview

Instruction
call 00007F1EB08D04D9h
jmp 00007F1EB08CFBDFh
push ebp
mov ebp, esp
pop ebp
jmp 00007F1EB08CF459h
push ebp
mov ebp, esp
and dword ptr [00508440h], 00000000h
sub esp, 28h
or dword ptr [00504118h], 01h
push 0000000Ah
call dword ptr [004DC238h]
test eax, eax
je 00007F1EB08D006Bh
push ebx
push esi
push edi
xor eax, eax
lea edi, dword ptr [ebp-28h]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-28h]
mov edi, dword ptr [ebp-24h]
mov dword ptr [ebp-04h], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-1Ch]
xor eax, 49656E69h
mov dword ptr [ebp-18h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 6C65746Eh
mov dword ptr [ebp-14h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-28h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-18h]
or eax, dword ptr [ebp-14h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F1EB08CFD9Bh
mov eax, dword ptr [ebp-28h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F1EB08CFD85h
cmp eax, 00020660h
je 00007F1EB08CFD7Eh
cmp eax, 00020670h
je 00007F1EB08CFD77h
cmp eax, 00030650h
je 00007F1EB08CFD70h
cmp eax, 00030660h
je 00007F1EB08CFD69h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x100d6c	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11d000	0x27ee868	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2900400	0x29f0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x290c000	0xb208	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf09a0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf09c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf08e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xdc000	0x69c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdaf5c	0xdb000	ee4ffa6b421416cb870b4dd7c2555747	False	0.4587993186358447	DOS executable (COM)	6.498008455044036	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xdc000	0x272d4	0x27400	d0e77bd1dac89316a0665d9a06b26adf	False	0.3346312699044586	data	4.759283366681058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x104000	0x18020	0x3e00	a96155ca2312d5ea5ef1db479d615469	False	0.19430443548387097	data	4.566885531106728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11d000	0x27ee868	0x27eea00	b19da25060bf75d761a2364b0a9c73b1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x290c000	0xb208	0xb400	109541f3149bcdc7ef96ce8b5e55bbce	False	0.573828125	data	6.5666903730688855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x11d798	0x2b1	PNG image data, 210 x 143, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7706821480406386
PNG	0x11da4c	0x834	PNG image data, 800 x 40, 8-bit colormap, non-interlaced	Chinese	China	1.0052380952380953
PNG	0x11e280	0xca	PNG image data, 16 x 6, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004950495049505
PNG	0x11e34c	0x167	PNG image data, 72 x 24, 8-bit gray+alpha, non-interlaced	Chinese	China	1.0306406685236769
PNG	0x11e4b4	0xd4	PNG image data, 16 x 6, 8-bit/color RGBA, non-interlaced	Chinese	China	1.009433962264151
PNG	0x11e588	0xa2	PNG image data, 20 x 20, 4-bit colormap, non-interlaced	Chinese	China	0.9629629629629629
PNG	0x11e62c	0x6e4	PNG image data, 80 x 80, 8-bit colormap, non-interlaced	Chinese	China	1.006235827664399
PNG	0x11ed10	0x1fb8	PNG image data, 600 x 400, 4-bit colormap, non-interlaced	Chinese	China	0.9926108374384236
PNG	0x120cc8	0xb50	PNG image data, 200 x 29, 8-bit colormap, non-interlaced	Chinese	China	0.9986187845303868
PNG	0x121818	0x3cf	PNG image data, 96 x 12, 8-bit colormap, non-interlaced	Chinese	China	0.9364102564102564
PNG	0x121be8	0x134	PNG image data, 36 x 12, 8-bit colormap, non-interlaced	Chinese	China	0.961038961038961
PNG	0x121d1c	0x12d	PNG image data, 36 x 12, 8-bit colormap, non-interlaced	Chinese	China	0.9833887043189369
PNG	0x121e4c	0x190	PNG image data, 240 x 24, 8-bit colormap, non-interlaced	Chinese	China	1.0
RT_ICON	0x121fdc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.3421985815602837
RT_ICON	0x122444	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Chinese	China	0.25778688524590165
RT_ICON	0x122dcc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Chinese	China	0.18878986866791744
RT_ICON	0x123e74	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.1370331950207469
RT_ICON	0x12641c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Chinese	China	0.10899858290033065
RT_ICON	0x12a644	0x2dd6	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9944605420146583
RT_ICON	0x12d41c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.3421985815602837
RT_ICON	0x12d884	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Chinese	China	0.25778688524590165
RT_ICON	0x12e20c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Chinese	China	0.18878986866791744
RT_ICON	0x12f2b4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.1370331950207469
RT_ICON	0x13185c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Chinese	China	0.10899858290033065
RT_ICON	0x135a84	0x2dd6	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9944605420146583
RT_MENU	0x13885c	0x50	data	Chinese	China	0.8375
RT_DIALOG	0x1388ac	0x114	data	Chinese	China	0.6159420289855072
RT_STRING	0x1389c0	0x34	data	Chinese	China	0.6346153846153846
RT_ACCELERATOR	0x1389f4	0x10	data	Chinese	China	1.25
RT_RCDATA	0x138a04	0x4ef	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.40380047505938244
RT_RCDATA	0x138ef4	0x27d21eb	7-zip archive data, version 0.4	Chinese	China	1.0003108978271484
RT_GROUP_ICON	0x290b0e0	0x5a	data	Chinese	China	0.7777777777777778
RT_GROUP_ICON	0x290b13c	0x5a	data	Chinese	China	0.8111111111111111
RT_VERSION	0x290b198	0x2a0	data	Chinese	China	0.5461309523809523
RT_MANIFEST	0x290b438	0x42e	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1010), with CRLF line terminators	English	United States	0.5037383177570094

Imports

DLL	Import
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
KERNEL32.dll	lstrcmpA, GetThreadLocale, SetThreadLocale, InitializeCriticalSectionAndSpinCount, GetSystemInfo, SetEndOfFile, GetFileSizeEx, MoveFileExW, SetFileAttributesW, GetFileAttributesExW, ResetEvent, SetEvent, PostQueuedCompletionStatus, GetExitCodeThread, CreateEventW, CreateIoCompletionPort, GetQueuedCompletionStatus, DecodePointer, WriteConsoleW, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, FlushFileBuffers, GetTimeZoneInformation, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetConsoleOutputCP, SetStdHandle, WaitForSingleObject, SetFilePointerEx, GetFileType, GetStdHandle, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, QueryPerformanceFrequency, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlUnwind, GetSystemTimeAsFileTime, QueryPerformanceCounter, SetUnhandledExceptionFilter, UnhandledExceptionFilter, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetCPInfo, LCMapStringEx, GetStringTypeW, LoadLibraryExA, VirtualFree, VirtualAlloc, IsProcessorFeaturePresent, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, EncodePointer, IsDebuggerPresent, EnumSystemLocalesW, GetLastError, HeapDestroy, lstrlenA, GetSystemTime, HeapAlloc, HeapReAlloc, GetNativeSystemInfo, GetFileSize, HeapFree, HeapSize, GetProcessHeap, InitializeCriticalSectionEx, DeleteCriticalSection, FindResourceExW, LoadResource, LockResource, SizeofResource, FindResourceW, RaiseException, SetLastError, EnterCriticalSection, LeaveCriticalSection, GetCurrentThreadId, GetModuleFileNameW, CreateFileA, SystemTimeToFileTime, GetWindowsDirectoryW, FileTimeToSystemTime, DeviceIoControl, GetCurrentProcess, K32GetModuleFileNameExW, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, ReadFile, GetStartupInfoW, CreatePipe, TerminateProcess, GetExitCodeProcess, CreateProcessW, MoveFileW, RemoveDirectoryW, FindClose, FindNextFileW, FindFirstFileW, LocalAlloc, LocalFree, OutputDebugStringW, SetFilePointer, GetPrivateProfileStringW, GetPrivateProfileIntW, CopyFileW, lstrlenW, CreateThread, ReadConsoleW, TerminateThread, InitializeCriticalSection, GetVersionExW, GetModuleHandleW, DeleteFileW, WriteFile, LoadLibraryW, GetTickCount, MulDiv, GetCurrentProcessId, OpenProcess, FreeResource, GlobalFree, GlobalAlloc, Sleep, VerSetConditionMask, VerifyVersionInfoW, WideCharToMultiByte, MultiByteToWideChar, WritePrivateProfileStringW, lstrcmpiW, LoadLibraryExW, GetProcAddress, FreeLibrary, CloseHandle, CreateFileW, CreateDirectoryW, GetVersion, GetConsoleMode
USER32.dll	GetShellWindow, IsClipboardFormatAvailable, RegisterClipboardFormatW, GetSysColor, SetCaretPos, CreateCaret, GetCaretBlinkTime, wsprintfW, SetWindowPos, MoveWindow, ShowWindow, PostQuitMessage, LoadCursorW, KillTimer, SetTimer, DestroyWindow, IsWindow, CreateWindowExW, GetClassInfoExW, RegisterClassExW, SetWindowLongW, GetWindowLongW, GetDlgItem, UnregisterClassW, CallWindowProcW, IsRectEmpty, DefWindowProcW, SendMessageW, GetWindowTextLengthW, SetWindowTextW, CharLowerBuffW, UpdateWindow, UpdateLayeredWindow, SetActiveWindow, BringWindowToTop, AttachThreadInput, GetWindowThreadProcessId, GetClientRect, GetWindowRect, MapWindowPoints, GetParent, LoadIconW, MonitorFromWindow, GetMonitorInfoW, MessageBoxW, GetMessageW, TranslateMessage, DispatchMessageW, PeekMessageW, CharNextW, SetRectEmpty, EqualRect, SetCursor, ClientToScreen, GetCursorPos, PtInRect, ScreenToClient, GetDoubleClickTime, CopyRect, IntersectRect, PostMessageW, SystemParametersInfoW, BeginPaint, EndPaint, IsIconic, InvalidateRect, TrackMouseEvent, SetFocus, GetFocus, SetCapture, ReleaseCapture, SetWindowRgn, IsWindowVisible, EnableWindow, GetForegroundWindow, GetWindowTextW, SetForegroundWindow, IsZoomed, MonitorFromRect, OffsetRect, SetLayeredWindowAttributes, DrawTextW, GetCursor, GetIconInfo, GetDC, ReleaseDC, FillRect, GetWindow, LoadImageW
GDI32.dll	CreatePen, RestoreDC, ExtSelectClipRgn, CreateRectRgnIndirect, SaveDC, GetDeviceCaps, GetStockObject, SetBkColor, GetBitmapBits, StretchBlt, SetStretchBltMode, SetPixel, Rectangle, CreateSolidBrush, GetObjectW, SetTextColor, SetBkMode, CreateRectRgn, CombineRgn, CreateRoundRectRgn, DeleteDC, BitBlt, SelectObject, CreateCompatibleDC, DeleteObject, CreateFontIndirectW, SetBitmapBits, GetTextColor, GetCurrentObject, SetTextCharacterExtra, GetViewportOrgEx, CreateDIBSection
ADVAPI32.dll	RegQueryInfoKeyW, FreeSid, CheckTokenMembership, AllocateAndInitializeSid, ConvertSidToStringSidW, LookupAccountNameW, GetUserNameW, DeleteService, ControlService, SetSecurityDescriptorDacl, RegSetKeySecurity, InitializeSecurityDescriptor, RegEnumKeyW, CloseServiceHandle, ChangeServiceConfigW, QueryServiceConfigW, QueryServiceStatus, StartServiceW, OpenServiceW, OpenSCManagerW, CreateProcessWithTokenW, DuplicateTokenEx, OpenProcessToken, RegQueryValueExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHBrowseForFolderW, ShellExecuteW, SHCreateDirectoryExW, ShellExecuteExW, SHChangeNotify, SHGetSpecialFolderPathW, SHGetMalloc
ole32.dll	CoInitializeSecurity, OleRun, RegisterDragDrop, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, CreateStreamOnHGlobal, CoInitialize, CoTaskMemRealloc, CoTaskMemAlloc, CoCreateInstance, CoTaskMemFree, CoUninitialize
OLEAUT32.dll	SysAllocString, VarBstrCmp, VarUI4FromStr, VariantCopy, VariantClear, LoadRegTypeLib, LoadTypeLib, SysFreeString, SysStringLen, VariantInit, GetErrorInfo
SHLWAPI.dll	PathIsDirectoryW, PathSearchAndQualifyW, PathRemoveBackslashW, SHDeleteValueW, SHGetValueW, StrCmpIW, PathCombineW, PathAppendW, PathRemoveFileSpecW, PathRemoveExtensionW, PathFindFileNameW, PathFileExistsW
COMCTL32.dll	DrawShadowText, InitCommonControlsEx
MSIMG32.dll	AlphaBlend
WININET.dll	InternetCloseHandle, HttpSendRequestW, HttpOpenRequestW, InternetReadFile, HttpQueryInfoW, InternetCrackUrlW, InternetConnectW, InternetSetOptionW, InternetOpenW
gdiplus.dll	GdipCreateBitmapFromHICON, GdipCreateBitmapFromHBITMAP, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipCreateBitmapFromFile, GdipBitmapLockBits, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipGetImagePixelFormat, GdipDeleteGraphics, GdipGetImageGraphicsContext, GdipCreateFromHDC, GdipDisposeImage, GdipAlloc, GdipFree, GdipDeleteBrush, GdipCloneBrush, GdipCreateSolidFill, GdipSetTextRenderingHint, GdipDrawString, GdipCreateFontFamilyFromName, GdipDeleteFontFamily, GdipCreateFont, GdipDeleteFont, GdiplusStartup, GdipSetInterpolationMode
Secur32.dll	GetUserNameExW
CRYPT32.dll	CryptBinaryToStringW, CryptStringToBinaryW
NETAPI32.dll	Netbios
IPHLPAPI.DLL	GetAdaptersInfo, GetIpAddrTable

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:37:08.763045073 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:08.803069115 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:08.803478003 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:08.822451115 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:08.864703894 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:10.115009069 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:10.115087032 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:10.115602016 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:10.115658045 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:10.348500013 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:10.348583937 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:37:25.172838926 CET	80	49706	123.56.218.178	192.168.2.6
Oct 28, 2024 18:37:25.172957897 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:38:58.496223927 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:38:58.808022976 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:38:59.417403936 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:39:00.620520115 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:39:03.026798010 CET	49706	80	192.168.2.6	123.56.218.178
Oct 28, 2024 18:39:07.839284897 CET	49706	80	192.168.2.6	123.56.218.178

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:37:08.610331059 CET	64453	53	192.168.2.6	1.1.1.1
Oct 28, 2024 18:37:08.663336039 CET	53	64453	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 18:37:08.610331059 CET	192.168.2.6	1.1.1.1	0x8aac	Standard query (0)	report.pdfxd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 18:37:08.663336039 CET	1.1.1.1	192.168.2.6	0x8aac	No error (0)	report.pdfxd.com		123.56.218.178	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

report.pdfxd.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49706	123.56.218.178	80	3160	C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 18:37:08.822451115 CET	415	OUT	POST /v1/log?product=imageshow&version=1.2.3.8&timestamp=1730137026&sign=8c9ca8f6cf36d8135001e1e08ebb1e21 HTTP/1.1 Content-Type: application/json Host: report.pdfxd.com Content-Length: 171 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 7b 22 61 63 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 64 65 76 69 63 65 5f 69 64 22 3a 22 39 65 35 35 37 64 63 32 66 38 66 63 37 37 31 36 39 63 32 33 66 66 32 66 33 37 38 32 30 31 63 38 22 2c 22 6f 73 22 3a 22 31 36 33 38 34 32 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 69 6d 61 67 65 73 68 6f 77 22 2c 22 71 64 22 3a 22 48 6f 6d 65 22 2c 22 72 61 6e 64 6f 6d 22 3a 22 37 31 34 31 38 32 38 22 2c 22 73 74 61 74 75 73 22 3a 22 73 74 61 72 74 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 2e 32 2e 33 2e 38 22 7d Data Ascii: {"action":"install","device_id":"9e557dc2f8fc77169c23ff2f378201c8","os":"163842","product":"imageshow","qd":"Home","random":"7141828","status":"start","version":"1.2.3.8"}
Oct 28, 2024 18:37:10.115009069 CET	180	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:37:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 33 Connection: keep-alive Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 64 61 74 61 22 3a 22 22 7d Data Ascii: {"code":0,"message":"","data":""}
Oct 28, 2024 18:37:10.115602016 CET	180	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:37:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 33 Connection: keep-alive Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 64 61 74 61 22 3a 22 22 7d Data Ascii: {"code":0,"message":"","data":""}
Oct 28, 2024 18:37:10.348500013 CET	180	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:37:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 33 Connection: keep-alive Data Raw: 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 64 61 74 61 22 3a 22 22 7d Data Ascii: {"code":0,"message":"","data":""}

Target ID:	0
Start time:	13:37:06
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe"
Imagebase:	0xeb0000
File size:	43'003'376 bytes
MD5 hash:	DE33BE5614D00E60EDCC7F0188826233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	434
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00F6AE5A Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00FB05B0,0000000C), ref: 00F6AE6D
ExitThread.KERNEL32 ref: 00F6AE74

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 2c15efd94393d444211ab74282f1139f71439370ea090ef3d9f50319a0a6c3fc
Instruction ID: cc092a0b0713268ec0dc17ebcef1eae7888527f89ec008667912de8bd08a56ce
Opcode Fuzzy Hash: 2c15efd94393d444211ab74282f1139f71439370ea090ef3d9f50319a0a6c3fc
Instruction Fuzzy Hash: 32F0A470940204AFDB01AFB0DC4AABE3B74EF54710F104249F00597652DB79A940EFA2

Function 00F6F792 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00F78618,?,00000000,?,?,00F788B9,?,00000007,?,?,00F78C6C,?,?), ref: 00F6F7A8
GetLastError.KERNEL32(?,?,00F78618,?,00000000,?,?,00F788B9,?,00000007,?,?,00F78C6C,?,?), ref: 00F6F7B3

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8307a1fbea2b4439a2bfc265e3148764cf642e622548de548fc3f2eef6bb8c8a
Instruction ID: df864b9862e5acbc9e9e938203904b17c558fbbe166c3e70b9fd77aabc663a03
Opcode Fuzzy Hash: 8307a1fbea2b4439a2bfc265e3148764cf642e622548de548fc3f2eef6bb8c8a
Instruction Fuzzy Hash: 1FE08631500208ABEB112FF0AC49B953B68AB41753F044021FA19E6070CA388844E7D4

Function 00F6F4A7 Relevance: 2.6, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00F6AE7F,00FB05B0,0000000C), ref: 00F6F4AB
SetLastError.KERNEL32(00000000), ref: 00F6F54D

Part of subcall function 00F70C3C: RtlAllocateHeap.NTDLL(00000008,?,?,?,00F6F4F4,00000001,00000364,?,00000006,000000FF,?,00F6AE7F,00FB05B0,0000000C), ref: 00F70C7D

Part of subcall function 00F6F792: RtlFreeHeap.NTDLL(00000000,00000000,?,00F78618,?,00000000,?,?,00F788B9,?,00000007,?,?,00F78C6C,?,?), ref: 00F6F7A8
Part of subcall function 00F6F792: GetLastError.KERNEL32(?,?,00F78618,?,00000000,?,?,00F788B9,?,00000007,?,?,00F78C6C,?,?), ref: 00F6F7B3

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$Heap$AllocateFree
String ID:
API String ID: 2037364846-0
Opcode ID: 16447014ff5c2281e1b78437bb6fbb75fc5588d0645defaba969bd88c63067d2
Instruction ID: 7293c341cb1f101c7f98dcedf3c760efc8b0b63e223b2c1a75d1dbe05b42bddd
Opcode Fuzzy Hash: 16447014ff5c2281e1b78437bb6fbb75fc5588d0645defaba969bd88c63067d2
Instruction Fuzzy Hash: 8B31EB326052157BDA513B747CC6E6F364C8F40370B158331F516951F2EE688D0EB7A2

Function 00F6F5F8 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,?,00F56AF2,00F70C8E,?,?,00F6F4F4,00000001,00000364,?,00000006,000000FF,?,00F6AE7F,00FB05B0,0000000C), ref: 00F6F5FC
SetLastError.KERNEL32(00000000), ref: 00F6F69E

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5c9404721502bdce66687cc346b4127a385e59d5d2850fb16db13a6abfecd3f8
Instruction ID: d4aa4c2f1f52806855b8204b5013019be511b748b70fa7447e697463f4d343cf
Opcode Fuzzy Hash: 5c9404721502bdce66687cc346b4127a385e59d5d2850fb16db13a6abfecd3f8
Instruction Fuzzy Hash: B811CE326052166FDA813AB4FCC6E6F364CCF403B4B104335F018910B2EA6A8C0EB662

Function 00F70C3C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00F6F4F4,00000001,00000364,?,00000006,000000FF,?,00F6AE7F,00FB05B0,0000000C), ref: 00F70C7D

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a620391d2f3e1c03d185b951ca462ae186f3619acf5d67aa4e5cc9ca2adb1515
Instruction ID: 481b85321585907bef3803e868424477f5940bdc18362c21010b19a3a37c09d4
Opcode Fuzzy Hash: a620391d2f3e1c03d185b951ca462ae186f3619acf5d67aa4e5cc9ca2adb1515
Instruction Fuzzy Hash: E2F09036904125EAAB222A219C45B6A3748AF40770B18C352B80CEA190CE30E800B7E6

Non-executed Functions

Function 00F567F3 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F568EB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F568F5
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00F56902

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f6859dedae42249f3ab7bf3b505bb9ae02a7cc61fd8541a2c14653a3a7f551f8
Instruction ID: f5d228ee9a320ea13a832f45005122a854b2111251a8b37d76e59bf50ffbe2c3
Opcode Fuzzy Hash: f6859dedae42249f3ab7bf3b505bb9ae02a7cc61fd8541a2c14653a3a7f551f8
Instruction Fuzzy Hash: 4A31D37490121C9BCB21DF68DC8979DBBB8BF08311F5042EAE91CA7291E7349B859F54

Function 00F6CB54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,03F8D1CB,?,?,00000000,00F80F80,000000FF,?,00F6CB30,00000002,?,00F6CB04,00F6C58C), ref: 00F6CB89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F6CB9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,00F80F80,000000FF,?,00F6CB30,00000002,?,00F6CB04,00F6C58C), ref: 00F6CBBD

Strings

CorExitProcess, xrefs: 00F6CB93
mscoree.dll, xrefs: 00F6CB82

Memory Dump Source

Source File: 00000000.00000002.3391103235.0000000000EB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000000.00000002.3391051473.0000000000EB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391205772.0000000000F8C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391272111.0000000000FB4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391312278.0000000000FB5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FB7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391330165.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000019CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.00000000023CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3391380298.0000000002DCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 92e414bbb41086ba2095589ed373ad7c1c4f51f7c1adc883b372fd62cd00c3c2
Instruction ID: faff456fd38d6c87f74217a768dc3309e669217ba7bbfafcf54f91f5636e4f34
Opcode Fuzzy Hash: 92e414bbb41086ba2095589ed373ad7c1c4f51f7c1adc883b372fd62cd00c3c2
Instruction Fuzzy Hash: 3E016231A40659AFDB119B50DC09FFEBBB8FB44B24F004625F911A2690DB749904EBE0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
SecuriteInfo.com.Riskware.Pdfxd.1445.707.exe

Function 00F6AE5A Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 00F6F792 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00F6F4A7 Relevance: 2.6, APIs: 2, Instructions: 125
COMMON

Function 00F6F5F8 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Function 00F70C3C Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00F567F3 Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 00F6CB54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON