Edit tour

Windows Analysis Report
CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Overview

General Information

Sample name:	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Analysis ID:	1560091
MD5:	56507d8fc1346411ed4fdbecb4589ec8
SHA1:	a7d542484247819e9037cbd913b8ad1b68b0dad6
SHA256:	ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
Tags:	exeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

CHARIKLIA JUNIOR DETAILS.pdf.scr.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe" MD5: 56507D8FC1346411ED4FDBECB4589EC8)

powershell.exe (PID: 7668 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CHARIKLIA JUNIOR DETAILS.pdf.scr.exe (PID: 7684 cmdline: "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe" MD5: 56507D8FC1346411ED4FDBECB4589EC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7684	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7684	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d6f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d765:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d7ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d881:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d8eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d95d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d9f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6da83:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6aae6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x6a1e5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b823:$s5: remove_Key 0x6b9b2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c893:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d6d5:$s7: logins 0x6dc47:$s7: logins 0x7092a:$s7: logins 0x70a0a:$s7: logins 0x72306:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, ParentProcessId: 7492, ParentProcessName: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", ProcessId: 7668, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, ParentProcessId: 7492, ParentProcessName: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe", ProcessId: 7668, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Multi AV Scanner detection for submitted file

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Joe Sandbox ML: detected

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49709 version: TLS 1.2

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 50.87.144.157 50.87.144.157

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: beirutrest.com

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://beirutrest.com
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1423822508.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet.xsd
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet1.xsd
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet2.xsdM
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49709 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, n00.cs

.Net Code: lGCzgIzdr

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_0115D51C	0_2_0115D51C
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_0583AE79	0_2_0583AE79
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05836D51	0_2_05836D51
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05836D60	0_2_05836D60
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05834E48	0_2_05834E48
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_058349FC	0_2_058349FC
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05836918	0_2_05836918
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05836928	0_2_05836928
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05835280	0_2_05835280
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_05834A10	0_2_05834A10
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F2E5B8	5_2_02F2E5B8
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F24A58	5_2_02F24A58
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F2A9E0	5_2_02F2A9E0
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F23E40	5_2_02F23E40
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F2DD38	5_2_02F2DD38
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F24188	5_2_02F24188
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DE8970	5_2_06DE8970
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DEB5F8	5_2_06DEB5F8
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF65F0	5_2_06DF65F0
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF7D80	5_2_06DF7D80
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF55A0	5_2_06DF55A0
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DFB248	5_2_06DFB248
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF2350	5_2_06DF2350
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DFC190	5_2_06DFC190
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF76A0	5_2_06DF76A0
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF5CF8	5_2_06DF5CF8
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DFE3A8	5_2_06DFE3A8
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF0040	5_2_06DF0040
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF0351	5_2_06DF0351
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_06DF0007	5_2_06DF0007

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1427863922.0000000005460000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1423822508.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1429287807.0000000007A81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedd vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1428858547.0000000007230000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1412520912.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1423822508.0000000002DD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1398062622.0000000000910000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameQkTu.exe4 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3858210909.0000000000F99000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Binary or memory string: OriginalFilenameQkTu.exe4 vs CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, mO0cHCfe6EeD0PN2nv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, oTWR4jX5WAldfeNr9l.cs	Security API names: _0020.SetAccessControl
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, oTWR4jX5WAldfeNr9l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, oTWR4jX5WAldfeNr9l.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/6@2/2

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrbdbnsw.yx3.ps1

Jump to behavior

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PLAN] ([CREDIT_ID], [MATURITY_DATE], [MATURITY_SUM], [MATURITY_NOTE], [MODIF_DATE]) VALUES (@CREDIT_ID, @MATURITY_DATE, @MATURITY_SUM, @MATURITY_NOTE, @MODIF_DATE);
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE], [INTEREST]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE, @INTEREST);
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[Login] SET [User_id] = @User_id, [User_pass] = @User_pass WHERE (([User_id] = @Original_User_id) AND ([User_pass] = @Original_User_pass));
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT_PLAN] SET [CREDIT_ID] = @CREDIT_ID, [MATURITY_DATE] = @MATURITY_DATE, [MATURITY_SUM] = @MATURITY_SUM, [MATURITY_NOTE] = @MATURITY_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([MATURITY_ID] = @Original_MATURITY_ID) AND ((@IsNull_CREDIT_ID = 1 AND [CREDIT_ID] IS NULL) OR ([CREDIT_ID] = @Original_CREDIT_ID)) AND ([MATURITY_DATE] = @Original_MATURITY_DATE) AND ([MATURITY_SUM] = @Original_MATURITY_SUM) AND ((@IsNull_MATURITY_NOTE = 1 AND [MATURITY_NOTE] IS NULL) OR ([MATURITY_NOTE] = @Original_MATURITY_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[PROD_PERIODS] ([PROD_CODE], [PROD_PERIOD]) VALUES (@PROD_CODE, @PROD_PERIOD);
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[INTEREST] SET [PROD_CODE] = @PROD_CODE, [PROD_PERIOD] = @PROD_PERIOD, [SUM_FROM] = @SUM_FROM, [SUM_TO] = @SUM_TO WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_PERIOD] = @Original_PROD_PERIOD) AND ([SUM_FROM] = @Original_SUM_FROM) AND ([SUM_TO] = @Original_SUM_TO));
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT] SET [CREDIT_NO] = @CREDIT_NO, [CREDIT_DATE] = @CREDIT_DATE, [CREDIT_PERIOD] = @CREDIT_PERIOD, [CREDIT_END_DATE] = @CREDIT_END_DATE, [CREDIT_BEGIN_DATE] = @CREDIT_BEGIN_DATE, [CLIENT_ID] = @CLIENT_ID, [PROD_CODE] = @PROD_CODE, [CREDIT_SUM] = @CREDIT_SUM, [CREDIT_NOTE] = @CREDIT_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([CREDIT_ID] = @Original_CREDIT_ID) AND ([CREDIT_NO] = @Original_CREDIT_NO) AND ((@IsNull_CREDIT_DATE = 1 AND [CREDIT_DATE] IS NULL) OR ([CREDIT_DATE] = @Original_CREDIT_DATE)) AND ([CREDIT_PERIOD] = @Original_CREDIT_PERIOD) AND ((@IsNull_CREDIT_END_DATE = 1 AND [CREDIT_END_DATE] IS NULL) OR ([CREDIT_END_DATE] = @Original_CREDIT_END_DATE)) AND ((@IsNull_CREDIT_BEGIN_DATE = 1 AND [CREDIT_BEGIN_DATE] IS NULL) OR ([CREDIT_BEGIN_DATE] = @Original_CREDIT_BEGIN_DATE)) AND ([CLIENT_ID] = @Original_CLIENT_ID) AND ((@IsNull_PROD_CODE = 1 AND [PROD_CODE] IS NULL) OR ([PROD_CODE] = @Original_PROD_CODE)) AND ([CREDIT_SUM] = @Original_CREDIT_SUM) AND ((@IsNull_CREDIT_NOTE = 1 AND [CREDIT_NOTE] IS NULL) OR ([CREDIT_NOTE] = @Original_CREDIT_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT_PRODUCT] SET [PROD_NAME] = @PROD_NAME, [PROD_ACTIVE] = @PROD_ACTIVE, [PROD_SUM_FROM] = @PROD_SUM_FROM, [PROD_SUM_TO] = @PROD_SUM_TO, [MODIF_DATE] = @MODIF_DATE WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_NAME] = @Original_PROD_NAME) AND ([PROD_ACTIVE] = @Original_PROD_ACTIVE) AND ([PROD_SUM_FROM] = @Original_PROD_SUM_FROM) AND ([PROD_SUM_TO] = @Original_PROD_SUM_TO) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000000.1397955965.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE);

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, InnerForm.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, oTWR4jX5WAldfeNr9l.cs	.Net Code: W3a5x9yJDD System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 0_2_0115DB84 pushfd ; ret		0_2_0115DB89
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Code function: 5_2_02F20C77 push edi; retf		5_2_02F20C7A

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Static PE information: section name: .text entropy: 7.528842413573355

Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, bKajDlMRoWfFMCaojU.cs	High entropy of concatenated method names: 'UOsDt5k7Xi', 'CrZDep1ihZ', 'zAnDD4SuGB', 'TBYDoNkqti', 'ud1D3U3Uhb', 'ERfDnsuMch', 'Dispose', 'I5a1E3txgm', 'rBa1IlpesI', 'DFB1NgC42a'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, aoZ5ZOdHfAY3VlgJLe.cs	High entropy of concatenated method names: 'FysscY7vn4', 'V36shH732u', 'Vuysx5d00c', 'sV4sZIu2l0', 'f6Gs24OuCm', 'vC0sYGrlV8', 'CjDs0mMtVp', 'sUQsf2AYak', 'EKJsSDWey7', 'LTIskiyN41'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, RhFK4wgMyLLuTnij1G.cs	High entropy of concatenated method names: 'ToString', 'VE3OWZc5gx', 'v6IOaRYGtB', 'igkO6xYJNo', 'lNjOjX9VOi', 'f4fOQpDu9G', 'jH1OCxDKrw', 'CYpOr9uoEo', 'cbeO4l4TUA', 'wWDOd8Wj92'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, mO0cHCfe6EeD0PN2nv.cs	High entropy of concatenated method names: 'Hq9IKMdLgy', 'GbaIFDcbH9', 'GAnIgPOTGB', 'KY5ImANMw0', 'InNIu1tpnM', 'QQVI8slqsj', 'WT7IMG4jDL', 'RsYI90RqYZ', 'KssILQaIA5', 'AioIRjdq8A'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, IkAS7eRqcx3a3kX44C.cs	High entropy of concatenated method names: 'R4UPNn7VgR', 'W2TPyUBlyp', 'HoBPJNAS19', 'ielPsLbyOX', 'J2lPDyexZf', 'i72PXiCBdD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, dkhx2UU75UPo3M4pIK.cs	High entropy of concatenated method names: 'pLcxRCNQ7', 'ynKZS1TjS', 'bx5Y9PEZL', 'l4Z0PQNKF', 'kAeSkBA54', 'omqkueQNX', 'zkaEcsMEU9ylA05ogY', 'nPrjxUkcAEGyp6n573', 'Dd11TpWJv', 'EWtPmZ9vq'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, kbfO8Pbnl4gKhe2ODL.cs	High entropy of concatenated method names: 'T2m7fgiT4r', 'a5s7Sk9IU5', 'ayq7p8xasj', 'xQN7aBPDFF', 'WxL7jyUIAP', 'N787QiPH5c', 'Wwp7r0Eyeo', 'lvU74OYvT4', 'lCl7wcewuo', 'Poi7W2WYZj'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, aFf7qbAAj88XSIi81E1.cs	High entropy of concatenated method names: 'YNZPRDtXp9', 'yKQPzlQR3P', 'K4woHEdKQl', 'PIVoAENdjg', 'o27oURh44e', 'rynoqhU708', 'IYRo5wVSjm', 'FfuoiqRrgK', 'YlSoE2kYCf', 'dTmoIx1eC5'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, HqPboYL2pr4r8kuGLp.cs	High entropy of concatenated method names: 'nK9DpY2HDX', 'eG0DakZEXi', 'TwND6SoSNt', 'doADj11ElZ', 'NgZDQwJLkk', 'chNDCmOeN5', 'DgaDrxiwLB', 'jfjD4lDu3C', 'NAZDd1jQxS', 'q56DwBofBq'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, HcmjCNrorsuqgIpjA7.cs	High entropy of concatenated method names: 'seqsE37BIe', 'dyQsNQ18uL', 'A5WsJV8j9K', 'qGOJR4PhuQ', 'bMcJzlsHuG', 'WFZsHiuJGh', 'CgZsAhukX4', 'T19sU8TvyK', 'HLssqEMUhi', 'z9Ds5nBjt2'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, JkaYIP88Qn30GQ1v1A.cs	High entropy of concatenated method names: 'Pgxe9yOkjs', 'mQmeRGd046', 'hFA1HldY7V', 'omk1AfRROe', 'GFSeWYLLxl', 'opueT6ayd5', 'EfVebfhHlD', 'Np9eKjAEYX', 'vGteF15Vv8', 'BcRegUHyEl'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, fdPwDTSIaeaio0i1kO.cs	High entropy of concatenated method names: 'FQeNZPfHag', 'RDXNYrLnbD', 'vDmNfCENp9', 'gWgNSP6uP7', 'kqXNtt6jKl', 'iaTNOPHIk6', 'U4gNeB5E07', 'kQHN1lWNq7', 'xPQNDdlTil', 'u7ZNPo2Uu6'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, CltvPrpNjb1VckZWnp.cs	High entropy of concatenated method names: 'hE1Ji7UcNc', 'vBdJI5BlfR', 'iJYJyxt3ev', 'umkJsUZLWT', 'c2VJXKC3hq', 'JGSyuZ796F', 'PtZy8JuJYs', 'kiRyMw623L', 'ROFy9EV8ky', 'qDiyLEpTpg'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, WoIeMMKENcLTkZ5yTy.cs	High entropy of concatenated method names: 'WgQtwDicQN', 'FyxtTslUFu', 'ODetKFcQyo', 'GArtFfTgu8', 'U6btaFuM2B', 'jTjt62r4Tm', 'Jkltj0FmtU', 'cyStQXoodN', 'xGctCGA7up', 'nKItrL6l9d'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, BMJIbmFGTNF56vX1ga.cs	High entropy of concatenated method names: 'kWBtMeeH7u', 'IkMt9iJ2ce', 'wNttLmQVEk', 'Pw3tRAaUaY', 'q6DOeq7JkBf127nBxEy', 'rqaNt57yItV3KxgIw26', 'SVg0bd7rsmvCNKlnxjT', 'GOl6Gt7GTWlmwByXaWF'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, EhbdPpziB5ht4NFO3c.cs	High entropy of concatenated method names: 'VUCPYKSsMc', 'U0VPff3TWo', 'hFbPS2PSD8', 'rTlPpyw3sV', 'TfCPaDx5ph', 'oNaPjvCghS', 'LdxPQc8tQb', 'C0xPncRHEn', 'nxUPcEbWOK', 'JSOPh4tf1i'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, QPotiGAHGh845Es1EeE.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PQHPWZSy28', 'CycPT6rhZW', 'S9sPb7EPNF', 'g06PKFFGFi', 'owcPFNElDd', 'kDHPgvqXhk', 'O32PmCIMN2'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, oTWR4jX5WAldfeNr9l.cs	High entropy of concatenated method names: 'Mh1qieyNEp', 'i1TqECsHJV', 'VdKqITD8fI', 'tyeqNFIfJn', 'oMRqynEIX5', 'lv4qJUKcH4', 'JFmqsfj4Ck', 'S4IqXUHySb', 'PYsqVLYR9p', 'q2VqGjcJbM'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, uYcnS7N2rgKIWsFxaW.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YS3UL4javS', 'AWtUR9Rnch', 'ambUzXqlZk', 'igrqHDFXf9', 'hPvqASX3Y7', 'GJrqUXUGQ8', 'DdWqqhWtVw', 'NxtQpSPtFmv42ihs59O'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, EZiWFwIbaBbaLGoZN3.cs	High entropy of concatenated method names: 'Dispose', 'OfFALMCaoj', 'M5NUaB7l8s', 'Ko0HXZOBnl', 'b6AARQRVV2', 'usdAzvNUum', 'ProcessDialogKey', 'qF6UHqPboY', 'AprUA4r8ku', 'lLpUUjkAS7'
Source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.7230000.2.raw.unpack, xtJn9c5XQ9QJTf70qb.cs	High entropy of concatenated method names: 'iFvAsO0cHC', 'p6EAXeD0PN', 'PIaAGeaio0', 'e1kAvOx0MU', 'UPHAtioYlt', 'mPrAONjb1V', 'FrPyBRj8OL0p56JLv7', 'gdFDhcRZ2tZEVZcOUc', 'Fp6AACupZQ', 'sZKAqajAaP'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.scr

Static PE information: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 1320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 7B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 8B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 8CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 9CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597745	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597528	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597308	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596107	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5910	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3782	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Window / User API: threadDelayed 2688	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Window / User API: threadDelayed 7160	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7916	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8008	Thread sleep count: 2688 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8008	Thread sleep count: 7160 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597866s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597528s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597308s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe TID: 8004	Thread sleep time: -594469s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597866	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597745	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597528	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597308	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596219	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596107	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Thread delayed: delay time: 594469	Jump to behavior

Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3858284388.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1428858547.0000000007230000.00000004.08000000.00040000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HLssqEMUhi

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Memory written: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"			Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Process created: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"			Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7684, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7684, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.3f891f0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe PID: 7684, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	55%	ReversingLabs	Win32.Spyware.Negasteal
CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beirutrest.com	50.87.144.157	true	false		high
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://tempuri.org/ianiDataSet1.xsd	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	false	high
https://account.dyn.com/	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000000.00000002.1423822508.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false	high
http://beirutrest.com	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe, 00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://tempuri.org/ianiDataSet2.xsdM	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	false	high
http://tempuri.org/ianiDataSet.xsd	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
50.87.144.157	beirutrest.com	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560091
Start date and time:	2024-11-21 11:50:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 95 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
05:51:02	API Interceptor	10204700x Sleep call for process: CHARIKLIA JUNIOR DETAILS.pdf.scr.exe modified
05:51:04	API Interceptor	10x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
50.87.144.157	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COSCO SHIPPING WISDOM VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beirutrest.com	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	COSCO SHIPPING WISDOM VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MUM - VESSEL'S PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
api.ipify.org	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	104.26.12.205
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.67.74.152
	order and drawings_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	172.64.41.3
	New_Order_PO-NG57283H9.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	MDE_File_Sample_37ce4d95fd579c36340b1d1490e2ef7623af4bb3.zip	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://newvideozones.click	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Order requirements CIF Greece_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	z1MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
UNIFIEDLAYER-AS-1US	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.185.3.195
	https://1.midlifemouse.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVFXRTNlSFU9JnVpZD1VU0VSMTIxMTIwMjRVNTUxMTEyMjQ=N0123Nexample@email.com	Get hash	malicious	Unknown	Browse	67.20.112.200
	https://lmmoye.org/file/oL/xzw/	Get hash	malicious	Unknown	Browse	69.49.234.173
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.172.172.178
	Delivery_Notification_000275578.doc.js	Get hash	malicious	Unknown	Browse	162.241.225.96
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	216.172.172.178
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	162.144.165.86
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	50.116.87.139

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	Order requirements CIF Greece_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.205
	https://voyages-moinschers.fr/request/index.html?userid=viviane.beigbeder@idcom-france.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	ORDER 20240986 OA.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	PO#8329837372938383839238PDF.exe	Get hash	malicious	XWorm	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.3550249375369265
Encrypted:	false
SSDEEP:	24:3OWSKco4KmZjKbmOIKod6emZ9tYs4RPQoUEJ0gt/NKIl9iagu:eWSU4xympjmZ9tz4RIoUl8NDv
MD5:	D66C47B8DC1712C9019C2CA1A29A7224
SHA1:	027D8E43DB55EB21BE139D06CCAD686648485565
SHA-256:	217A7B18569319440E4C429C91D9ECD917765DF0037D0CD19E3072BE7126BC38
SHA-512:	B2121B19348C8DD0204496EDA12D3416BE199284A307A13FEC0A7FD8FFD0F89511B9C110AE369049951ED27DD59E892153FE5E63600C3E7315A598DB5BB21F31
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwsuu0sb.sq3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqultexp.2j3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqsknafn.34x.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrbdbnsw.yx3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.526744624549009
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
File size:	979'456 bytes
MD5:	56507d8fc1346411ed4fdbecb4589ec8
SHA1:	a7d542484247819e9037cbd913b8ad1b68b0dad6
SHA256:	ad3517d5640b93e40bc1e839f6616222801d06dd83ed5887462a71f3858f5b40
SHA512:	c31e23a032d3551bb17a5bbfdff585ec57f308397739b807c08b082513d63c1984d8cf0a4cd65c2f0863e6ebec0766f161abe6a8860c65a1e44619097cb77e7b
SSDEEP:	12288:9csCELA+12Hd5lpvS36pDfi/xN3xoAS4zxPVzxWWavQ8qiNRJEvhsEY72k2uDF+d:rzxdzxWpq8JE9ePD47tdTmTX
TLSH:	A525B02077F89E67E27AA1F3EB84425097B6D141767BE39A4CC564CE26C27320783D27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*.>g..............0......(........... ........@.. .......................`............@................................

File Icon


Icon Hash:	130b253d1931012d

Static PE Info

General

Entrypoint:	0x4ee6e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673E9B2A [Thu Nov 21 02:30:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xee694	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x2588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xec6ec	0xec800	d16a37cb289f1e668a0c69ca5a2f8ee0	False	0.7367111109275899	data	7.528842413573355	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x2588	0x2600	50038f86c56e4d33d10d5412d21b5c17	False	0.8748972039473685	data	7.577073429096482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	4c41e5d352a398611a9e058992080527	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf0100	0x2016	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9504504504504504
RT_GROUP_ICON	0xf2128	0x14	data	1.05
RT_VERSION	0xf214c	0x23c	data	0.47027972027972026
RT_MANIFEST	0xf2398	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 11:51:06.184916019 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:06.184954882 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:06.185022116 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:06.194443941 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:06.194474936 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.456192970 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.456265926 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:07.458792925 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:07.458798885 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.459073067 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.510687113 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:07.521538973 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:07.563329935 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.904660940 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.904746056 CET	443	49709	104.26.12.205	192.168.2.8
Nov 21, 2024 11:51:07.904884100 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:07.910940886 CET	49709	443	192.168.2.8	104.26.12.205
Nov 21, 2024 11:51:09.581499100 CET	49711	21	192.168.2.8	50.87.144.157
Nov 21, 2024 11:51:09.701241970 CET	21	49711	50.87.144.157	192.168.2.8
Nov 21, 2024 11:51:09.701442957 CET	49711	21	192.168.2.8	50.87.144.157
Nov 21, 2024 11:51:09.707833052 CET	49711	21	192.168.2.8	50.87.144.157
Nov 21, 2024 11:51:09.827406883 CET	21	49711	50.87.144.157	192.168.2.8
Nov 21, 2024 11:51:09.827860117 CET	49711	21	192.168.2.8	50.87.144.157

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 11:51:05.948193073 CET	64351	53	192.168.2.8	1.1.1.1
Nov 21, 2024 11:51:06.178083897 CET	53	64351	1.1.1.1	192.168.2.8
Nov 21, 2024 11:51:09.058645010 CET	64993	53	192.168.2.8	1.1.1.1
Nov 21, 2024 11:51:09.579471111 CET	53	64993	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 11:51:05.948193073 CET	192.168.2.8	1.1.1.1	0x76a2	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:51:09.058645010 CET	192.168.2.8	1.1.1.1	0x4be9	Standard query (0)	beirutrest.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 11:51:06.178083897 CET	1.1.1.1	192.168.2.8	0x76a2	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:51:06.178083897 CET	1.1.1.1	192.168.2.8	0x76a2	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:51:06.178083897 CET	1.1.1.1	192.168.2.8	0x76a2	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 21, 2024 11:51:09.579471111 CET	1.1.1.1	192.168.2.8	0x4be9	No error (0)	beirutrest.com	50.87.144.157	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	104.26.12.205	443	7684	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 10:51:07 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-21 10:51:07 UTC	399	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 10:51:07 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e601f6d4ff019ae-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1895&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1492842&cwnd=224&unsent_bytes=0&cid=799422a1c4478dcd&ts=457&x=0"
2024-11-21 10:51:07 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Target ID:	0
Start time:	05:51:02
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Imagebase:	0x820000
File size:	979'456 bytes
MD5 hash:	56507D8FC1346411ED4FDBECB4589EC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1424716965.0000000003D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:51:03
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Imagebase:	0xec0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:51:03
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:51:03
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe"
Imagebase:	0xd10000
File size:	979'456 bytes
MD5 hash:	56507D8FC1346411ED4FDBECB4589EC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3862005678.000000000327C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3857823640.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.3862005678.0000000003251000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	199
Total number of Limit Nodes:	15

Executed Functions

Function 0583AE79 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7512bc46d80bcefe8a34f107f2ebaf1c820555b464b4755b81c40c75497490
Instruction ID: f26a8f17125636be516c50511ff7322464a9d85532267d3597f81d89c8679f14
Opcode Fuzzy Hash: ae7512bc46d80bcefe8a34f107f2ebaf1c820555b464b4755b81c40c75497490
Instruction Fuzzy Hash: 08E1DC717017048FDB29DB79C460BAEBBFAAF89305F1444A9E856DB290CB35EC01CB91

Function 0115CF90 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0115D01E
GetCurrentThread.KERNEL32 ref: 0115D05B
GetCurrentProcess.KERNEL32 ref: 0115D098
GetCurrentThreadId.KERNEL32 ref: 0115D0F1

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: afcf35854b983ff479568423bc3defe331eb9c7c64f2066d15a9046874d5053c
Instruction ID: 9fd1795f447deb515a808023d1d3d064708e9513cca98ee41b07b7f06f8f27b3
Opcode Fuzzy Hash: afcf35854b983ff479568423bc3defe331eb9c7c64f2066d15a9046874d5053c
Instruction Fuzzy Hash: B15176B090134ACFDB58DFA9D948BDEBBF1BF88314F208599E419A72A0D7345844CB26

Function 0115CFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0115D01E
GetCurrentThread.KERNEL32 ref: 0115D05B
GetCurrentProcess.KERNEL32 ref: 0115D098
GetCurrentThreadId.KERNEL32 ref: 0115D0F1

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7fd7c5acae3e1fe556d7d37b4ba6ce4dfa01b07dd2d16be922f80b57550b85e0
Instruction ID: d7ba63b642a3180c0afe34da9702ecfe71ed28f4c6d10495870ce77fc7a0efb8
Opcode Fuzzy Hash: 7fd7c5acae3e1fe556d7d37b4ba6ce4dfa01b07dd2d16be922f80b57550b85e0
Instruction Fuzzy Hash: 2E5156B090034ACFDB58DFAAD548BDEBBF1BF88314F208559E419A7360D7345944CB66

Function 05837A4D Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05837C8E

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 58aca948a08b0ead8e5d5e2192544edc58c375c7f70e52d2151c23f098b9edfa
Instruction ID: 2b6d9bafb91aff47e7bbde6f5d6cdce03729fbbc8d8286b01e73169c82637e51
Opcode Fuzzy Hash: 58aca948a08b0ead8e5d5e2192544edc58c375c7f70e52d2151c23f098b9edfa
Instruction Fuzzy Hash: D3A14AB1D00219DFEB10DF68C841BADBBB2FF44314F1485A9E819E7240DB759A85CF91

Function 05837A58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05837C8E

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c5763f758f0feb1e948fb2fc7485b2f7eecefc387f272670ea0baee5f49d78a1
Instruction ID: bfa701259e6b44cc20f2064bb370527e848ab1c3d41be6bedfdbae9857f07ac2
Opcode Fuzzy Hash: c5763f758f0feb1e948fb2fc7485b2f7eecefc387f272670ea0baee5f49d78a1
Instruction Fuzzy Hash: 59915BB1D00219DFEB14DF69C841BADBBB2FF48314F1485A9D819E7240DB749A85CF91

Function 0115AD08 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0115AF5E

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 23b46dd02191ea626a14a92bec83c4a25f3fead273f90c084b98e5cd6e629b14
Instruction ID: 0810a10b8e2a63901d2a360140fc7c11744f76c89860e71fb24250727bc794e5
Opcode Fuzzy Hash: 23b46dd02191ea626a14a92bec83c4a25f3fead273f90c084b98e5cd6e629b14
Instruction Fuzzy Hash: C8812770A00B05CFDB68DF29E44075ABBF5FF88304F108A2DD99A9BA50D775E849CB91

Function 011558EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011559A9

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 665f3b15562220381e61ce50a6b3c5860b4919f2674fb528c82244d9803a7a6b
Instruction ID: 03ce04725c235bcd93a017be5b75468fb42b6a0fcc099bead9f1f032302ae1c6
Opcode Fuzzy Hash: 665f3b15562220381e61ce50a6b3c5860b4919f2674fb528c82244d9803a7a6b
Instruction Fuzzy Hash: F14113B1C00319CFEB24DFAAC8847DEBBB6BF89704F20816AD419AB251DB755946CF50

Function 011544B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011559A9

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 78e82f68c676a6ace8607eec38fd530ed0491d48d46dc52e904d95e1f29f41bb
Instruction ID: d2b92670ed13fb5d59b7a435f1fa3a0c8fc0db0026b9875e0a6e3c53ef1bdf09
Opcode Fuzzy Hash: 78e82f68c676a6ace8607eec38fd530ed0491d48d46dc52e904d95e1f29f41bb
Instruction Fuzzy Hash: 8841F5B0D0071DCFDB68DFAAC84478EBBB6BF88704F208069D419AB251DB756945CF90

Function 058377C8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05837860

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3804150fed0810ef92f07d6e600ca96dd87323d0dacb206171bd691fbb0bcb19
Instruction ID: 29facc14817b17202e18680a8d2174b3df40a0f7b63232253ef860f577973599
Opcode Fuzzy Hash: 3804150fed0810ef92f07d6e600ca96dd87323d0dacb206171bd691fbb0bcb19
Instruction Fuzzy Hash: 4F2157B1D003499FDB10DFAAC881BDEBBF5FF48310F50842AE919A7240C778A944CBA4

Function 05837630 Relevance: 1.6, APIs: 1, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 058376B6

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5c8a6761a56c1648b04cba03d82b174d67f23e096e08be17cd9cc231e5d03652
Instruction ID: ccae07ad1c5b7b19ffb6fe32dd2bdf9c6f6f48ab0d8d3618705f62a5d53201a6
Opcode Fuzzy Hash: 5c8a6761a56c1648b04cba03d82b174d67f23e096e08be17cd9cc231e5d03652
Instruction Fuzzy Hash: 9E217CB19003099FDB10DFAAC9857EEBBF5EF48210F548429D919E7240DB789945CFA0

Function 0115D5E8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0115D677

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 791d8ccce490ba9e3b1bb4c6a350c4ed4798582c80d2014222da8fa6908b6e79
Instruction ID: 7f55c661eb5daecdb59e1e68774e8ce97f04a447323ea8a92b709437df6031d5
Opcode Fuzzy Hash: 791d8ccce490ba9e3b1bb4c6a350c4ed4798582c80d2014222da8fa6908b6e79
Instruction Fuzzy Hash: 823148B5800249DFDB10CFAAD980ADEFFF4AB49320F14415AE958A7250C378A941CF61

Function 058377D0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05837860

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a7bbf6db2b5277a127c14c9b6b7191348f93f8d8048e8ec371f42fad69f6f3bd
Instruction ID: 9a42e750f1bcf6bfef370c24f09a7c0c14758495fb801c475c73ae7dd3d70ac5
Opcode Fuzzy Hash: a7bbf6db2b5277a127c14c9b6b7191348f93f8d8048e8ec371f42fad69f6f3bd
Instruction Fuzzy Hash: C92125B59003499FDB10DFAAC885BDEBBF5FF48310F50842AE919A7240C778A944CBA4

Function 058378B8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05837940

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e587a951d8d185a70af53a4c9dd3497b61fde1f51003a94fa3cdab7eba5b63e5
Instruction ID: 6f54ef92ba0aacafcd89870a45c7103ac779e9c87f3a502a4a11652c22358048
Opcode Fuzzy Hash: e587a951d8d185a70af53a4c9dd3497b61fde1f51003a94fa3cdab7eba5b63e5
Instruction Fuzzy Hash: F9214AB1C0034A9FDB10DFA9C881BDEBBF5FF48310F548429E919A7240D7789905CBA0

Function 05837638 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 058376B6

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2e5f3de7fc65fe89272896515b3ef66cee82ccca30e5f8dcd291598ff5958a65
Instruction ID: fd1ec8e9864ca6142151fec64dadb3087fcd8ded16b86c108c7b4575de7cbce1
Opcode Fuzzy Hash: 2e5f3de7fc65fe89272896515b3ef66cee82ccca30e5f8dcd291598ff5958a65
Instruction Fuzzy Hash: 872138B19003098FDB10DFAAC8857AEBBF5EF88310F548429D919A7240DB789944CFA4

Function 058378C0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05837940

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ad321e392328623bc696dda2d8216889a0e5070483c639fa37fd3059de0232df
Instruction ID: 0ffcf4d12724ae03a36ff2d0c3e2f95b76b36ffc7d498d9590571f936632b6ad
Opcode Fuzzy Hash: ad321e392328623bc696dda2d8216889a0e5070483c639fa37fd3059de0232df
Instruction Fuzzy Hash: 092128B18003499FDB10DFAAC881BDEFBF5FF48320F508429E959A7240D7789904CBA4

Function 0115D5F0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0115D677

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6a2885f3da762c55876e09d3e76666fc4d322b3112738d152012c1c5f6612e5e
Instruction ID: eb2564282d8f05a66395293453070f5bf09bf8f1e8675442ad137dcfcceac578
Opcode Fuzzy Hash: 6a2885f3da762c55876e09d3e76666fc4d322b3112738d152012c1c5f6612e5e
Instruction Fuzzy Hash: ED21E4B5900209DFDB10CFAAD984ADEFBF8FB48310F14841AE918A3350D374A944CF65

Function 05837709 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0583777E

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 81ab4e67d0117828d3e19d253921e8c9f52e0151f76b6447663a5680dd709061
Instruction ID: 4537a6adc699f83e1b1241e9dc34b7da1015a635fe8b54b610e025b619df557f
Opcode Fuzzy Hash: 81ab4e67d0117828d3e19d253921e8c9f52e0151f76b6447663a5680dd709061
Instruction Fuzzy Hash: FE1126B68003499FDB10DFAAC945BDEBBF5EF48320F148819E919A7250CB799944CFA0

Function 05837710 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0583777E

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e3c5acf4884e3452c65304e95ffc0727cf49b87437390fb6ea38356f6d3fcf94
Instruction ID: 18df9940f2e4e435358074c8af30ffe7832b2b7e65b651caf660a431bbfabf6b
Opcode Fuzzy Hash: e3c5acf4884e3452c65304e95ffc0727cf49b87437390fb6ea38356f6d3fcf94
Instruction Fuzzy Hash: E31134758003499FDB10DFAAC845BDFBBF5EF88720F148819E919A7250CB79A944CFA0

Function 05837580 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 058375EA

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4d2f2f344800f3bc72d22a45df155e6c22b35e17098b7b111ef3a5bbd9690607
Instruction ID: 3b4ec98a0fdd933351f26caa384b9465159743b102daabf4d62936a717ae9b37
Opcode Fuzzy Hash: 4d2f2f344800f3bc72d22a45df155e6c22b35e17098b7b111ef3a5bbd9690607
Instruction Fuzzy Hash: F5115BB18003498FDB10DFAAC8457DEFBF5EF88310F248429D519A7240DB759904CF94

Function 05837588 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 058375EA

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0cc0a73ffc8629c41bd50f82a00553d64fd7f17af21b8be6bc996618c75f6d30
Instruction ID: 0c88c9298eb283e9fcacae8be446c7ef641e0326d4f663c16915d2dbdba22f7b
Opcode Fuzzy Hash: 0cc0a73ffc8629c41bd50f82a00553d64fd7f17af21b8be6bc996618c75f6d30
Instruction Fuzzy Hash: 36113AB19003498FDB14DFAAC8457DEFBF9EF88720F248419D519A7240CB75A944CF94

Function 05835E40 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0583A27D

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 14637f11fa16732fd747bd649b2ad87d9254b2678e64a03a584b96b4bb7fb6a9
Instruction ID: 1f9b66872302947d172f64cb624c572d5a7a2db173e8b816865f65d344486417
Opcode Fuzzy Hash: 14637f11fa16732fd747bd649b2ad87d9254b2678e64a03a584b96b4bb7fb6a9
Instruction Fuzzy Hash: 911122B58003099FCB10DF8AC885BDEBBF8EB48320F108419E959A3200C375A984CFA1

Function 0115AEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0115AF5E

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 534f86938827b70553ce6f2089995b133bb62f9f4bbcf1b826181a8354c3bdd4
Instruction ID: d300ef1d043f937d7b7e7d19ab742b313d0891539841ec24e9aeb6d1438b728d
Opcode Fuzzy Hash: 534f86938827b70553ce6f2089995b133bb62f9f4bbcf1b826181a8354c3bdd4
Instruction Fuzzy Hash: A0110FB5C002498FDB14CF9AD844A9EFBF4AF88624F10851AD928A7250C379A545CFA1

Function 0583A21B Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0583A27D

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1f77f48e6e47de3671be293fbb1d8fd58d4a223337b5662334eabb3d52ef8f2c
Instruction ID: 732516b74ca1004e66ab56260f465146ce3a5de89e18e075684681d550e6aeeb
Opcode Fuzzy Hash: 1f77f48e6e47de3671be293fbb1d8fd58d4a223337b5662334eabb3d52ef8f2c
Instruction Fuzzy Hash: 491103B58003499FDB10DF9AD885BDEFBF8FB48720F108419E958A3250C375A944CFA1

Function 010FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c4536e325249ff3d1d914eaa2cdfd0f42d51feafc04405f834a5e7d6080dd2
Instruction ID: 203c298118c1439a63a11906103bb77a078ef0c843341502122d7eb242fb418c
Opcode Fuzzy Hash: c9c4536e325249ff3d1d914eaa2cdfd0f42d51feafc04405f834a5e7d6080dd2
Instruction Fuzzy Hash: 99213671504200DFDB01DF54D8C5B2ABFA1FB84718F20C1ADDA850B646C336D446CBA2

Function 010FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f937f61afcc9947b834266ead1b43a841b358a342a1bf64e58be255f19896e
Instruction ID: 71a4c8979b2806eccb44730c1f77806eae8f3c247410ed9cab6cf733132f58fe
Opcode Fuzzy Hash: 87f937f61afcc9947b834266ead1b43a841b358a342a1bf64e58be255f19896e
Instruction Fuzzy Hash: 75213671504304DFDB05DF44D9C5B5ABBA5FB84324F20C1ADEA490B646C73AF446CBA2

Function 0110D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413089844.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1bd8677a62078c4a537671aa0ad1a5fc566e7d19a822d029328bf8a46dd6d2
Instruction ID: 0c673c6cc852253016fe53c17d72baafee5a59b48d5eb6d78e8615e9b7f840de
Opcode Fuzzy Hash: 2f1bd8677a62078c4a537671aa0ad1a5fc566e7d19a822d029328bf8a46dd6d2
Instruction Fuzzy Hash: C521F575A04304EFDF0ADF94E9C4B25BB65FB84324F20C56DE8494B296C3B6D446CA62

Function 0110D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413089844.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25186ed0ce621b583bcedfaabaea0cb175a4fd649424a850ed4cc61b0020a5ad
Instruction ID: 914e0fd2389c94d75b7ba95f6f90367a9ac4f0d222bb7b1735a7c3071f85d3da
Opcode Fuzzy Hash: 25186ed0ce621b583bcedfaabaea0cb175a4fd649424a850ed4cc61b0020a5ad
Instruction Fuzzy Hash: D4210375A04304DFDF1ADF94E884B16BB65FB84314F20C56DD84D4B28AC3B6D407CA62

Function 010FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 54e26bd903ef6a4e0fccc227cc795237853c4a5f9cd25dbe9179d021a6a1cbf3
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 1611CD76504240CFCB02CF44D5C0B56BFA2FB84224F2482ADD9490A657C33AE456CBA2

Function 010FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 5f3b27bd411becadc57ec4a45e1d369f806402c2820661cb842e464718003307
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 2D11CD76504280CFCB02CF54D5C4B16BFA2FB84624F2486ADD9490B656C33AD45ACBA2

Function 0110D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413089844.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: b5a75fdc6aa4713968c64f86921be1042b24aca4326e4ab18d235321aeb9ca42
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 3E11BE75904284CFCB16CF54E5C4B15BB62FB44324F24C6A9D8494B69AC37AD40ACB62

Function 0110D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413089844.000000000110D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0110D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: b832214ca1b7a0d2b060d1c2d9c9f0ed0ce59a33585e2c0856b7cba4ef20998b
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 6D11BB75904280DFCB06CF98D5C0B15BBA2FB84224F24C6ADD8494B696C37AD40ACB62

Function 010FD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db652e9a29d746c7a47c6ef244a0551ebbe24a85ea0aa1a072af749569e78edf
Instruction ID: 734726fad148249a893a415ecb9f408913afba0a45a7a4346a46a04bf194c41a
Opcode Fuzzy Hash: db652e9a29d746c7a47c6ef244a0551ebbe24a85ea0aa1a072af749569e78edf
Instruction Fuzzy Hash: E101F2710043849BE7604AA5CCC5B6AFFD8FF81625F18C55EEE484EA86D3799840CBB2

Function 010FD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413023247.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5cac70e9d43b36c9e874b2cc8882fb35e97fc427cd46d9778e1e16e177c478
Instruction ID: e56f24581bc13a2648bb98991f59da62fe1af4ba8f8d7c69a17bfc0de8d23498
Opcode Fuzzy Hash: 6b5cac70e9d43b36c9e874b2cc8882fb35e97fc427cd46d9778e1e16e177c478
Instruction Fuzzy Hash: 71F0C2310043849EE7508A0ACC84B62FFE8EF80634F18C49EEE484E296C279A844CBB1

Non-executed Functions

Function 05836D60 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d120e0a418c7e00765de0388991123f09b92c3725536dbcc7110de5a9fa8c20c
Instruction ID: 21cddf89273983dded63f71a0c3773ee3280a746933830c4ef6912adc50f8e16
Opcode Fuzzy Hash: d120e0a418c7e00765de0388991123f09b92c3725536dbcc7110de5a9fa8c20c
Instruction Fuzzy Hash: 81E1F874E002199FDB14DFA9C5819AEBBF2FF89304F248169E854AB355D731AD42CFA0

Function 05834E48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb809feb56a53bc8585163ba746158568dc31b92faab41210f92812dd75b151d
Instruction ID: daa1d466ad5200c7cb6f90db7ffa6f1d8ac9fb621de3451d87d8ef76dc337129
Opcode Fuzzy Hash: eb809feb56a53bc8585163ba746158568dc31b92faab41210f92812dd75b151d
Instruction Fuzzy Hash: 35E1E674E042198FDB14DFA9C581AAEBBF2FF89305F248169E814AB355D731AD41CFA0

Function 05836928 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc59f7f0f293332cc6cf9ede0c1620a97f4c0a3429461409922f43b46d90c423
Instruction ID: d01bec78e647da0e08d0462a5119a993af7d7d88343cb4882b4c677983680f35
Opcode Fuzzy Hash: dc59f7f0f293332cc6cf9ede0c1620a97f4c0a3429461409922f43b46d90c423
Instruction Fuzzy Hash: 62E10974E002199FDB14DFA9C581AAEBBF2FF89305F248169D814AB355DB319D42CFA0

Function 05835280 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8af4d702d1f8a7e939b1575b36e620c5a2fd8098faf0bf75b5706581427475
Instruction ID: 79a90c7b66c6cbfcf7338070f26a724c25ddbff12c79513bfbdc26e947d6e347
Opcode Fuzzy Hash: 5c8af4d702d1f8a7e939b1575b36e620c5a2fd8098faf0bf75b5706581427475
Instruction Fuzzy Hash: 10E10674E042198FDB14DF99C581AAEBBB2FF89305F248569E814AB315D730AD42CFA0

Function 05834A10 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc54d31c38bf01bf1126887fd98fd868dcaf8d4f36867274abc006c036e4e3d5
Instruction ID: 05fbbaaefc2b386bace01705e2c5aacb9f24145821dd2d7301b0869873d76544
Opcode Fuzzy Hash: fc54d31c38bf01bf1126887fd98fd868dcaf8d4f36867274abc006c036e4e3d5
Instruction Fuzzy Hash: 23E10974E042198FDB14DF99C585AAEBBF2FF89305F248169E814A7315D731AD42CFA0

Function 0115D51C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1413540836.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f265b839ac9e44f0541a3dfcf5c56a874c9781f8ae89cfe95bee1a58c6101816
Instruction ID: dc16ef9975ff605265b50032d9bc7962918a7473ba75b1d6ec75ff2bec7e9682
Opcode Fuzzy Hash: f265b839ac9e44f0541a3dfcf5c56a874c9781f8ae89cfe95bee1a58c6101816
Instruction Fuzzy Hash: B8A1A532E1020ACFCF19DFB4C88459EBBB6FF85304B1545A9ED11AB255DB71E916CB40

Function 058349FC Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19417f5a45bcbf72721d98821a82f7e691e727ee644e3ea7c5ad332f15ed1727
Instruction ID: b8da3b0e0836605d9d5f3c3444fca8846020f11c75bf29907c0a4101eed7d076
Opcode Fuzzy Hash: 19417f5a45bcbf72721d98821a82f7e691e727ee644e3ea7c5ad332f15ed1727
Instruction Fuzzy Hash: 25511670E142198BDB14DFA9C9856AEFBF2FF89205F248169D818A7315DB319D42CFA0

Function 05836918 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c8aadc55893ba39b53f3f246429fbb9cbef211b44aafcf948e02c4926cbf53
Instruction ID: ed049160cf102b85be4600725b691c018b5b750e0588cb05a8a23f5867a738c6
Opcode Fuzzy Hash: e7c8aadc55893ba39b53f3f246429fbb9cbef211b44aafcf948e02c4926cbf53
Instruction Fuzzy Hash: E4511971E042199BDB14DFA9C5815AEFBF2BF89305F24C169D818AB315D7319D42CFA0

Function 05836D51 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1428706861.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f9c365cabd831ce1deed3137ef0700bfba98d5539079b22dbb030d18c02cc4
Instruction ID: b05d21af7682b95e6e596d806b030dde27924f7f232d0b1d016f0cac318beed3
Opcode Fuzzy Hash: d7f9c365cabd831ce1deed3137ef0700bfba98d5539079b22dbb030d18c02cc4
Instruction Fuzzy Hash: D5513674E002198FDB14DFA9C6815AEBBF2BF89304F24816AD858AB315D7319D46CFA0

Analysis Process: CHARIKLIA JUNIOR DETAILS.pdf.scr.exePID: 7684, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	95
Total number of Limit Nodes:	10

Executed Functions

Function 06DF55A0 Relevance: 1.8, Strings: 1, Instructions: 600
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06DF597B

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: cc52bf1fa63e87a06eddf1ca2aa4b169f6bdc8c0f52c6e4318f4a78c546109a9
Instruction ID: a741c7e1493c67c7e88b0792ba87bfb646185f6b2e8bbd526f960bf8ac2e1b12
Opcode Fuzzy Hash: cc52bf1fa63e87a06eddf1ca2aa4b169f6bdc8c0f52c6e4318f4a78c546109a9
Instruction Fuzzy Hash: EC22D371F20215CFDF64DBA4E4406AEBBB2FF98320F25856AD905AB350DA31DC42CB90

Function 06DF2350 Relevance: 1.5, Instructions: 1496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9924ec8e773ed3ebe8d9a78ab8ede04bae2f0de28f7da75e7c84a6543af29b8a
Instruction ID: 504115a31c9304c53b19948b94ab2365bd52b50a49bfc4860c78aac03f243c7a
Opcode Fuzzy Hash: 9924ec8e773ed3ebe8d9a78ab8ede04bae2f0de28f7da75e7c84a6543af29b8a
Instruction Fuzzy Hash: 60D24A30E10209CFDB64DBA8C594A9DB7B2FF89310F56C5AAD509AB351DB35ED81CB80

Function 06DF65F0 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe71b0091461a0528252b358a502ef067bda87a277327e886655088e42f99c62
Instruction ID: be167ca30713aa6d2f8c9cc2e12dbad61c283ac99b752d2b98d99dd0500d2cf4
Opcode Fuzzy Hash: fe71b0091461a0528252b358a502ef067bda87a277327e886655088e42f99c62
Instruction Fuzzy Hash: 82628C34B20249DFDB54DB68D984BADBBB2EF84310F158469E905EB790DB35EC42CB90

Function 06DFB248 Relevance: .8, Instructions: 765COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fb9e9a695b28008445649404a2d30095e42b692e17f40fef9636d794a79df1
Instruction ID: 2accbb8abc2f1d9de6bc47bb215bd615600052ed28f1d4b3626df0e147b92df4
Opcode Fuzzy Hash: 66fb9e9a695b28008445649404a2d30095e42b692e17f40fef9636d794a79df1
Instruction Fuzzy Hash: 34525D70E202098FEF64DB69D4847AEB7B2FB89310F25852AE505EB351DB35DC81CB91

Function 06DFC190 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eec2836300e404c57920a867acc0177a89a09ed684bb749772adadd4c2744d5
Instruction ID: 6ca02bbba1dbb37c7af6a2183ff4d4f5c44b43555df00b852ce0ee532fe0b0f2
Opcode Fuzzy Hash: 3eec2836300e404c57920a867acc0177a89a09ed684bb749772adadd4c2744d5
Instruction Fuzzy Hash: 52329074B202098FDF54DB68E884BAEB7B2FB88310F118525D905EB351DB35EC52CB91

Function 06DF7D80 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbe4bd3316972369dcec62a086cc15f9f90d8f3bd5360c038b6613653170a5a
Instruction ID: 83301c4df2cee7545581c76bdc0689d9a0a62539f446c753aa7f54e93c9b8a5c
Opcode Fuzzy Hash: dfbe4bd3316972369dcec62a086cc15f9f90d8f3bd5360c038b6613653170a5a
Instruction Fuzzy Hash: 7502AD30B1121ACFDB54DB69E854AAEB7F2FF88210F118529D905DB350DB76EC82CB91

Function 06DE2872 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06DE28F6
GetCurrentThread.KERNEL32 ref: 06DE2933
GetCurrentProcess.KERNEL32 ref: 06DE2970
GetCurrentThreadId.KERNEL32 ref: 06DE29C9

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a7660d91497337970a7b4602b8b16c61e62bc28407479a1e07411ae2f10ddb58
Instruction ID: 09e76945f1bce61a40de26addcd6e91e63785fd9be6868fe69c42eeb7b89ff70
Opcode Fuzzy Hash: a7660d91497337970a7b4602b8b16c61e62bc28407479a1e07411ae2f10ddb58
Instruction Fuzzy Hash: 865167B0901349CFDB44EFAAD948BAEBBF1BF88314F208419E409A73A0D7755944CF65

Function 06DE2878 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06DE28F6
GetCurrentThread.KERNEL32 ref: 06DE2933
GetCurrentProcess.KERNEL32 ref: 06DE2970
GetCurrentThreadId.KERNEL32 ref: 06DE29C9

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 87f81d86737f67d27f19b68bf5a1564f41b373c302b6c32fc7ebbf86e325deee
Instruction ID: bb37f34ebaf02e358572a8340d4ea27f777a37a902d165ee2f00d8ec4d0c7ff1
Opcode Fuzzy Hash: 87f81d86737f67d27f19b68bf5a1564f41b373c302b6c32fc7ebbf86e325deee
Instruction Fuzzy Hash: A05166B09013498FDB44EFAAD948B9EBBF5FF88314F208019E409A73A0DB756944CF65

Function 06DEAF10 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06DEB176

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 47d0a3d1887abee22388ad8f7e3a96e1f2e455346f7c2cee7d3eae1b4c6d9f23
Instruction ID: 97e54688fc77aee86d3ad1ccf0731c72d22d50566c4b234ad0458907bfd4b9d9
Opcode Fuzzy Hash: 47d0a3d1887abee22388ad8f7e3a96e1f2e455346f7c2cee7d3eae1b4c6d9f23
Instruction Fuzzy Hash: 4E8168B0A00B068FD764EF6AD54475ABBF1FF88200F04892EE49AD7A50D775F845CBA1

Function 06DED0E4 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06DED202

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4e884979985a47efbded1fda4f402e0f1fb489c9cca32ce302468d7079fac372
Instruction ID: be4af9ac9a12d8d666bd3341f56e770bb7617c32cf4bd312ed5145cf5e15df24
Opcode Fuzzy Hash: 4e884979985a47efbded1fda4f402e0f1fb489c9cca32ce302468d7079fac372
Instruction Fuzzy Hash: 4051C1B1D0034DDFDB14DFA9C884ADEBBB6BF88310F64812AE819AB210D7759945CF90

Function 06DED0F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06DED202

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4377a61a5cc79efec04c64486e323e57092e07f6ef1c2f1470afc37d22ec6555
Instruction ID: 2335327a95489f51134bb2c0e3d059c36d9d75ee159ca7af37d185cbcd029b0d
Opcode Fuzzy Hash: 4377a61a5cc79efec04c64486e323e57092e07f6ef1c2f1470afc37d22ec6555
Instruction Fuzzy Hash: 7B41B1B1D00309DFDB14DF99C884ADEBBB6BF88310F64812AE819AB250DB759845CF90

Function 06DEA5EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06DEF8F1

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8ae5d2111546711de96032d313d15119b1f092de7e0934bf78432e0a8d1a5f8b
Instruction ID: cfd3d022ed4fcd20bf194b6998d8a361422cddfe754a47c8a8d56dacea757b60
Opcode Fuzzy Hash: 8ae5d2111546711de96032d313d15119b1f092de7e0934bf78432e0a8d1a5f8b
Instruction Fuzzy Hash: 32415AB4900709DFDB54EF99C888AAABBF5FB88314F258459D459A7321D734A841CFA0

Function 06DE2AB8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06DE2B47

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab8c04eecdd51c5855f863062a089435c2a9e1f4b22f0931da3df5acd449f435
Instruction ID: 8f9249d1b6eac7b675daeb65b0ea4479c477330e22e06e15e3f64912c51a57ae
Opcode Fuzzy Hash: ab8c04eecdd51c5855f863062a089435c2a9e1f4b22f0931da3df5acd449f435
Instruction Fuzzy Hash: EF21E4B5D00249DFDB10CFAAD884ADEBBF5FB48310F14841AE914A7350D378A951CFA4

Function 06DE2AC0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06DE2B47

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2877829976bbca19def1c45ed576decf9bbe570896400fc658d20ecaf7792f3f
Instruction ID: ad496f8e93b2ddfba1670c6aa69276febefc235effe03e11606eb10cbe5a01e5
Opcode Fuzzy Hash: 2877829976bbca19def1c45ed576decf9bbe570896400fc658d20ecaf7792f3f
Instruction Fuzzy Hash: F221E4B5D002099FDB10CFAAD884ADEFBF9FB48310F14801AE914A3350D378A940CFA4

Function 02F2EB1F Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02F2EB9F

Memory Dump Source

Source File: 00000005.00000002.3861220439.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f20000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 28d5027407f91d16220816587f380feeca1507cf98d0a11a73434d31307b157a
Instruction ID: 6b5009b5e197460d74e54d733f91db76b420857566c49e9ee46ad1578205442f
Opcode Fuzzy Hash: 28d5027407f91d16220816587f380feeca1507cf98d0a11a73434d31307b157a
Instruction Fuzzy Hash: C32133B1C0126A9FDB10CFAAC54579EFBF4BF49220F14816AD918B7240D378A905CFA5

Function 02F2EB38 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02F2EB9F

Memory Dump Source

Source File: 00000005.00000002.3861220439.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f20000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bc9e7a46f73f39ddc67d9eab3c3d6a7a33a63c5da4e2bfb9a39996b541121103
Instruction ID: 0124964fa0de43658fc0f0ba12e9b1dd58c375cde10ceee5b2dd5e02eefc5618
Opcode Fuzzy Hash: bc9e7a46f73f39ddc67d9eab3c3d6a7a33a63c5da4e2bfb9a39996b541121103
Instruction Fuzzy Hash: 471120B1C0066A9FDB10DFAAC444BDEFBF4BF48720F10816AD918A7240D378A944CFA5

Function 06DEB110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 06DEB176

Memory Dump Source

Source File: 00000005.00000002.3866058732.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6de0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0973ee971f5f65e6ce47ff530a438948857084d9234364d3ad9dfb6a6b3acd3e
Instruction ID: fec3ce17f06f4bde0d830e299feca1db6983009b0c1f3cf2a57543491a48bb93
Opcode Fuzzy Hash: 0973ee971f5f65e6ce47ff530a438948857084d9234364d3ad9dfb6a6b3acd3e
Instruction Fuzzy Hash: EF1110B5C003498FDB10DF9AC944BDEFBF4EB88220F10841AD429A7210C379A545CFA5

Function 06DFCF48 Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d94f95d899a580a37235096387a3fb4f0146432425b43bba091a6f0347f5eb8
Instruction ID: 29e428f4fc67117e8a56775dba12fcf11015b022347a0a4b62b748be5219d03c
Opcode Fuzzy Hash: 5d94f95d899a580a37235096387a3fb4f0146432425b43bba091a6f0347f5eb8
Instruction Fuzzy Hash: C7627F30B1031A8FCB55EB69E580A5DBBF2FF84700B218629D4059F35ADB75EC86CB81

Function 06DFB238 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b62cbc4ec11088134c55e00b6b578ab01c0d3f1230c46fbd1d5ccdbb9f1a6
Instruction ID: 93c543ce9727040244a85bccd118ca1a4de39d5874251286a84ef05e9dff31a1
Opcode Fuzzy Hash: c32b62cbc4ec11088134c55e00b6b578ab01c0d3f1230c46fbd1d5ccdbb9f1a6
Instruction Fuzzy Hash: C5A1A570F201098FEF64DB6CD4907AEBAA6FB89310F658426E505EB391CF39DC819B51

Function 06DF9158 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c64280f042fdd4ceb2d0740be743d3ef44fd7b7e949e496cd2d34e6de64e771
Instruction ID: 997fc1fd10a0a4410e9a265ad6fa75f41e4471e1de58d8dc5071a4ce6fae7276
Opcode Fuzzy Hash: 5c64280f042fdd4ceb2d0740be743d3ef44fd7b7e949e496cd2d34e6de64e771
Instruction Fuzzy Hash: AF915F70F1021ACFDB94DB69D8607AEB7F6EFC9200F108569C9099B344EE359D86CB91

Function 06DF61F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9db060a86ce7c80a941fd82001d62cec5a2a4b5457e8892570d0769c34c9ab1
Instruction ID: 0e458739b76c8cf9fef1192cf68737a3a49e4bfc4e2139553b03a9a2813605f0
Opcode Fuzzy Hash: a9db060a86ce7c80a941fd82001d62cec5a2a4b5457e8892570d0769c34c9ab1
Instruction Fuzzy Hash: E861C371F101214BDF64AB7EC880A5EBADBEFC4610B15443AD90ADB3A0DE66EC4287D5

Function 06DF42A1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccf38c906782486fab90fad3bf33bbf88218b09d0b2c10c8808e2505810686a
Instruction ID: 8f1d605ceb7d4902d2ce5ac8f4d175b907b1238b5afe3fb496a8dc25534bf7af
Opcode Fuzzy Hash: fccf38c906782486fab90fad3bf33bbf88218b09d0b2c10c8808e2505810686a
Instruction Fuzzy Hash: F4813C30B112098BDF54DFA8D4547AEBBF6AF89300F118529D90AEB395EF35DC428B51

Function 06DF42B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e981cb6839a5da36e91d688f977d7f78e6a2f3c539ba5640e776fdea0f61ce1
Instruction ID: 43acc58d8246e0454c8c76815bdcd1be6e5a2c21ea19e4b209c4a11e89b99544
Opcode Fuzzy Hash: 3e981cb6839a5da36e91d688f977d7f78e6a2f3c539ba5640e776fdea0f61ce1
Instruction Fuzzy Hash: C2812C30B112098BDF54DFA8D45476EBBF6AF89300F218529D90AEB395EF35DC428B51

Function 06DF45C4 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6a20e02a7a05c5dbc04d8342f3bb31360c6f7eebf5efc6b936633f8c2942fe
Instruction ID: d07fb30b8e00170429fffe9262e4b406f74e0d013bceaaf271a251dc4e063916
Opcode Fuzzy Hash: 2e6a20e02a7a05c5dbc04d8342f3bb31360c6f7eebf5efc6b936633f8c2942fe
Instruction Fuzzy Hash: 95914E30E1021A8BDF60DF68C890B9DB7B1FF89310F208699D549BB355DB71A985CF91

Function 06DFAF30 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c460a72fd24c2dfe961a01617173327a34034af48a04612ed404312386288c
Instruction ID: 1ded7f3f265219b782287878150f5611c903a9b3bf46cd3ec3f5aa20db006504
Opcode Fuzzy Hash: 56c460a72fd24c2dfe961a01617173327a34034af48a04612ed404312386288c
Instruction Fuzzy Hash: B7715C70E1071ACFDB54DFA9D49069EB7B2FF85200F11852AE909AB354EB759846CB80

Function 06DF45D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092cd4600e0c109541ef0ea4f67067eaa3b072ef734ee7b8d13bcba5421eb15e
Instruction ID: 08ccfffa08132069fa8a3a806a6edb88ee914f4f89ba1e1fa78b16b5392421eb
Opcode Fuzzy Hash: 092cd4600e0c109541ef0ea4f67067eaa3b072ef734ee7b8d13bcba5421eb15e
Instruction Fuzzy Hash: A2913E30E106198BDF60DF68C890B9EB7B1FF89310F208699D549BB355DB71AA85CF90

Function 06DFEB19 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60393968409899accd120497e32b6143409230c278fe3dd78d0ba8f199457039
Instruction ID: 0de548fc04728c46c840c4c4135c99dda48eb22dff1d200415439f72ff00dbb8
Opcode Fuzzy Hash: 60393968409899accd120497e32b6143409230c278fe3dd78d0ba8f199457039
Instruction Fuzzy Hash: 74714830A112099FDB54EFA9D980A9EBBF6FF88300F258429D505EB365DB30ED46CB50

Function 06DFFBB8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38edc18de328733daffe3835e19a84367de32f4376d22ea769e882df32ff5f5
Instruction ID: 4b52f6c354b8d3840e5091558dbbbf5bab30630cceeffbff482688280fe7e37c
Opcode Fuzzy Hash: e38edc18de328733daffe3835e19a84367de32f4376d22ea769e882df32ff5f5
Instruction Fuzzy Hash: A761E431F20119DFDF549F78E8846AEB7B2EF84311F12886AE606DB351DB358955CB80

Function 06DFEB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d1350b1b616d8effec1452ee82fabe88b43e1311ff834db348002fad8dcd7e
Instruction ID: 4e7ea6e730ac49af946872c8f940457d158ae3318ae6bf661c2f1797464c43f4
Opcode Fuzzy Hash: 24d1350b1b616d8effec1452ee82fabe88b43e1311ff834db348002fad8dcd7e
Instruction Fuzzy Hash: 3B713730A112099FDB54EFA9D980A9EBBF6FF88310F158429E505EB365DB30ED46CB50

Function 06DF4B70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e25c68e2a52118ea51300ef9e99b4e5ffef43d834bc80682345034888538c5
Instruction ID: a47cb122f8fc28cf019593d3bb2ef6a0b39131450336b0f6df0ee37665d4dc4e
Opcode Fuzzy Hash: 97e25c68e2a52118ea51300ef9e99b4e5ffef43d834bc80682345034888538c5
Instruction Fuzzy Hash: F661A170F102099FEB549FA9C8547AEBBF6FBC8700F20852AE506EB395DE758C459B40

Function 06DF9149 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e849e856d302fd72e49ce179c53ef17220cd9b65d541779ce15eea33f2ab41d3
Instruction ID: 156ae50686747b6f2d1f0769f1dc0e69597b82841eb526d178ec11771feec5aa
Opcode Fuzzy Hash: e849e856d302fd72e49ce179c53ef17220cd9b65d541779ce15eea33f2ab41d3
Instruction Fuzzy Hash: AA512D70B11106DFDB94DB68E860BAE77F6EF88600F108469D909DB394EE359D42CB91

Function 06DFF968 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5992915d55bc8348240f5d3d79c639878f054a4c804c3e95525531cb92c125f1
Instruction ID: 7a9b8d0194057e2780bcabbba04d633550ae89c54fb88a112241eb5be00debb5
Opcode Fuzzy Hash: 5992915d55bc8348240f5d3d79c639878f054a4c804c3e95525531cb92c125f1
Instruction Fuzzy Hash: E651C670B202059BEF605B7CD854B2F7A9AD7CA751F61442AE10BC73D2CE69CC8197A2

Function 06DFF978 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2778299cdacbbb555bf72940e9a83e8aa78f9c768ec2d2a747e2db92b7c48292
Instruction ID: 36ca30f2d665b526a4adcaf7f29c81da6cf9b890caa948c0b34dc2037efcb68a
Opcode Fuzzy Hash: 2778299cdacbbb555bf72940e9a83e8aa78f9c768ec2d2a747e2db92b7c48292
Instruction Fuzzy Hash: 3551D570B302049BEF605B6CD858B2F769BD7CD751F61442AE20BC7392CE69CC8197A2

Function 06DF4B60 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55124fdb85011a34e481c1385c5878d7ec4c42feeb06640d7fbc40f28a62b9e4
Instruction ID: 9fc4bd8ecc27d8ef16f8ce637770add7fa857c56d20b3ff3517c0156510a5b40
Opcode Fuzzy Hash: 55124fdb85011a34e481c1385c5878d7ec4c42feeb06640d7fbc40f28a62b9e4
Instruction Fuzzy Hash: 47419F70B102089FDB45DFA9C814B9EBBF6EFC8700F20852AE105AB395DE758C05DB90

Function 06DF5428 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61e54ef3c66e97060eb5643f20af1080c59b0a8ffd7d9661e80555d8692fe47
Instruction ID: 4f8ec51917c0663bfe2aca589c8129e8348922ffab977774b773fd8ed00c38ae
Opcode Fuzzy Hash: b61e54ef3c66e97060eb5643f20af1080c59b0a8ffd7d9661e80555d8692fe47
Instruction Fuzzy Hash: C4413D31E1060A8FDF70CF99E880AAFF7B2FB98310F11492AE216D7650D731E9558B91

Function 06DFDAD0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cde6c9a169775a9d963664d3e36b58b7493be6e688a003df27d169da8d619b
Instruction ID: bdd3e0898e0dff2a809e1b15b741eb63675a4efadf75fa31e96954b8fc03f27c
Opcode Fuzzy Hash: d4cde6c9a169775a9d963664d3e36b58b7493be6e688a003df27d169da8d619b
Instruction Fuzzy Hash: A0418E30E1030A9FDB64DF65C48469EBBB2FF85700F214929E906EB244EB70D846DB81

Function 06DFDABD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acaa96bc9b0b5211fc68fba946aaf509d71b5ecb354e5caef641561207bd3ca
Instruction ID: 509d8d82ff2695583b3df50732b827b8772b230d74f6b0c1e74ffa2050c91f14
Opcode Fuzzy Hash: 3acaa96bc9b0b5211fc68fba946aaf509d71b5ecb354e5caef641561207bd3ca
Instruction Fuzzy Hash: C841CE30E203199FDF65DF65C48469EBBB3FF85600F11492AE902EB240EB70E946DB90

Function 06DF21B5 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07831daae7535e3db24eed6579891b27e8ea88f924eabb382d2967a75f094330
Instruction ID: cf07f3cda5eca0fb46d7204bd2837960eeb2ada7c64b5cabdb1c13442222ffb2
Opcode Fuzzy Hash: 07831daae7535e3db24eed6579891b27e8ea88f924eabb382d2967a75f094330
Instruction Fuzzy Hash: B631FE30B10206CFDBA89FB8D4946AE7BB2BF89610F158529D402DB394DF36CD46CB91

Function 06DF21C8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e7918e2fd7cb945e248756dcddcb6128892a05e170988b092ded441b560b3e
Instruction ID: 6b0fc32629238a8773dc7d14b7a45fcb2f8da3215942beeb07ab958416302e1f
Opcode Fuzzy Hash: e0e7918e2fd7cb945e248756dcddcb6128892a05e170988b092ded441b560b3e
Instruction Fuzzy Hash: C431D230B102068FDBA89BB8D45466E7BF2BF89610F25842DD502DB394DF35CD46D791

Function 06DFD970 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625ba2d4c876e3787a415f9eae0a11a3fc71971db876ef99606a3e8606d2846b
Instruction ID: e74042d7904c3523b14b8c8db41f90edf40ee84229dfc4f66a9adabc16c933c8
Opcode Fuzzy Hash: 625ba2d4c876e3787a415f9eae0a11a3fc71971db876ef99606a3e8606d2846b
Instruction Fuzzy Hash: A531B430E2071A8FDF15DF68D88069DBBF2FF85204F148929D901EB345EB71E8468B81

Function 06DF2079 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209289646c970ebf92fc09226c7f2e84178374c40e4f7c1e6d4aeec9a60a3aec
Instruction ID: 7ec08f6fd294d05ecc5c1537deb2e1c637393e6fcb4698a48af523e7812a7eb0
Opcode Fuzzy Hash: 209289646c970ebf92fc09226c7f2e84178374c40e4f7c1e6d4aeec9a60a3aec
Instruction Fuzzy Hash: 18317034E206099FCB54CFA9D89469EBBB2FF89300F108519E905EB350EB71AD42CB50

Function 06DF2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f21f08a63e31fb68bcb87d4f16af99bfef433d42dfeff92d524c216a9aec0b
Instruction ID: 97e845e6f6570360432a05daeffc0e4f314d7b04aa949b3c4b8eb2b3149059f4
Opcode Fuzzy Hash: f1f21f08a63e31fb68bcb87d4f16af99bfef433d42dfeff92d524c216a9aec0b
Instruction Fuzzy Hash: F9314234E206099FDB54CFA9D89469EB7B2FF89300F118519E906EB750DB71AD42CB50

Function 06DF3AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d23443899c883e16f057b1561745b3988a6859866969a398f7c18b800b3656a
Instruction ID: 7195724568ea77cbef5066d3104761ab0b85e665dcad1030b1f80460ceb3303c
Opcode Fuzzy Hash: 9d23443899c883e16f057b1561745b3988a6859866969a398f7c18b800b3656a
Instruction Fuzzy Hash: AC217A75F10615DFDB50CFA9E890AAEBBF5EB48710F128469EA05E7381EB35DC408B90

Function 06DF3AAE Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b831741cdeea202b657fe7c83df54945f4bbac52b59a42ecdedb473fa515d97
Instruction ID: d1f74144fe87341890724f1081382c7aa375707ec4878f47db594d61f75fcf69
Opcode Fuzzy Hash: 1b831741cdeea202b657fe7c83df54945f4bbac52b59a42ecdedb473fa515d97
Instruction Fuzzy Hash: BA217871F10615DFDB40CFA9E890AAEBBF5EB88610F128465EA05E7381EB35DC418B90

Function 0149D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3860726292.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_149d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a078135f2fff293669baac420e7653760802e0facabeb398737de85729093cf1
Instruction ID: 183cccb2112200f09419a53d8a577081c2629e40151e6bf155de1f45f2979cc7
Opcode Fuzzy Hash: a078135f2fff293669baac420e7653760802e0facabeb398737de85729093cf1
Instruction Fuzzy Hash: 962100B5A04304DFDF15DF94D984B26BFA1FB84218F20C56ED80A0B3A2C33AD447CA62

Function 0149D006 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3860726292.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_149d000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7626a5537e912645f61d1979840f7cbe966ad864844f8c6decaab75ea2fb1d22
Instruction ID: 4e23ed95f1942728e549aa95e75a29b0ec3a4491e9e5453ebfbe66172c080f64
Opcode Fuzzy Hash: 7626a5537e912645f61d1979840f7cbe966ad864844f8c6decaab75ea2fb1d22
Instruction Fuzzy Hash: EA215C755493C09FCB07CF64D994711BF71AB46224F29C5DBD8898F2A7C23A980ACB62

Function 06DF6D18 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924ede9104506e1b582c9bb907140f3a0924fa19fd2960ab27fc740d15d2c8b5
Instruction ID: 59ff6f8be0177785cc4787e99dc870fa4e06eb1941dde38ec40b0377aff0e8f1
Opcode Fuzzy Hash: 924ede9104506e1b582c9bb907140f3a0924fa19fd2960ab27fc740d15d2c8b5
Instruction Fuzzy Hash: 2021DF30B201189BDF94DB69F85869EB7F6EFC4310F218429D905E7380DB32EC818B80

Function 06DF3060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a37776c534312c48851936f10599efd6b5fe206ed324bd8cc2f98fc8f0ad87f
Instruction ID: 469dfb69606f81d937d9b37617f966c415db8f5493d417b230cefc43d8580eab
Opcode Fuzzy Hash: 4a37776c534312c48851936f10599efd6b5fe206ed324bd8cc2f98fc8f0ad87f
Instruction Fuzzy Hash: 38115E71E102299FCF54DF79D8805DEB7B5EB89310F1285AAD506EB200DA31D985CBE1

Function 06DF4200 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cb34d9cc735c3d7a814b892e26739cb0094e7ae4dd11a161149af70057e472
Instruction ID: 88690905f15989f9ee6dfe710cc3cd9e8ae069d4c6a8ccbafde2aee354c35172
Opcode Fuzzy Hash: 78cb34d9cc735c3d7a814b892e26739cb0094e7ae4dd11a161149af70057e472
Instruction Fuzzy Hash: 5A01F535B252100FDBA2C7BC981576F77DADFCA610F15843AE10ACB382DE26CC424791

Function 06DF3BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b21e75124c3ac3bad3a24f5382553c1cc1a73bb8763628fe98ccbbc3eade12
Instruction ID: cc9483b652372c604cd34b47bdaf4a9012dbbef4f2186dcb8089398927d25e0e
Opcode Fuzzy Hash: a5b21e75124c3ac3bad3a24f5382553c1cc1a73bb8763628fe98ccbbc3eade12
Instruction Fuzzy Hash: A1116531B141298FDF949B68D8146AE77EAEBC8350F028539D906E7340EE75DC028BD1

Function 06DFED99 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761ae9709892f75510ea4f9193e543024eea0b1dc771cf5f827958bb1ad6e062
Instruction ID: cbfba3c3c6ca1e6e3c91de7039e01534301df7dded8c603b7a09c63c0e79663f
Opcode Fuzzy Hash: 761ae9709892f75510ea4f9193e543024eea0b1dc771cf5f827958bb1ad6e062
Instruction Fuzzy Hash: 1701D430B24210AFDB62DB7CA85073E77DADBCA620F11883AF609C7391EA65CC424791

Function 06DF3878 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d7e727210e50f2dff605b901254731bbae587030984db39096b64fccf44a22
Instruction ID: 2455616a615c180c4134dc6b957377b57da449a3e0f413a205bcf57312f0fb83
Opcode Fuzzy Hash: 28d7e727210e50f2dff605b901254731bbae587030984db39096b64fccf44a22
Instruction Fuzzy Hash: 8821C0B5D01259AFDB00DF9AD985ADEFBB4BB48210F11812AE518A7240C374A554CFA4

Function 06DFA311 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17c3346bf1b3b8c64fd6e1e87d59a7e0782743e6afe23ea3bb335bd4c80e3b4
Instruction ID: 930a71104d2982ec8cd8e665ba935fe4c079b829a0382f2ea44dc72d21515093
Opcode Fuzzy Hash: b17c3346bf1b3b8c64fd6e1e87d59a7e0782743e6afe23ea3bb335bd4c80e3b4
Instruction Fuzzy Hash: 2601F130B252158FC791D7BCE850A1F7BE2EB8A640F08882AE50ECB351DA25DC028340

Function 06DF3880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46c683db94c90caa4e71d432fe3d96d574cd8bb594a5b2a7cceabf3788f91e7
Instruction ID: 1d5dd8643c507ced3cae671c61ab412dd8805bd34515bd0ae56761939b9be682
Opcode Fuzzy Hash: f46c683db94c90caa4e71d432fe3d96d574cd8bb594a5b2a7cceabf3788f91e7
Instruction Fuzzy Hash: 4211D0B5D01259AFCB00DF9AD884ACEFFB4FB48710F11812AE918A7340C378A954CFA5

Function 06DF4210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7385c93167d865b851f7a200ed2a090b98d2fd7b0672ea6aac0bd543a8fd8d
Instruction ID: c6bd24896ea9fcc7f9a397c1b351f1d2e63af3efa9105726db1845f1fd8ec809
Opcode Fuzzy Hash: bf7385c93167d865b851f7a200ed2a090b98d2fd7b0672ea6aac0bd543a8fd8d
Instruction Fuzzy Hash: FB01D131B205140BDBA0D7BDD404B2FB3DAEBC9A10F10843AE20EC7381EE26DC424791

Function 06DF3BAF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af3c7f75555d37183ece67379c42be01f5e5ebb1bcfcc1259833797eaa28f27
Instruction ID: e115a539ddb191960b3308cbd13ad0c65cbbdda2233628ff2882528751a56edc
Opcode Fuzzy Hash: 7af3c7f75555d37183ece67379c42be01f5e5ebb1bcfcc1259833797eaa28f27
Instruction Fuzzy Hash: 0301A775B241288BDF949B6CE8143EF77AB9BC8200F06853AD90AE3280EE75CC0247D1

Function 06DFEDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c5e10fd4786689384eaf3ff9f784070b1c870d3597bd641feaa78046f71aa2
Instruction ID: 15af21b940e2adfb3c3a1ca96a223243c217f8aabb9827a1cc0587bc091f60ec
Opcode Fuzzy Hash: 52c5e10fd4786689384eaf3ff9f784070b1c870d3597bd641feaa78046f71aa2
Instruction Fuzzy Hash: EE018131B20115ABDB64D77DA85472F77DADBC9A20F10843AE60EC7350EE65DC424781

Function 06DFA320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dbd97720914151a9e09995001912572bb7e8460dab42fbcfb9f0d2572b72b3
Instruction ID: 31b2e7e0792db8c5197ba3b3f79c7d574f98b07abc8c939933b68a7f795c4ce9
Opcode Fuzzy Hash: 25dbd97720914151a9e09995001912572bb7e8460dab42fbcfb9f0d2572b72b3
Instruction Fuzzy Hash: 8A013130B201158FDB50EBBCE85471E77D5EB8A651F148839E60ECB350EE25ED428781

Function 06DF82D0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f9a830be2a5098e43e6cafa21800d1223eb159c41041e78abb945c9e3fa525
Instruction ID: 33669ef82f6bd163b2b1aa839306f45eb1798a632cee3f7c0fb22e5a79d5ed2f
Opcode Fuzzy Hash: a0f9a830be2a5098e43e6cafa21800d1223eb159c41041e78abb945c9e3fa525
Instruction Fuzzy Hash: 6CF0AF35B20205DFDFA88B58F98066CB3F4EB44211F168066DA05DB261DB35EE42E753

Function 06DFC7D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31caa1311d56797bf9d5c5361e57992e6dfae0b3596c16519a1d0633e72961c9
Instruction ID: d3e2879981c4f6a37eb97e9b13f53ca3a6b0eea1f7919c123c068757a7b6c8fa
Opcode Fuzzy Hash: 31caa1311d56797bf9d5c5361e57992e6dfae0b3596c16519a1d0633e72961c9
Instruction Fuzzy Hash: 6DF0A032F30238ABDB145B69EC14AEBB77AF784354F01442AEE01E7241DA32AD54CBD0

Function 06DF6470 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a8053c5f949f11a3866895305b03115740b52127e97ef377e5b89e39d75da6
Instruction ID: 7483c591c2909a9ab733dba727bd77f05274791725b07023f4627c7ed62315b4
Opcode Fuzzy Hash: 26a8053c5f949f11a3866895305b03115740b52127e97ef377e5b89e39d75da6
Instruction Fuzzy Hash: 61E0D871E291485FDF50DFB0DE5539E377ADB4A204F2248A6D505CB141E136CD058350

Function 06DF6480 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3866116642.0000000006DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6df0000_CHARIKLIA JUNIOR DETAILS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction ID: 558805d3f511a357c3c495097fac6b2c2716b10fdb8b919515b5b2d7407fc5d4
Opcode Fuzzy Hash: aa976699a50b98a0a6b50c08d3026a88d70fc42e5459dfcadbf44bb0d2ea6d04
Instruction Fuzzy Hash: 17E0C270E34108ABDF50EFB0CA4575A73ADDB06218F2288A4D908CB601E132DE014380

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CHARIKLIA JUNIOR DETAILS.pdf.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cwsuu0sb.sq3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqultexp.2j3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqsknafn.34x.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrbdbnsw.yx3.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
CHARIKLIA JUNIOR DETAILS.pdf.scr.exe

Function 0115CF90 Relevance: 6.1, APIs: 4, Instructions: 135
threadCOMMON

Function 0115CFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 05837A4D Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 05837A58 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0115AD08 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 011558EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 011544B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 058377C8 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 05837630 Relevance: 1.6, APIs: 1, Instructions: 71
threadCOMMON

Function 0115D5E8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 058377D0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 058378B8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 05837638 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 058378C0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 0115D5F0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre