Edit tour

Windows Analysis Report
MV BBG MUARA Ship's Particulars.pdf.scr.exe

Overview

General Information

Sample name:	MV BBG MUARA Ship's Particulars.pdf.scr.exe
Analysis ID:	1560137
MD5:	1779ee90e122ebe86f1bddc4ec06440d
SHA1:	e8842b83a180e7589e366bd61b08f59a87a71734
SHA256:	941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
Tags:	exeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MV BBG MUARA Ship's Particulars.pdf.scr.exe (PID: 6712 cmdline: "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe" MD5: 1779EE90E122EBE86F1BDDC4EC06440D)

powershell.exe (PID: 3288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MV BBG MUARA Ship's Particulars.pdf.scr.exe (PID: 796 cmdline: "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe" MD5: 1779EE90E122EBE86F1BDDC4EC06440D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x312d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31345:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x313cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31461:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x314cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3153d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x315d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31663:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6c6:$s2: GetPrivateProfileString 0x2ddc5:$s3: get_OSFullName 0x2f403:$s5: remove_Key 0x2f592:$s5: remove_Key 0x30473:$s6: FtpWebRequest 0x312b5:$s7: logins 0x31827:$s7: logins 0x3450a:$s7: logins 0x345ea:$s7: logins 0x35ee6:$s7: logins 0x35184:$s9: 1.85 (Hash, version 2, native byte-order)
4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330d3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d6f3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33145:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d765:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331cf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d7ef:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33261:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d881:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d8eb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3333d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d95d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d9f3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33463:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6da83:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304c6:$s2: GetPrivateProfileString 0x6aae6:$s2: GetPrivateProfileString 0x2fbc5:$s3: get_OSFullName 0x6a1e5:$s3: get_OSFullName 0x31203:$s5: remove_Key 0x31392:$s5: remove_Key 0x6b823:$s5: remove_Key 0x6b9b2:$s5: remove_Key 0x32273:$s6: FtpWebRequest 0x6c893:$s6: FtpWebRequest 0x330b5:$s7: logins 0x33627:$s7: logins 0x3630a:$s7: logins 0x363ea:$s7: logins 0x37ce6:$s7: logins 0x6d6d5:$s7: logins 0x6dc47:$s7: logins 0x7092a:$s7: logins 0x70a0a:$s7: logins 0x72306:$s7: logins 0x36f84:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 17 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe, ParentProcessId: 6712, ParentProcessName: MV BBG MUARA Ship's Particulars.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", ProcessId: 3288, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", ParentImage: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe, ParentProcessId: 6712, ParentProcessName: MV BBG MUARA Ship's Particulars.pdf.scr.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe", ProcessId: 3288, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://beirutrest.com", "Username": "belogs@beirutrest.com", "Password": "9yXQ39wz(uL+"}

Multi AV Scanner detection for submitted file

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Joe Sandbox ML: detected

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Code function: 4x nop then jmp 06C99175h

0_2_06C991BC

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 50.87.144.157 50.87.144.157

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: beirutrest.com

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://beirutrest.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4192547572.000000000641A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820131384.00000000025BA000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet.xsd
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet1.xsd
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe	String found in binary or memory: http://tempuri.org/ianiDataSet2.xsdM
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1822825090.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comhs
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49735 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_00B5D51C	0_2_00B5D51C
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C9AF01	0_2_06C9AF01
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C91E70	0_2_06C91E70
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C94E30	0_2_06C94E30
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C95268	0_2_06C95268
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C971E8	0_2_06C971E8
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C949F8	0_2_06C949F8
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C96900	0_2_06C96900
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_06C96910	0_2_06C96910
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051EE5B8	4_2_051EE5B8
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051EDD38	4_2_051EDD38
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051E3E40	4_2_051E3E40
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051E4A58	4_2_051E4A58
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051EAA9A	4_2_051EAA9A
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051E4188	4_2_051E4188
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06908970	4_2_06908970
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0690B5F8	4_2_0690B5F8
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06917D80	4_2_06917D80
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_069155A0	4_2_069155A0
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_069165F0	4_2_069165F0
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0691B238	4_2_0691B238
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06913060	4_2_06913060
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0691C190	4_2_0691C190
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_069176A0	4_2_069176A0
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06915CE3	4_2_06915CE3
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0691E3A8	4_2_0691E3A8
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06910040	4_2_06910040
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_06910006	4_2_06910006
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0691055C	4_2_0691055C

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820131384.00000000025C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1822920441.00000000050B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718857892.0000000000120000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGfhv.exe4 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823913098.00000000070F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1819458942.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820131384.00000000025BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2ee75d06-d489-4537-90fc-92fe0f559436.exe4 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186955073.0000000000BF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MV BBG MUARA Ship's Particulars.pdf.scr.exe
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe	Binary or memory string: OriginalFilenameGfhv.exe4 vs MV BBG MUARA Ship's Particulars.pdf.scr.exe

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/4@2/2

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV BBG MUARA Ship's Particulars.pdf.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11lz2jrg.ahb.ps1

Jump to behavior

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PLAN] ([CREDIT_ID], [MATURITY_DATE], [MATURITY_SUM], [MATURITY_NOTE], [MODIF_DATE]) VALUES (@CREDIT_ID, @MATURITY_DATE, @MATURITY_SUM, @MATURITY_NOTE, @MODIF_DATE);
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE], [INTEREST]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE, @INTEREST);
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[Login] SET [User_id] = @User_id, [User_pass] = @User_pass WHERE (([User_id] = @Original_User_id) AND ([User_pass] = @Original_User_pass));
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT_PLAN] SET [CREDIT_ID] = @CREDIT_ID, [MATURITY_DATE] = @MATURITY_DATE, [MATURITY_SUM] = @MATURITY_SUM, [MATURITY_NOTE] = @MATURITY_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([MATURITY_ID] = @Original_MATURITY_ID) AND ((@IsNull_CREDIT_ID = 1 AND [CREDIT_ID] IS NULL) OR ([CREDIT_ID] = @Original_CREDIT_ID)) AND ([MATURITY_DATE] = @Original_MATURITY_DATE) AND ([MATURITY_SUM] = @Original_MATURITY_SUM) AND ((@IsNull_MATURITY_NOTE = 1 AND [MATURITY_NOTE] IS NULL) OR ([MATURITY_NOTE] = @Original_MATURITY_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[PROD_PERIODS] ([PROD_CODE], [PROD_PERIOD]) VALUES (@PROD_CODE, @PROD_PERIOD);
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[INTEREST] SET [PROD_CODE] = @PROD_CODE, [PROD_PERIOD] = @PROD_PERIOD, [SUM_FROM] = @SUM_FROM, [SUM_TO] = @SUM_TO WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_PERIOD] = @Original_PROD_PERIOD) AND ([SUM_FROM] = @Original_SUM_FROM) AND ([SUM_TO] = @Original_SUM_TO));
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT] SET [CREDIT_NO] = @CREDIT_NO, [CREDIT_DATE] = @CREDIT_DATE, [CREDIT_PERIOD] = @CREDIT_PERIOD, [CREDIT_END_DATE] = @CREDIT_END_DATE, [CREDIT_BEGIN_DATE] = @CREDIT_BEGIN_DATE, [CLIENT_ID] = @CLIENT_ID, [PROD_CODE] = @PROD_CODE, [CREDIT_SUM] = @CREDIT_SUM, [CREDIT_NOTE] = @CREDIT_NOTE, [MODIF_DATE] = @MODIF_DATE WHERE (([CREDIT_ID] = @Original_CREDIT_ID) AND ([CREDIT_NO] = @Original_CREDIT_NO) AND ((@IsNull_CREDIT_DATE = 1 AND [CREDIT_DATE] IS NULL) OR ([CREDIT_DATE] = @Original_CREDIT_DATE)) AND ([CREDIT_PERIOD] = @Original_CREDIT_PERIOD) AND ((@IsNull_CREDIT_END_DATE = 1 AND [CREDIT_END_DATE] IS NULL) OR ([CREDIT_END_DATE] = @Original_CREDIT_END_DATE)) AND ((@IsNull_CREDIT_BEGIN_DATE = 1 AND [CREDIT_BEGIN_DATE] IS NULL) OR ([CREDIT_BEGIN_DATE] = @Original_CREDIT_BEGIN_DATE)) AND ([CLIENT_ID] = @Original_CLIENT_ID) AND ((@IsNull_PROD_CODE = 1 AND [PROD_CODE] IS NULL) OR ([PROD_CODE] = @Original_PROD_CODE)) AND ([CREDIT_SUM] = @Original_CREDIT_SUM) AND ((@IsNull_CREDIT_NOTE = 1 AND [CREDIT_NOTE] IS NULL) OR ([CREDIT_NOTE] = @Original_CREDIT_NOTE)) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE [dbo].[CREDIT_PRODUCT] SET [PROD_NAME] = @PROD_NAME, [PROD_ACTIVE] = @PROD_ACTIVE, [PROD_SUM_FROM] = @PROD_SUM_FROM, [PROD_SUM_TO] = @PROD_SUM_TO, [MODIF_DATE] = @MODIF_DATE WHERE (([PROD_CODE] = @Original_PROD_CODE) AND ([PROD_NAME] = @Original_PROD_NAME) AND ([PROD_ACTIVE] = @Original_PROD_ACTIVE) AND ([PROD_SUM_FROM] = @Original_PROD_SUM_FROM) AND ([PROD_SUM_TO] = @Original_PROD_SUM_TO) AND ((@IsNull_MODIF_DATE = 1 AND [MODIF_DATE] IS NULL) OR ([MODIF_DATE] = @Original_MODIF_DATE)));
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000000.1718710623.0000000000032000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO [dbo].[CREDIT_PRODUCT] ([PROD_NAME], [PROD_ACTIVE], [PROD_SUM_FROM], [PROD_SUM_TO], [MODIF_DATE]) VALUES (@PROD_NAME, @PROD_ACTIVE, @PROD_SUM_FROM, @PROD_SUM_TO, @MODIF_DATE);

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 0_2_00B5DB84 pushfd ; ret	0_2_00B5DB89
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051E0C55 push edi; retf	4_2_051E0C7A
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_051EA9E0 push eax; iretd	4_2_051EAA99
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Code function: 4_2_0690F6F0 push es; ret	4_2_0690F6F4

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Static PE information: section name: .text entropy: 7.528323979837935

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.scr

Static PE information: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 7370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 8370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 8520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 9520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Memory allocated: 4CE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598122	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594219	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2376	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 823	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Window / User API: threadDelayed 1867	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Window / User API: threadDelayed 7987	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 5680	Thread sleep count: 1867 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 5680	Thread sleep count: 7987 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -598122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe TID: 4584	Thread sleep time: -594219s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 598122	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Thread delayed: delay time: 594219	Jump to behavior

Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1824315473.0000000007187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}q
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1824315473.0000000007187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\!
Source: MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4187413405.0000000001073000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Memory written: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"			Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Process created: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"			Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 796, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 796, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.37b3500.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV BBG MUARA Ship's Particulars.pdf.scr.exe.3778ee0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 6712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MV BBG MUARA Ship's Particulars.pdf.scr.exe PID: 796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	13 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MV BBG MUARA Ship's Particulars.pdf.scr.exe	47%	ReversingLabs	Win32.Spyware.Negasteal
MV BBG MUARA Ship's Particulars.pdf.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.sakkal.comhs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
beirutrest.com	50.87.144.157	true	false		high
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/ianiDataSet2.xsdM	MV BBG MUARA Ship's Particulars.pdf.scr.exe	false		high
http://www.tiro.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/ianiDataSet.xsd	MV BBG MUARA Ship's Particulars.pdf.scr.exe	false		high
http://www.sajatypeworks.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/ianiDataSet1.xsd	MV BBG MUARA Ship's Particulars.pdf.scr.exe	false		high
http://www.founder.com.cn/cn	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1820131384.00000000025BA000.00000004.00000800.00020000.00000000.sdmp, MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1823002760.00000000066B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.comhs	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000000.00000002.1822825090.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beirutrest.com	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	MV BBG MUARA Ship's Particulars.pdf.scr.exe, 00000004.00000002.4192547572.000000000641A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
50.87.144.157	beirutrest.com	United States		46606	UNIFIEDLAYER-AS-1US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560137
Start date and time:	2024-11-21 13:05:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MV BBG MUARA Ship's Particulars.pdf.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/4@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 91 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: MV BBG MUARA Ship's Particulars.pdf.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
07:06:13	API Interceptor	10528336x Sleep call for process: MV BBG MUARA Ship's Particulars.pdf.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
50.87.144.157	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COSCO SHIPPING WISDOM VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beirutrest.com	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	01. MT JS JIANGYIN Ship Particulars.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	ESTEEM ASTRO PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	Q88.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	COSCO SHIPPING WISDOM VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	EVER ABILITY V66 PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	MV. NORDRHONE VSL's PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
api.ipify.org	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	104.26.12.205
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	104.26.12.205
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.67.74.152
	order and drawings_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	104.17.25.14
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	172.64.41.3
UNIFIEDLAYER-AS-1US	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.185.3.195
	https://1.midlifemouse.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVFXRTNlSFU9JnVpZD1VU0VSMTIxMTIwMjRVNTUxMTEyMjQ=N0123Nexample@email.com	Get hash	malicious	Unknown	Browse	67.20.112.200
	https://lmmoye.org/file/oL/xzw/	Get hash	malicious	Unknown	Browse	69.49.234.173
	USD470900_COPY_800BLHSBC882001_NOV202024.PDF.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.172.172.178
	Delivery_Notification_000275578.doc.js	Get hash	malicious	Unknown	Browse	162.241.225.96
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse	216.172.172.178
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	arm7.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	162.144.165.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PO#83298373729383838392387373873PDF.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	104.26.12.205
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	PO-841122676_g787.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.12.205
	Order requirements CIF Greece_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.205
	https://voyages-moinschers.fr/request/index.html?userid=viviane.beigbeder@idcom-france.com	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllulx/:NllU
MD5:	F57B3C748887161F8BB93941BD4BD122
SHA1:	95E5C6DE8FCECC4F1DA4FF59498636E99971AF92
SHA-256:	0723E06FAA4F308175FD8F153940229C06201CE6C82D16075320F26E777C3904
SHA-512:	E11AF9E36F6DF3DAFB703A84757CB511A346BDC433C1A8A3B1907248CC53EC4CB42A3C8B16A42E5D72BBF6A9E942AF4C73C9001A58070E0476AE8B4A0B3291FB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................L.........................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11lz2jrg.ahb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhln2n40.zeh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.526239595566343
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	MV BBG MUARA Ship's Particulars.pdf.scr.exe
File size:	979'456 bytes
MD5:	1779ee90e122ebe86f1bddc4ec06440d
SHA1:	e8842b83a180e7589e366bd61b08f59a87a71734
SHA256:	941559a78b6e1caf39212048e7f62723e5f283d1942858cc07a339d6d6b24362
SHA512:	a5b84316604b0728cf6cd29409f68a9b4b41b8437bf39ead5bac4ba7806339adeabd848c352a7b90be6bfbf57c709a3a1636ea2f0d655c0cce6b2f95e4c9faaf
SSDEEP:	12288:/csCELA+12Hd5lpvS36pDfi/xN3xIZrzfBVzxWWKy5siBjVE4wPLXkYVx5OjuRZx:0zf/zxWu5zW4wjkTuRZOVFuxztsrG
TLSH:	1825B02077F8DD67E27A61B3EAC8421197B6D146767BE3AA0CD560CE25C27321383D27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>g..............0......(......^.... ........@.. .......................`............@................................

File Icon


Icon Hash:	130b253d1931012d

Static PE Info

General

Entrypoint:	0x4ee65e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x673E9A8A [Thu Nov 21 02:27:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xee60c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf0000	0x2588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xec664	0xec800	a725ee12878a504296537ae23b36c3c2	False	0.73659755714852	data	7.528323979837935	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf0000	0x2588	0x2600	0c2ed23f4b73d34a7def91b7ee71a2d0	False	0.8751027960526315	data	7.577009356017859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf4000	0xc	0x200	56d29d29c24a75d76e7ed4e57186142c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xf0100	0x2016	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9504504504504504
RT_GROUP_ICON	0xf2128	0x14	data	1.05
RT_VERSION	0xf214c	0x23c	data	0.46853146853146854
RT_MANIFEST	0xf2398	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:06:17.435720921 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:17.435758114 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:17.435834885 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:17.601142883 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:17.601165056 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:18.870743990 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:18.870845079 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:18.875483036 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:18.875503063 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:18.875884056 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:18.929224968 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:19.011527061 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:19.059338093 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:19.348870993 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:19.349035025 CET	443	49735	104.26.12.205	192.168.2.4
Nov 21, 2024 13:06:19.349309921 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:19.390930891 CET	49735	443	192.168.2.4	104.26.12.205
Nov 21, 2024 13:06:21.279850960 CET	49736	21	192.168.2.4	50.87.144.157
Nov 21, 2024 13:06:21.399930000 CET	21	49736	50.87.144.157	192.168.2.4
Nov 21, 2024 13:06:21.400029898 CET	49736	21	192.168.2.4	50.87.144.157
Nov 21, 2024 13:06:21.409563065 CET	49736	21	192.168.2.4	50.87.144.157
Nov 21, 2024 13:06:21.529881001 CET	21	49736	50.87.144.157	192.168.2.4
Nov 21, 2024 13:06:21.529959917 CET	49736	21	192.168.2.4	50.87.144.157

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 13:06:17.114108086 CET	63893	53	192.168.2.4	1.1.1.1
Nov 21, 2024 13:06:17.340250969 CET	53	63893	1.1.1.1	192.168.2.4
Nov 21, 2024 13:06:20.755846977 CET	52038	53	192.168.2.4	1.1.1.1
Nov 21, 2024 13:06:21.279093027 CET	53	52038	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 13:06:17.114108086 CET	192.168.2.4	1.1.1.1	0x1bcf	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:06:20.755846977 CET	192.168.2.4	1.1.1.1	0xe576	Standard query (0)	beirutrest.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 13:06:17.340250969 CET	1.1.1.1	192.168.2.4	0x1bcf	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:06:17.340250969 CET	1.1.1.1	192.168.2.4	0x1bcf	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:06:17.340250969 CET	1.1.1.1	192.168.2.4	0x1bcf	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 21, 2024 13:06:21.279093027 CET	1.1.1.1	192.168.2.4	0xe576	No error (0)	beirutrest.com	50.87.144.157	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.26.12.205	443	796	C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 12:06:19 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-21 12:06:19 UTC	399	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 12:06:19 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8e608d91dda3427c-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1602&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1808049&cwnd=242&unsent_bytes=0&cid=75797b4134375d66&ts=492&x=0"
2024-11-21 12:06:19 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Target ID:	0
Start time:	07:06:04
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Imagebase:	0x30000
File size:	979'456 bytes
MD5 hash:	1779EE90E122EBE86F1BDDC4EC06440D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1820711879.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:06:14
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Imagebase:	0x390000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:06:15
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:06:14
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV BBG MUARA Ship's Particulars.pdf.scr.exe"
Imagebase:	0x970000
File size:	979'456 bytes
MD5 hash:	1779EE90E122EBE86F1BDDC4EC06440D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4188253761.0000000002D5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4186764037.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.4188253761.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.3%
Total number of Nodes:	159
Total number of Limit Nodes:	11

Executed Functions

Function 06C9AF01 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbefa349140b259a8df58d69f4570726d75490180ac9270ad1b923397441fcbe
Instruction ID: f8f030ec36b35ea3bcbde48e59971dffc06026c6f17eab32cf2e54501d0fabac
Opcode Fuzzy Hash: dbefa349140b259a8df58d69f4570726d75490180ac9270ad1b923397441fcbe
Instruction Fuzzy Hash: 19E1CC70B006049FDB69DBB5C558BAFBBF6AF89700F1444ADE106AB290CB35ED05CB61

Function 06C991BC Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57c8a021b669e29d11636925a5b9498e115ae7f5b24687174022745e2cbc484
Instruction ID: 4ffb249f9cce37f623c440b96018a2cb94e07172f6022e60a31c0d135acd43c6
Opcode Fuzzy Hash: e57c8a021b669e29d11636925a5b9498e115ae7f5b24687174022745e2cbc484
Instruction Fuzzy Hash: 08414A71D44619CFEB64CF55C848BE9BBB9BF4A300F1495AAD519A2240EB709AC1CF90

Function 06C91E70 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04534e5107c7355dda962c728b31a530e658fe08fe3bbd2eacde53aa1c83fd88
Instruction ID: 622093a47f015915e61cf6bdb3765299dda70c4efcc963cc1a8725aac206496b
Opcode Fuzzy Hash: 04534e5107c7355dda962c728b31a530e658fe08fe3bbd2eacde53aa1c83fd88
Instruction Fuzzy Hash: 2C21F4B0D056189BEB18CFA7C9597DEBEF6AF89304F04C06AD409B6264DB7409468BA0

Function 00B5CF90 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B5D01E
GetCurrentThread.KERNEL32 ref: 00B5D05B
GetCurrentProcess.KERNEL32 ref: 00B5D098
GetCurrentThreadId.KERNEL32 ref: 00B5D0F1

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a496005354fca0062d7a09e2a32957444c0dd64dd5bb8e518d6929274f728566
Instruction ID: 2d9e444120fb551702d573406f1669b4042d020d21328df1353e0a30636fdc73
Opcode Fuzzy Hash: a496005354fca0062d7a09e2a32957444c0dd64dd5bb8e518d6929274f728566
Instruction Fuzzy Hash: A95187B09003498FDB64CFA9D948BDEBFF1EF88314F24849AE408A73A0D7745884CB65

Function 00B5CFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B5D01E
GetCurrentThread.KERNEL32 ref: 00B5D05B
GetCurrentProcess.KERNEL32 ref: 00B5D098
GetCurrentThreadId.KERNEL32 ref: 00B5D0F1

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a390e5cb71f759d90ea319c9472848568b39223d1d9a919808d191c37cee4169
Instruction ID: 1ad5173fbca16f274ba78fb48ab142ed3e9c7ee1dfa489bb3574e0aee5e1e1e3
Opcode Fuzzy Hash: a390e5cb71f759d90ea319c9472848568b39223d1d9a919808d191c37cee4169
Instruction Fuzzy Hash: E65178B0900349CFDB64CFA9D948B9EBBF1EF88314F24849AE508A7390D7745984CF65

Function 00B5AD08 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B5AF5E

Strings

dRp, xrefs: 00B5AE96
dRp, xrefs: 00B5AEBB

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: HandleModule
String ID: dRp$dRp
API String ID: 4139908857-3792169924
Opcode ID: 8f532de9572f622d00ba7231e44ddc7c430f13df4735398eb43cff8f33fa025a
Instruction ID: 1c7fb993a71b159bb0f6a7cf59cb8667eb870fedd26e781365d0469429d2a8a0
Opcode Fuzzy Hash: 8f532de9572f622d00ba7231e44ddc7c430f13df4735398eb43cff8f33fa025a
Instruction Fuzzy Hash: EF816870A00B058FDB64DF29D44175ABBF1FF88305F108AADD886E7A90DB74E849CB91

Function 06C97A34 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06C97C76

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d67d28bda6334e750d75f1e6b842edbee4ba458d32d29495cbd952f13cb384f4
Instruction ID: 26285eecc04bdfe083b0461580873822160d6951cd36815a0a1bacde0d6029f8
Opcode Fuzzy Hash: d67d28bda6334e750d75f1e6b842edbee4ba458d32d29495cbd952f13cb384f4
Instruction Fuzzy Hash: BA915971D11219DFDF64CF68CC45BAEBBB2BF48310F1485A9E808A7240DB749A85CFA1

Function 06C97A40 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06C97C76

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6df8ad4378240b7f30fd8c8d4efd55fa9cb0f0f20bb82a6b48ebbde69be8b893
Instruction ID: e5829cd79bfb0d5860020b19437df647d02d6a64c65fa24e3939a164442652c6
Opcode Fuzzy Hash: 6df8ad4378240b7f30fd8c8d4efd55fa9cb0f0f20bb82a6b48ebbde69be8b893
Instruction Fuzzy Hash: 8F915871D11219DFDF64CF68C845BAEBBB2BF48314F1485A9E808A7240DB749A85CFA1

Function 00B558EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B559A9

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3bf08fa6a2b6c09582e9c583f97b55b0dba9848206a503dcf1eb4d9045590587
Instruction ID: 32099ae47d3c576d410e397eaa8dd7c8b000433c1df5a49ff7eecea7478407c6
Opcode Fuzzy Hash: 3bf08fa6a2b6c09582e9c583f97b55b0dba9848206a503dcf1eb4d9045590587
Instruction Fuzzy Hash: B641E2B0C00619CFDB24CFA9C984BDEBBB5FF88305F20819AD458AB251DB756949CF50

Function 00B544B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B559A9

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ab85a0787d4ae8c2869f4ecb3bdb1a9508eec7640cabefca85714421d6fcf6e8
Instruction ID: fc48009518c8608f86dfd1bb39da7b4d9935357563e40f6ea8dbafc57d68c32a
Opcode Fuzzy Hash: ab85a0787d4ae8c2869f4ecb3bdb1a9508eec7640cabefca85714421d6fcf6e8
Instruction Fuzzy Hash: 6141D3B0C00719CBDB24DFA9C984B8EBBF5FF48305F20819AD418AB251DB756949CF90

Function 06C977B0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C97848

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 87d9eb4f36c97c1630e383054a9ed45e38d4c963011da4167d1618be640bd0d6
Instruction ID: f85ee72452751640597cc27c8a9589be08cb3dac857e2e3910bba376ae615067
Opcode Fuzzy Hash: 87d9eb4f36c97c1630e383054a9ed45e38d4c963011da4167d1618be640bd0d6
Instruction Fuzzy Hash: D02124B19003499FDB10CFAAC885BDEBBF5FB48320F10842AE958A7240D7789940DBA4

Function 06C977B8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C97848

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fa1657b9bb28a21178f9805a4489dde0df1f1fa2eafcc77203313aadb4b6d55c
Instruction ID: 937143043d83e8fa287fbf8541657ed8b8eb9cbcc0b5602c1399e8ce222baa6e
Opcode Fuzzy Hash: fa1657b9bb28a21178f9805a4489dde0df1f1fa2eafcc77203313aadb4b6d55c
Instruction Fuzzy Hash: DD2113B19003499FCB14CFAAC985BDEBBF5FF48320F10842AE958A7240D7789940DBA5

Function 00B5D5E8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B5D677

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1b07fdd75a58e5dcb895058f61e66cd19046a0be520d1e01e452a664dbfd76a3
Instruction ID: c63fd10140d4d1cf4cec8ec48badb327bb7e24fe8117e3d0d12ed633a0c5e403
Opcode Fuzzy Hash: 1b07fdd75a58e5dcb895058f61e66cd19046a0be520d1e01e452a664dbfd76a3
Instruction Fuzzy Hash: A521D6B59002489FDB10CFAAD985ADEBFF5FB48320F14815AE958A3310C3799945CF60

Function 06C97618 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C9769E

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0bdfdf7cee774334a3dc046cf343b52323eb9afac5b910e805781bbef4507993
Instruction ID: c5ecf4c99f885fcc812b61f7781d1c5cd6e72508097d35c88ca4d0dd1d87caf2
Opcode Fuzzy Hash: 0bdfdf7cee774334a3dc046cf343b52323eb9afac5b910e805781bbef4507993
Instruction Fuzzy Hash: 7B2139B1D103098FDB10CFAAC8857AEBBF5EF88324F14842AD559A7280D7789945CBA1

Function 06C978A0 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C97928

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 69ec8e886b4f9aa21f70400b54fcd785ccd323fcdcd9dc09b58ba6e474586a13
Instruction ID: cd231f8db9a7245a73cf1e06cb14cc6814f1a9fcb768287ec4443ef8ecb30b5d
Opcode Fuzzy Hash: 69ec8e886b4f9aa21f70400b54fcd785ccd323fcdcd9dc09b58ba6e474586a13
Instruction Fuzzy Hash: DB2148B1D003499FDF10CFAAC885ADEBBF5FF48320F14842AE559A7250D7789940DBA0

Function 06C97620 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C9769E

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8de09e3df252a3438bb66dbfd5952e6187b6e1e2da117cf140f53267b4021c22
Instruction ID: 79d49fee2c390f78fb3706fa20cd86d87479eaa0c1883ba560c247ed0ede882b
Opcode Fuzzy Hash: 8de09e3df252a3438bb66dbfd5952e6187b6e1e2da117cf140f53267b4021c22
Instruction Fuzzy Hash: FB2138B1D103098FDB10CFAAC8857AEBBF4EF88324F14842AD459A7240D7789944CFA1

Function 06C978A8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C97928

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ad23debdc802f751732143a337104261c0befd165f778cfdad90a2865d1da009
Instruction ID: aa43c773d7d16543c379e29c87381d8e7c4145783b8bc9dac4e60a6e2cc5ce05
Opcode Fuzzy Hash: ad23debdc802f751732143a337104261c0befd165f778cfdad90a2865d1da009
Instruction Fuzzy Hash: CA2128B1D003499FCB10DFAAC885ADEBBF5FF48320F10842AE558A7250D7789540DBA1

Function 00B5D5F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B5D677

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 198f66ac84f9024fb871a251cb6a1545b82711f134e7ec8bbff28cde307864aa
Instruction ID: 48d98350c5fcfe0d48ce1b852e95bd3b64418ef43cbb54904210132b5ae01e0b
Opcode Fuzzy Hash: 198f66ac84f9024fb871a251cb6a1545b82711f134e7ec8bbff28cde307864aa
Instruction Fuzzy Hash: 8121E4B5900248DFDB10CF9AD984ADEBBF9FB48320F14805AE918A3310C374A944CFA4

Function 06C976F2 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C97766

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ceffd3ec1789d7450aaa1813d4825a07bf18e0caf96a16144b6158b119e912ef
Instruction ID: 2603bf2d399471cb043b0462116f61f46fc441ef0b462b91770203f8d5232889
Opcode Fuzzy Hash: ceffd3ec1789d7450aaa1813d4825a07bf18e0caf96a16144b6158b119e912ef
Instruction Fuzzy Hash: E51167B29003499FDF10DFAAC845ADEBFF9EF88320F208419E519A7250C775A540DFA1

Function 06C976F8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C97766

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44681ac7564e8de0d37ac3a924ac407aa1c7b5497533f66f58ddd2b35a9d5a31
Instruction ID: 3f384e7e2e616d3eb1b27c30c5fda9658c0c726040e29e38be31bcb93264ee20
Opcode Fuzzy Hash: 44681ac7564e8de0d37ac3a924ac407aa1c7b5497533f66f58ddd2b35a9d5a31
Instruction Fuzzy Hash: CC1137B19003499FCF10DFAAC845ADEBFF9EF88324F248419E519A7250C775A540DFA1

Function 06C97130 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C9719A

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 48504c27e6f371be883c135db01a7277de45ba80bdb9a09f5d8ca7c6438455dd
Instruction ID: e5ee8870fd85716ab4ad08c471bcebfb4d2e67768025b5c2fc9856fd74b7ace3
Opcode Fuzzy Hash: 48504c27e6f371be883c135db01a7277de45ba80bdb9a09f5d8ca7c6438455dd
Instruction Fuzzy Hash: 961158B1D003498FDB20DFAAC8457DEFFF5EB88324F208419D459A7250C775A941CBA4

Function 06C97138 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C9719A

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5ed3bb9bf942c1d1ea64c11aee843c74fa9b4fdd811b8602ac7b700c796f319d
Instruction ID: 5cd3f388578816f5878717dc42633dbcb56e194ca787ab2aada5a13bbeb66c5c
Opcode Fuzzy Hash: 5ed3bb9bf942c1d1ea64c11aee843c74fa9b4fdd811b8602ac7b700c796f319d
Instruction Fuzzy Hash: AA113AB1D003498FDB20DFAAC84579EFBF5EF88324F248419D559A7250C775A540CBA5

Function 06C95E08 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06C9A305

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 62272f78a38c806665c3542349be63110caf7a68b0abc0d2234b4ca5935c6cfd
Instruction ID: 55ec1b512fa9a89e2aaadbf90a280541926ccc20431d5388384b97aaee3facee
Opcode Fuzzy Hash: 62272f78a38c806665c3542349be63110caf7a68b0abc0d2234b4ca5935c6cfd
Instruction Fuzzy Hash: 0F11F2B5800749DFDB50DF9AC889BDEBBF8FB48324F20841AE558A7200C375A944CFA1

Function 00B5AEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B5AF5E

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f1d8b7f1a91d0de3b909936c46adb1a707a4a98d5adbe554666a15a8e3a64f5b
Instruction ID: d8b28fa042fee9c604f72bb7dc0d0fa231cb4fbce62be69bcddb12a9d2feb069
Opcode Fuzzy Hash: f1d8b7f1a91d0de3b909936c46adb1a707a4a98d5adbe554666a15a8e3a64f5b
Instruction Fuzzy Hash: 9C11D2B5C003498FCB10CF9AD844B9EFBF5EB88324F14855AD859B7610C379A545CFA1

Function 06C9A2A2 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06C9A305

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 62f29d9e4d5bcb588d054f9d01688dd72200645e3a58d304169fd1a5df2b55d8
Instruction ID: 75f1fcc3ee8df83fa7f9fd6dbe40b069d940d2e8cea8fa1cbde646693479e039
Opcode Fuzzy Hash: 62f29d9e4d5bcb588d054f9d01688dd72200645e3a58d304169fd1a5df2b55d8
Instruction Fuzzy Hash: 8411B0B58003599FDB20CF9AD989BDEBBF8FB48324F20841AE558A7610D375A544CFA1

Function 006FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8664e49143cb3dd8962283244430a742da5077fb80b9392ac31e93fb010effdc
Instruction ID: bfc66cc4a8a54600bf29607c2b986c555e5a6e4ca681e8f85c1d35dad47089a0
Opcode Fuzzy Hash: 8664e49143cb3dd8962283244430a742da5077fb80b9392ac31e93fb010effdc
Instruction Fuzzy Hash: 842125B1504248EFCB15DF14D9C0B36BF67FB98318F24C569EA090B256C336E856DBA2

Function 006FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75dc6ba846f2ca903fea38c11908c64a9a547f899885628c784ab15981fcb180
Instruction ID: f04779e21757d583b7aa1ed7dd36f188964639b437c6a76818cd016f9ebecda5
Opcode Fuzzy Hash: 75dc6ba846f2ca903fea38c11908c64a9a547f899885628c784ab15981fcb180
Instruction Fuzzy Hash: 872106B1504208DFDB05DF14D9C0B26BFA7FB94324F24C569EA094B256C336F856DAA2

Function 0070D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819295836.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b8b7757dc1966c4b97c39f98e30b811207188c9003f5f75eba87bdd7e9d358
Instruction ID: 524c74c24c3890fc12073e09c88f7548e7294763974dd6c13b7f0c83fccb87a7
Opcode Fuzzy Hash: e7b8b7757dc1966c4b97c39f98e30b811207188c9003f5f75eba87bdd7e9d358
Instruction Fuzzy Hash: 582104B1504304EFDB25DF94D9C0B26BBA5FB88314F24CA6DE9094B296C73ADC46CA61

Function 0070D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819295836.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd657e51b4bd4eb58b3f0960cc9019ec727a742f3b94693e7af2b0518bd84be2
Instruction ID: 230fa7a92e485be263b3b998bee7da2d2b6b2443133228b4851a08ecafb3a7ec
Opcode Fuzzy Hash: bd657e51b4bd4eb58b3f0960cc9019ec727a742f3b94693e7af2b0518bd84be2
Instruction Fuzzy Hash: A42103B1604300DFCB24DF54D9C0B26BBA5EB84314F20C669D80E4B286C33ADC07CA61

Function 006FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: e2024f5c750c1d382edcf6973ce5b0ef6373fdb3eafd4c986acdc03aeacb9be7
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: BB11E172404284CFCB12CF10D5C0B66BF72FB94318F24C6A9D9090B656C33AE85ACBA2

Function 006FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: a0a2abd48655004998d06dde9401985c244e3375247af21d75c00ba0879788d1
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 9E11E172404244DFCB12CF00D5C0B66BFB2FB94324F24C2A9D9090B756C33AE85ACBA2

Function 0070D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819295836.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: f120386f361327e352859fa25ba99cab07187ac89d60c6af13b59228e033c6bd
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 6E11DD75504380CFCB21CF54D5C4B15FBA2FB88318F24C6AAD80D4B696C33AD84ACBA2

Function 0070D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819295836.000000000070D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0070D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 1ea357480cc85f1d02c90983a8a67497d9d101e9975a4f15a18ecda1c249dcd7
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 3C11BB75504380DFCB22CF54C5C0B15BBA2FB84324F24C6AAD8494B696C33AD84ACB61

Function 006FD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e070664fde26e432d6b8d1c87dca59e957e49438f153049aa3214e800c90ac8
Instruction ID: c5034a408d21d317fedd180a398e74da3da9c328e86bb2c0815130a9c8e248a3
Opcode Fuzzy Hash: 6e070664fde26e432d6b8d1c87dca59e957e49438f153049aa3214e800c90ac8
Instruction Fuzzy Hash: 6401DB710093489AE7106B25DCC4B76FFEADF51324F18C91AEE094E396C779A841D6B1

Function 006FD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819245750.00000000006FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 006FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dfda9b69522adc11ac5114ca6a1d95da4d32e2c44b56bb4b1b69dcc837c111
Instruction ID: a487177e7c96a8975ce46dadc1e84b5a8bdd8377c76ca2d31118935a58fb8c05
Opcode Fuzzy Hash: 82dfda9b69522adc11ac5114ca6a1d95da4d32e2c44b56bb4b1b69dcc837c111
Instruction Fuzzy Hash: 7DF062724053449EE7209A16DDC4B62FFE9EF51724F18C45AEE484E396C379A844CAB1

Non-executed Functions

Function 06C94E30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41251caaec75ae33bb4a07a39a725529a59af2be15f9a7e7effa34e1ce213205
Instruction ID: 0557083e654295d99f039952f1c1e28148c813c7a4ab5feda1cdb392a7f643eb
Opcode Fuzzy Hash: 41251caaec75ae33bb4a07a39a725529a59af2be15f9a7e7effa34e1ce213205
Instruction Fuzzy Hash: 58E1F874E102598FDB54DFA9C5849AEFBF2FF89304F248169D814AB355D730A982CFA0

Function 06C95268 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00782a24e67590ef4b012b5e5b6f8cfdf5d0470a6c2214af31472bbce8ee5ba
Instruction ID: 43fed4948fa39691b8c854ef2e8061dcf85f37e08a32c96d300e6e655775568d
Opcode Fuzzy Hash: c00782a24e67590ef4b012b5e5b6f8cfdf5d0470a6c2214af31472bbce8ee5ba
Instruction Fuzzy Hash: EAE11B74E101198FDB54DFA9C5849AEFBF2FF89304F648169D814AB355DB30A982CFA0

Function 06C971E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af4eeb8c7243230e371eede86c3830c5681ef1310bae562ac36269b9ab01c45
Instruction ID: 12fe0b095e7ee6c42c33f6b1423e5e996b93a9518c4c0962108debed36e86b91
Opcode Fuzzy Hash: 5af4eeb8c7243230e371eede86c3830c5681ef1310bae562ac36269b9ab01c45
Instruction Fuzzy Hash: 9DE10974E111198FDB54DFA9C5849AEFBF2FF89304F248169D814AB356D730A982CFA0

Function 06C949F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2694b209fa3818fa1e6d6be223909849203f12db8edddb4902b5b4c972a70a18
Instruction ID: 301d1af1e99b9de67a23ca416e9a776a8bb71d7c13b38ba8e3286a726edd4d41
Opcode Fuzzy Hash: 2694b209fa3818fa1e6d6be223909849203f12db8edddb4902b5b4c972a70a18
Instruction Fuzzy Hash: 4CE11574E141198FDB54DFA9C5849AEFBF2BF89304F24C169D814AB355DB30A982CFA0

Function 06C96910 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f080eafdb04d405a6eef609f18f04426fb5c3546f867ef8a662277a282e12c
Instruction ID: 68f982e4384d9a5b36216fa13ff24855415a6264005b2c223cf174fff5a6b245
Opcode Fuzzy Hash: 63f080eafdb04d405a6eef609f18f04426fb5c3546f867ef8a662277a282e12c
Instruction Fuzzy Hash: 3BE10774E141198FDB54DFA9C5849AEFBF2FF89304F248169E814AB355DB30A982CF60

Function 00B5D51C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1819750029.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b50000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1abea9065fbe7cfeb8fc1a793198411ed2c3e6721056cb56b1a291cab008ed74
Instruction ID: 886e5089ced0d57baada8ec80db46be23cd00f43d944e2043bb1a38c0df86e99
Opcode Fuzzy Hash: 1abea9065fbe7cfeb8fc1a793198411ed2c3e6721056cb56b1a291cab008ed74
Instruction Fuzzy Hash: E2A13B32A00606CFCF05DFA5D8449AEB7F2FF85301B1585FAE905AB265EB71990ACB40

Function 06C96900 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823762941.0000000006C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c90000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6199075a5d11b1f56b17bfb92a19e899b1460b6b3e1f074756cd3d3b90b47f
Instruction ID: f886dbd1eed29d5341d7254a44d3a23d1ee209c6198537cbf2e3ea8ba4645c06
Opcode Fuzzy Hash: 8b6199075a5d11b1f56b17bfb92a19e899b1460b6b3e1f074756cd3d3b90b47f
Instruction Fuzzy Hash: 23511B70E142198FDB54DFAAC5849AEFBF2BF89304F24C169D418A7355DB319A42CFA0

Analysis Process: MV BBG MUARA Ship's Particulars.pdf.scr.exePID: 796, Parent PID: 6712COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	151
Total number of Limit Nodes:	16

Executed Functions

Function 06913060 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 06913788
$fq, xrefs: 0691375F
$fq, xrefs: 069137B8
$fq, xrefs: 069137AC
$fq, xrefs: 0691376B
$fq, xrefs: 06913794

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-1582559945
Opcode ID: 13f80885f76db4bc77c71bebd43a673bfb9d12e0b1a6fe5ccb418db5fff68077
Instruction ID: add91a4e578b83ff49ee9f710709c5b41c6353e4927155d5591ff88a6318e176
Opcode Fuzzy Hash: 13f80885f76db4bc77c71bebd43a673bfb9d12e0b1a6fe5ccb418db5fff68077
Instruction Fuzzy Hash: 65321035E1061ACFCB14EF75D99459DB7B6BFC9300F20C69AD419AB264EF30A985CB80

Function 06917D80 Relevance: 3.0, Strings: 2, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 0691831B
$fq, xrefs: 06918327

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: dbd7cc43d44d1d26fec1736a03258eff12cbefa74a9c4ec856913d5a9604c59c
Instruction ID: 089e4762957dddf7598f6382a7e4bc4d017e3ac0b1014e362af70971363b87c2
Opcode Fuzzy Hash: dbd7cc43d44d1d26fec1736a03258eff12cbefa74a9c4ec856913d5a9604c59c
Instruction Fuzzy Hash: 04028E31B0021A8FDB54DF68D6906AEB7F6EF84300F248929E815DB794DB75DD46CB80

Function 069155A0 Relevance: 1.8, Strings: 1, Instructions: 600COMMON

Download Yara Rule

Strings

$, xrefs: 0691597B

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 798c4037c3b55aa9f7206231b0051564c9db80fb3f0dcdd02178da42a114e0a4
Instruction ID: 2bb53f3e54d46aac32db02089087aa631aa3eb6dc0f25c479cbc4fd3897f6ba8
Opcode Fuzzy Hash: 798c4037c3b55aa9f7206231b0051564c9db80fb3f0dcdd02178da42a114e0a4
Instruction Fuzzy Hash: 4B229DB5E002198FDF60DBA8C5906AEB7B6EF84320F36846AD455AF794DB31DC41CB90

Function 069165F0 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3248bfca06167de08cf1f20a07798f2fc99b28bf90bd78d143dded2634866a0d
Instruction ID: f2f3c4e913c741334d8ad7cd8e8a88631c22265f6c8bdbc237105e3a93606749
Opcode Fuzzy Hash: 3248bfca06167de08cf1f20a07798f2fc99b28bf90bd78d143dded2634866a0d
Instruction Fuzzy Hash: 3662AA34F002098FDB54DB68D994AADB7B6EF88310F248469E816EF795DB35ED41CB80

Function 0691C190 Relevance: .6, Instructions: 639COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc0076973bfb754b23c329f69712c08c953a2eec7e06867d5e96fd180d94eb9
Instruction ID: 70f817b827dc84b44fd72810e97cbf45d93bc96c60ea21adf6666e0a367cc1c1
Opcode Fuzzy Hash: ddc0076973bfb754b23c329f69712c08c953a2eec7e06867d5e96fd180d94eb9
Instruction Fuzzy Hash: DE326B35B00209CFDB54DB68D990BADB7B6FB88310F208929E515EB755DB38EC42CB91

Function 0691B238 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4b875a6c0d09a4f77db7e51ab5761a31810f4578e404675c058251704c8600
Instruction ID: 02977fa8b7f475a360a87fedefce6b11330de43bc5a50ccacc46742cd9e5e3ed
Opcode Fuzzy Hash: 6d4b875a6c0d09a4f77db7e51ab5761a31810f4578e404675c058251704c8600
Instruction Fuzzy Hash: 3D226D70E1010D8BEF64DBA8D5907ADB7BAEB45310F308926E455DB799CB34DC82CB91

Function 0691ACE0 Relevance: 10.4, Strings: 8, Instructions: 400
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 0691AE01
$fq, xrefs: 0691AEB8
$fq, xrefs: 0691AEAC
$fq, xrefs: 0691AE83
$fq, xrefs: 0691AE54
$fq, xrefs: 0691AE60
$fq, xrefs: 0691AE0D
$fq, xrefs: 0691AE8F

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-3929485403
Opcode ID: f3da349b4b64ab379ac703fc249d9e007de8c330a55fa49b6495a4bf31b8ee7f
Instruction ID: f093064db0bd54a7624f517bebdb57449f233d5c77e14fdd7f1f687cb5a3d50f
Opcode Fuzzy Hash: f3da349b4b64ab379ac703fc249d9e007de8c330a55fa49b6495a4bf31b8ee7f
Instruction Fuzzy Hash: 13E19D30F112098FDB55DFA8D9806AEB7B6EF85300F208929E815EF759DB309D46CB91

Function 0691B658 Relevance: 8.0, Strings: 6, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 0691BC1D
$fq, xrefs: 0691BBE9
$fq, xrefs: 0691BBB5
$fq, xrefs: 0691BC11
$fq, xrefs: 0691BBA9
$fq, xrefs: 0691BBDD

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-1582559945
Opcode ID: 9f0d9c23fe74c16bef5917cbecd98b744a777d39b33994ada943989a25d74f30
Instruction ID: 15359e0248084f3e5cf55a350418169a43940dcc5ace6b5bc7ad300f7297fc94
Opcode Fuzzy Hash: 9f0d9c23fe74c16bef5917cbecd98b744a777d39b33994ada943989a25d74f30
Instruction Fuzzy Hash: 55025930E0020E8FDBA4DB68D5906ADB7B6FB45314F30896AE415DFA59DB34DC82CB91

Function 06902872 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 069028F6
GetCurrentThread.KERNEL32 ref: 06902933
GetCurrentProcess.KERNEL32 ref: 06902970
GetCurrentThreadId.KERNEL32 ref: 069029C9

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b5bbb4ae6a89ff6415bd72f0c250991a237a7d48fdfb32fd9f6bb77d791be64f
Instruction ID: 95a7a51bcfdad323773ebe3b9f2f6f9672f30835dd77063cfd5f03183f9b6c98
Opcode Fuzzy Hash: b5bbb4ae6a89ff6415bd72f0c250991a237a7d48fdfb32fd9f6bb77d791be64f
Instruction Fuzzy Hash: 7E5185B0900309CFDB54CFA9DA48BAEBBF5EF88314F20841AE519A73A0D7755984CF61

Function 06902878 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 069028F6
GetCurrentThread.KERNEL32 ref: 06902933
GetCurrentProcess.KERNEL32 ref: 06902970
GetCurrentThreadId.KERNEL32 ref: 069029C9

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 090f967679a40e675a6bf22b556bae785f20be49aa233978c34a9263a56cb745
Instruction ID: 1ce1ad71a0e0339207d7deb995cc016146121235f8a17fc52c97921abbf5bec9
Opcode Fuzzy Hash: 090f967679a40e675a6bf22b556bae785f20be49aa233978c34a9263a56cb745
Instruction Fuzzy Hash: 515187B0900309CFDB54CFAADA48B9EBBF5EF88314F208419E519A73A0D7756984CF65

Function 06919158 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 0691920F
$fq, xrefs: 069191C8
$fq, xrefs: 069191D4
$fq, xrefs: 06919203

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: 2a7e2f9828c7fcc1cc624cf61d4568ba8bd63860a2a0e5aae86b3385e433a918
Instruction ID: 9eba9586da37f4160ce9150e098a0dbd821982cce703041823c5c8a704c38ceb
Opcode Fuzzy Hash: 2a7e2f9828c7fcc1cc624cf61d4568ba8bd63860a2a0e5aae86b3385e433a918
Instruction Fuzzy Hash: 35915534F1021A8FDB54DF68D9A076E77F6BF85200F208569C819EB798EF309D468B91

Function 0691CF48 Relevance: 4.5, Strings: 3, Instructions: 797
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 0691D33F
$fq, xrefs: 0691D347
$fq, xrefs: 0691D353

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq
API String ID: 0-837900676
Opcode ID: ec2d8e6e227887aa8b8b7a192684afe4160a1bbc335f4c8ec2384d20a94dd3d4
Instruction ID: 8609b96ab3e950b9f1c6b4d9e024d4ecbf752ebe3afebec7f8c2b2f109c8f1e7
Opcode Fuzzy Hash: ec2d8e6e227887aa8b8b7a192684afe4160a1bbc335f4c8ec2384d20a94dd3d4
Instruction Fuzzy Hash: 14625E30A0020A8FCB55EF68D590A5EB7B2FF85304F208A68D415DF769DB75ED86CB81

Function 06914B70 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fkq, xrefs: 0691527D
\Okq, xrefs: 06914D27
XPkq, xrefs: 06914C9D

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: fkq$XPkq$\Okq
API String ID: 0-673657909
Opcode ID: f4ebdcdbeaa07d44df0a2f29954a540945f9346d700855a26a97d7de41d9fa5b
Instruction ID: 19b6d7ad2baacf403d73ba153cd0b84f18e47bdffc404accce5ef9d879402e9a
Opcode Fuzzy Hash: f4ebdcdbeaa07d44df0a2f29954a540945f9346d700855a26a97d7de41d9fa5b
Instruction Fuzzy Hash: 44618E70E002189FEF549FA9C8547AEBBF6EF88700F20842AE506AB395DF759C45CB50

Function 06919149 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

$fq, xrefs: 069191C8
$fq, xrefs: 06919203

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: 10d1a587c4972047d3f930e648a3ee39db23905949d4ee3f4cfa9a9358654603
Instruction ID: 3cda13456a7efddec0d49ead0688fda887ef8567e521ae867eb1968d97e6a2cf
Opcode Fuzzy Hash: 10d1a587c4972047d3f930e648a3ee39db23905949d4ee3f4cfa9a9358654603
Instruction Fuzzy Hash: 56516434B001069FDB54DF68E9A076E77F6EF85210F248969D819DB398EB30DD42CB90

Function 0690AF10 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0690B176

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f2c5b3fd0f67e6e686ab391cfef9bf1420c501725687dc81798a5ca69256390f
Instruction ID: e853278768a74da6a994257c626482efa5a2f35ea0862dc6810003e4079f9d5f
Opcode Fuzzy Hash: f2c5b3fd0f67e6e686ab391cfef9bf1420c501725687dc81798a5ca69256390f
Instruction Fuzzy Hash: 91819CB0A00B058FE7A4DF29D44475ABBF5FF88300F108A2DE59AD7A81DB35E845CB91

Function 051EEA51 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4191623939.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51e0000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a36f90b1a4de9fefea5ee944a9c4cb9694eb057d4bb2911a422de35e2f86d3
Instruction ID: 1e1d56fc671bcf2729c0d7f3a8344f0b23636dac164412617c9e30e1273f237b
Opcode Fuzzy Hash: 96a36f90b1a4de9fefea5ee944a9c4cb9694eb057d4bb2911a422de35e2f86d3
Instruction Fuzzy Hash: D8414372D043858FCB14DFA9D4046AEBBB5AFC9310F1486ABD845E7241DB749845CBA1

Function 0690D0EF Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0690D202

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9aa0645ff9f6214493c38c1eb2ef0697b939e9449137e40477015e0d5bae94fd
Instruction ID: 80a9716fa16356abe44f039b23d5ea6001658cf02e3812c28fa92aeba4b68f22
Opcode Fuzzy Hash: 9aa0645ff9f6214493c38c1eb2ef0697b939e9449137e40477015e0d5bae94fd
Instruction Fuzzy Hash: D541B0B1D003099FDB14CF99C984ADEBFB5BF88310F24812AE819AB250D7759885CF90

Function 0690D0F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0690D202

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 22123175440af56bc42c7be16078486cd7692016c68bb6488793d2415b896273
Instruction ID: 9d5dc939a7c0873e01ed276a9ff2364242886dd145851efc2a430f0d88350843
Opcode Fuzzy Hash: 22123175440af56bc42c7be16078486cd7692016c68bb6488793d2415b896273
Instruction Fuzzy Hash: A541B0B1D003099FDB14CF99C984ADEBFB5BF88310F24812AE819AB250D7759885CF90

Function 0690A5EC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0690F8F1

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 3d6e2c6e94fbfc154806b67d91b6d50f126ce9dc479e81f23d00fc4a9860b4f0
Instruction ID: 867906fb041522df8b27ba6012b170cb9af8e9774637f12cc22992fd0c96b14c
Opcode Fuzzy Hash: 3d6e2c6e94fbfc154806b67d91b6d50f126ce9dc479e81f23d00fc4a9860b4f0
Instruction Fuzzy Hash: E3417CB4900309DFDB64CF99C488AAABBF5FF88314F24C459D919A7361C734A945CFA0

Function 06902AB8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06902B47

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ade5f98c86f592279b5b7398cc00eb95027cc6e2943e063c39e880111f62311c
Instruction ID: 166d2044acaa8523569b037a28a2374467703d3d23d95849e0eee9d50468984a
Opcode Fuzzy Hash: ade5f98c86f592279b5b7398cc00eb95027cc6e2943e063c39e880111f62311c
Instruction Fuzzy Hash: 412103B5D00209DFDB10CFAAD984AEEBBF4EF48310F14801AE914A7750C378A940CF61

Function 06902AC0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06902B47

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1ea2d2c30a41c1baf58830b73454d82d9e52a346366f55040f8571b654a59755
Instruction ID: 6618bb40e661df2ff333d7751894f48c248dc601c21cf4c3ba8dc1ede89d14d5
Opcode Fuzzy Hash: 1ea2d2c30a41c1baf58830b73454d82d9e52a346366f55040f8571b654a59755
Instruction Fuzzy Hash: 8621C4B5D002499FDB10CF9AD984ADEFBF9EB48320F14841AE914A7350D378A944DF65

Function 051EEB38 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 051EEB9F

Memory Dump Source

Source File: 00000004.00000002.4191623939.00000000051E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_51e0000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 02268ccc0c07e109d0222e293b10c65ec34e09779898b60d8acf94966340ab68
Instruction ID: 6c9635bd2d14ac1a83428528a334c5da6934d7c0866bf8218fe49fe5f802e2fb
Opcode Fuzzy Hash: 02268ccc0c07e109d0222e293b10c65ec34e09779898b60d8acf94966340ab68
Instruction Fuzzy Hash: EF11F6B1C006599BCB10CF9AC545BDEFBF8BF48320F14816AD918B7240D378A944CFA5

Function 0690B110 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0690B176

Memory Dump Source

Source File: 00000004.00000002.4193123024.0000000006900000.00000040.00000800.00020000.00000000.sdmp, Offset: 06900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6900000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 815b1b4fddaea5f314e38b14bb9f8d6ae156eb9b67147e90e3d57f79c001c63d
Instruction ID: 12ae90a56969446e8e053993d24e8d7e29b3875ac884ff36309f60fa6641e480
Opcode Fuzzy Hash: 815b1b4fddaea5f314e38b14bb9f8d6ae156eb9b67147e90e3d57f79c001c63d
Instruction Fuzzy Hash: EF11D2B6C007498FDB20CF9AC944A9EFBF8EB88324F24841AD519B7650D379A545CFA1

Function 06914B60 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

XPkq, xrefs: 06914C9D

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: XPkq
API String ID: 0-3796509991
Opcode ID: c9a1021459647e217d84041a6a0d1e9169444d1591f9b4e81b6d46217f4e412f
Instruction ID: e1cb5f4d9748d04eb6c0844b5d665ff5834747e235b335df737c5a18bab383d3
Opcode Fuzzy Hash: c9a1021459647e217d84041a6a0d1e9169444d1591f9b4e81b6d46217f4e412f
Instruction Fuzzy Hash: 6A519270E002189FDB54DFE9C814BAEBBF6EF88700F20852AE145AB395DB745C05CB90

Function 0691DABD Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PHfq, xrefs: 0691DC19

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: PHfq
API String ID: 0-2154135885
Opcode ID: 47906aab16151e0793dbf410047eb95e29c61de2b598415554ce4745e38e14ce
Instruction ID: 3cdd649925aa8166d6b437beecfc1369711f69b2717d49be2181b3d7c1e72a32
Opcode Fuzzy Hash: 47906aab16151e0793dbf410047eb95e29c61de2b598415554ce4745e38e14ce
Instruction Fuzzy Hash: 90418E70E0020E9FDF55DF65D8846AEBBB6AF85200F304929E402EB640DF74984ADB91

Function 069121C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHfq, xrefs: 06912303

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: PHfq
API String ID: 0-2154135885
Opcode ID: 4761dd29e4e4099231a9ef729e96d29cf05d031fd252c2eb2ff1e84dda231289
Instruction ID: 38cbd2a6ab37c896229da5e68998bf20452cd412ae38aa7e50e153d53ad8e959
Opcode Fuzzy Hash: 4761dd29e4e4099231a9ef729e96d29cf05d031fd252c2eb2ff1e84dda231289
Instruction Fuzzy Hash: C731C131B002098FDF58AB74D95466E7BA6AF89204F304828D406EF794EF35DD86C7A1

Function 069182D0 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$fq, xrefs: 0691831B

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq
API String ID: 0-12477121
Opcode ID: c4dd4069e856b0edb360b65838dc7c18cfb6c92e024de17d238f013b591a8b58
Instruction ID: f01b50b260fd4d23d8033d28fe4dbe15464cc4f530db95ace2450618c7da508d
Opcode Fuzzy Hash: c4dd4069e856b0edb360b65838dc7c18cfb6c92e024de17d238f013b591a8b58
Instruction Fuzzy Hash: 2FF08C31B002099FDFA99E58EB8066C73B9EB40254F384825E905DF645C731DE07E791

Function 06912340 Relevance: 1.0, Instructions: 1014COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486b104b24c21daa02e3532cf8be5195f8f806a1dfe2c16648d4244a756f5297
Instruction ID: 7a0757735ef28d687471e11c95896c99e19040df15658876866506772f4d230d
Opcode Fuzzy Hash: 486b104b24c21daa02e3532cf8be5195f8f806a1dfe2c16648d4244a756f5297
Instruction Fuzzy Hash: AC924734E002088FDB64EB68C584B5DBBF6FB45314F6484A9D419AF7A5DB35ED81CB80

Function 069161F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18323394134d3014c4a0f2f46c9fda10e952f2f8508d5414d305c1a6b454e039
Instruction ID: f80a06e57d3284712d6cc5bc18d535d4f0ad796000e17c8e6e8fc78b45d2cda2
Opcode Fuzzy Hash: 18323394134d3014c4a0f2f46c9fda10e952f2f8508d5414d305c1a6b454e039
Instruction Fuzzy Hash: EE619172F005224FDB549B6DCC8066FBAEBAFC4220B254439D80EDB364DE66ED0287D1

Function 069142A1 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 433170b1b726ea2345e928f4b013a474716d57a4e8ab3d3723a847b854ea83a7
Instruction ID: 819bb1737a796dea9b378d5791554bdc555814d444cc87b0c926cddf10b1bc40
Opcode Fuzzy Hash: 433170b1b726ea2345e928f4b013a474716d57a4e8ab3d3723a847b854ea83a7
Instruction Fuzzy Hash: DE813D34B0020A8FDF44DFA8D59469EB7F6AF89700F248529D40AEF799EB30DC468B51

Function 069145C4 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f35eddf63c42ade76e9d9750b223b191378e6b23ae9e7a1b032718f1e64c765
Instruction ID: 4a0c6fffe65bdc99318b2d350601f9edd7382d2573bb3cc1b1387a8316cdb56f
Opcode Fuzzy Hash: 1f35eddf63c42ade76e9d9750b223b191378e6b23ae9e7a1b032718f1e64c765
Instruction Fuzzy Hash: CA914D74E002198BDF60DF68C890B9DB7B1FF89310F208699D549AB395DB70AA85CF91

Function 069145D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89e0e574d2c58000c05b49ca4e3117dfbc44aa57eaa06998446121d9a831e89
Instruction ID: f80a6fde31633b18f8a10a54db927e9351e52006a0a2abbc19b8b1cf69a53233
Opcode Fuzzy Hash: e89e0e574d2c58000c05b49ca4e3117dfbc44aa57eaa06998446121d9a831e89
Instruction Fuzzy Hash: 34915D74E106198BDF60DF68C880B9DB7B1FF89310F208699D549BB395DB70AA85CF90

Function 0691FBB8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e7a4bda062c90090c216c324b8d1e266d2e74ff618a603343d2011b5eddeca
Instruction ID: 662bbf9f324579349391a09512210a5454475ba5bebff9953ed97341a900ed41
Opcode Fuzzy Hash: f8e7a4bda062c90090c216c324b8d1e266d2e74ff618a603343d2011b5eddeca
Instruction Fuzzy Hash: 0461BF31E0010DDFDF54AB78E8942AEBBF6EB84311F30486AE506DB655DB358955CB80

Function 0691EB1A Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78b92cd54e487cb5c4d089b4970563ca2c4a0fbb02a0ac7b51f75cc64cd227e
Instruction ID: ff03f686d045b922f52b96c3cfac2f1e76858c203e4d4547155d6b3667856ded
Opcode Fuzzy Hash: c78b92cd54e487cb5c4d089b4970563ca2c4a0fbb02a0ac7b51f75cc64cd227e
Instruction Fuzzy Hash: 9A712B74B002099FDB54DFA9D980A9EBBF6EF88300F248429E415EB755DB30ED46CB50

Function 0691EB28 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f69ad6502cbceb7da0f9ba0e14f594fe3331d104ac8de4d85ae620392721a7
Instruction ID: a78d0de4eb53fcdbaf9e208be68b5aaab2383c4a725a8c07ac273ed1397fd5a4
Opcode Fuzzy Hash: a7f69ad6502cbceb7da0f9ba0e14f594fe3331d104ac8de4d85ae620392721a7
Instruction Fuzzy Hash: 44711974B002099FDB54EFA9D980A9EBBF6EF88300F248429E405EB755DB30ED46CB50

Function 0691F968 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0af3c98d2c5c626598d2e6b7ec7081475f264fc187345fa2b1b82f6b916b4c55
Instruction ID: b4ef254817ff4f9f6768f4e90e66403aaafaf62a2354a0aca58d418401a8a85b
Opcode Fuzzy Hash: 0af3c98d2c5c626598d2e6b7ec7081475f264fc187345fa2b1b82f6b916b4c55
Instruction Fuzzy Hash: BE516574F2021C9BEFA466FCD8A476F269ED789310F304426D24ACB7D5DA6CCC4197A2

Function 0691F978 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258753bcb70b25f10496aec8303fb575235c945307c548f47bddc05bb450e3d6
Instruction ID: 4ed47bd8ee85bac2edb89d85c76d6e77547433cb2f2d5d4941399795423dd44b
Opcode Fuzzy Hash: 258753bcb70b25f10496aec8303fb575235c945307c548f47bddc05bb450e3d6
Instruction Fuzzy Hash: 17515374F2021C9BEFA466FCD89476F269ED789350F304426E20ACB795DE6CCC4157A2

Function 06915419 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ed3f4e0fe7f843bbe5b0f8ce067068a9a83502beb77e2160da6839f823e87c
Instruction ID: 201f2cebd7656acce399c8b1b6001010bad327eb8134e2f9526df4fbb0409a9d
Opcode Fuzzy Hash: 33ed3f4e0fe7f843bbe5b0f8ce067068a9a83502beb77e2160da6839f823e87c
Instruction Fuzzy Hash: AA4131B1E006099FDF70CE99D8C0AAFF7B6FB84310F21492AE116DB650D731E9558B91

Function 0691D970 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3ae21f8311f15047f3aa636824e7d71a937f6c6d2f49ab9f949a811a4b4ab9
Instruction ID: de8f18b869335676a2edc9a6d0965abc3e19d452e65dfc7db844ff82709ecdc0
Opcode Fuzzy Hash: 7a3ae21f8311f15047f3aa636824e7d71a937f6c6d2f49ab9f949a811a4b4ab9
Instruction Fuzzy Hash: A331A570E1034A9FDF15DF68C99069EBBB5EF85314F208929E805EF745EB70A946CB80

Function 06912079 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f5b63460a8f7d76fefeb1817a9f8e9897c4faf369aa7320b81f61606f32903
Instruction ID: 7a1f4951c09f3c74109868b59dd7d00c309ef33fbf39b87eb230a2b57a4b9c81
Opcode Fuzzy Hash: 52f5b63460a8f7d76fefeb1817a9f8e9897c4faf369aa7320b81f61606f32903
Instruction Fuzzy Hash: DA318030E102099FCB15DF68D99469EB7B6FF89300F20C529E906EB754DB71AD86CB90

Function 06912088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf70ccf01f41b703621f035d1686f1ead677646bd1dad38d3b3c3d90071b4537
Instruction ID: 0c4de203181aa6f5772b36efb248ba791ddfa36ee95d4ad73e7f9ada6d7d2bc2
Opcode Fuzzy Hash: bf70ccf01f41b703621f035d1686f1ead677646bd1dad38d3b3c3d90071b4537
Instruction Fuzzy Hash: D7316130E102099FCB15DF68D89469EB7B6FF89300F20C529E906EB754DB71AD86CB90

Function 06913AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105c66b9f42709406fce21033c880cf391c75f718b365002e6336ed2b8473596
Instruction ID: 057b1e773d67e270200f162cb807804b2dff4f72628ed6146e56f1ca294f02e2
Opcode Fuzzy Hash: 105c66b9f42709406fce21033c880cf391c75f718b365002e6336ed2b8473596
Instruction Fuzzy Hash: F0218976F406199FDB40DFA9D980AAEBBF5EB48710F248429E905EB395E730DC008B90

Function 06913AAE Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcb67df7ca1b26b455c3d0b3df6f76667e9f340764f6934795950e3a42a9fa5
Instruction ID: 45968c45575337ffe74ff7672d2b6dc44c2190fbf5d6b5c465b105f95e66049d
Opcode Fuzzy Hash: cfcb67df7ca1b26b455c3d0b3df6f76667e9f340764f6934795950e3a42a9fa5
Instruction Fuzzy Hash: 25217C76F006199FDB40DFB9D980BAEB7F5AB48710F248425E915EB395E730D9018B90

Function 00F7D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4187309392.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c776ede5b8ae2cc2c7204f9b066d9a3e87e3d5c96569e7d156606acdba03eb22
Instruction ID: c3bb565a1322711f66fb9001da115a108974df13b64eaaade1ce7477bfb12c9e
Opcode Fuzzy Hash: c776ede5b8ae2cc2c7204f9b066d9a3e87e3d5c96569e7d156606acdba03eb22
Instruction Fuzzy Hash: B1215E7150D3C09FC703CB24D994711BF71AF46224F29C5EBD8898F2A7C23A984ACB62

Function 00F7D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4187309392.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f7d000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbcdc847318837339a49cb44c6ceef623df78d9f52d55f48137535f527d465a
Instruction ID: f6a63a401a91a6d61b6c84ebd3944731d80622eaa68a0dbae2a0d92fc5f8f98f
Opcode Fuzzy Hash: 5cbcdc847318837339a49cb44c6ceef623df78d9f52d55f48137535f527d465a
Instruction Fuzzy Hash: A721D3B1504204DFDB14DF14D9C0B26BBB5FF84324F64C56AD94E4A25AC336D846EA62

Function 06913BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156ea2baadf8e7f720a2176595e01a05dc08b29be02a79e7fdce3bed6b588838
Instruction ID: b2be67262b94a146492e849764d62a6c53d673c4831fce2a20a38a2192ec0eeb
Opcode Fuzzy Hash: 156ea2baadf8e7f720a2176595e01a05dc08b29be02a79e7fdce3bed6b588838
Instruction Fuzzy Hash: 7D11A136B045294FDF549A6CD9506AE73FAABC8310F108539C806EB358EF34DC028B90

Function 06914200 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 922abf72b6dbf7cddd6fcbb66b03e0f03989dd9bb858f440a659cb8a0871a594
Instruction ID: 1fca119b064a0b077fbf64f8cf3327684de7775c4aa3d0e4360022e81e61fb49
Opcode Fuzzy Hash: 922abf72b6dbf7cddd6fcbb66b03e0f03989dd9bb858f440a659cb8a0871a594
Instruction Fuzzy Hash: AC019E31B001141BDB6196BD9844B1FB7DBDBC9B14F388829E10ADB745E965DC8243A2

Function 0691A311 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edca57857c4e7dee27148df558bf9407cb6fba481c5ffec83f956c7c406fe2f1
Instruction ID: 8fe944d68b343b0e2ac09cecc9adff1d20d3c0ac8386282c30df6bca89c93211
Opcode Fuzzy Hash: edca57857c4e7dee27148df558bf9407cb6fba481c5ffec83f956c7c406fe2f1
Instruction Fuzzy Hash: 8C01F5307012450FCB139A78985471EBBE9EB8B650F20486EE18ACB351DA25DC038381

Function 06913878 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bfbeac49dbd2633d85600d9a69fe8d3f375bb00f66e53f77811fc12f92bb7f
Instruction ID: 813d2677def61c2453aeaa969defe579b9117ae9071b65b8906f9652d8f53e95
Opcode Fuzzy Hash: c1bfbeac49dbd2633d85600d9a69fe8d3f375bb00f66e53f77811fc12f92bb7f
Instruction Fuzzy Hash: CE21F4B1D00259AFCB10CF9AD985ADEFFB8FB48310F10812AE918A7600C375A550CFA5

Function 0691ED99 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079845174994d7e1cb4eb52f9e5ba0e4f656ff28a6692645261c288abadaa72b
Instruction ID: 0f97a4ce7f2124276285a8db0e39d6a8710b1fe8690c02fcda3d6d46b98c011b
Opcode Fuzzy Hash: 079845174994d7e1cb4eb52f9e5ba0e4f656ff28a6692645261c288abadaa72b
Instruction Fuzzy Hash: C9018435B000155FCB55DA7CD450B3BB7EADBC9620F24893EE50ACB341DD61DD428791

Function 06913BAF Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a61b74379d09a70ab5d0d44f78383e73b9635c1af5152b3bc3fb9fbe31a145
Instruction ID: 148dd4ec33ee801a98fafc3c6fba87cecb31a0c9afc37c24ed0658b01669b656
Opcode Fuzzy Hash: 97a61b74379d09a70ab5d0d44f78383e73b9635c1af5152b3bc3fb9fbe31a145
Instruction Fuzzy Hash: F701B132B141195FDF549A6DA8102AF77FB9BC9210F24453AD80ADB248FB20CC0247D1

Function 06913880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3243045c4873a9a5ea52314b7645d019ba13874d2becd5924d3f080b8a590a59
Instruction ID: d6c5e23c8763c4cdbc65bf2e4c8ba378553951efa2fb8405e645aef072633e6e
Opcode Fuzzy Hash: 3243045c4873a9a5ea52314b7645d019ba13874d2becd5924d3f080b8a590a59
Instruction Fuzzy Hash: 8B11C2B1D00259AFCB10CF9AD985ACEFFB8FB48310F20812AE918A7200C374A554CFA5

Function 06914210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d67c4405429439e99b9461b4e0ed3a9801a58807f6f8d97666f29541427c4e
Instruction ID: 04303875e2905c8c1a27d449168fe3ec771fc95a9efae3cc486e47fcc8e86e8d
Opcode Fuzzy Hash: 51d67c4405429439e99b9461b4e0ed3a9801a58807f6f8d97666f29541427c4e
Instruction Fuzzy Hash: F9016D31B001141BDB6596ADD454B2FB3DEEBC9B20F348839E50ADB744DD65DC834391

Function 0691EDA8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5bc98b91f538391facf771eeea4ed4cc1120268cf8299aac2f182a0686b57d
Instruction ID: bc625609c61f1a28a6fdd1f6c3b584622b486fb3f58ef2934fbabe732e6ea201
Opcode Fuzzy Hash: 9d5bc98b91f538391facf771eeea4ed4cc1120268cf8299aac2f182a0686b57d
Instruction Fuzzy Hash: 2F018C35B100195BDB65967CA45073F73EADBC9620F34883AEA0ACB340EE65DD024381

Function 0691A320 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4291127f9b1b3d35f55f617421350aa4608b7b4d2079ee57013ea598725f44f8
Instruction ID: b1cebdbe681051c8eb9abbeb955b358ae07f98394886ea699e104681a630dbce
Opcode Fuzzy Hash: 4291127f9b1b3d35f55f617421350aa4608b7b4d2079ee57013ea598725f44f8
Instruction Fuzzy Hash: 2A01A435B001185FCB52DABCD55471E73EAEB8A760F708829E10ACB754DE21DD038381

Function 06916470 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12ead7efe305b0c7768bc0008e52f7354f2a3483e1765a4375e71872d684c4c
Instruction ID: c100164af45b4ee4d10705fc7358d03329e378f95438c42368eefef7c335b91a
Opcode Fuzzy Hash: e12ead7efe305b0c7768bc0008e52f7354f2a3483e1765a4375e71872d684c4c
Instruction Fuzzy Hash: AAE0D871E1524C5FDF50DEB08D6479A7B6E9B46204F3088E9D445CF582D532CA018340

Non-executed Functions

Function 069176A0 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$fq, xrefs: 06917C30
$fq, xrefs: 069177E0
$fq, xrefs: 06917C3C
$fq, xrefs: 06917C46
$fq, xrefs: 06917805
$fq, xrefs: 06917C52
$fq, xrefs: 06917B91
$fq, xrefs: 06917811
$fq, xrefs: 06917B9D
$fq, xrefs: 069177D4

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-1462074617
Opcode ID: 300b79e05ad90bda8e9bf3422f9688ca35216e02cd1fb6f486b31db6da2d5c23
Instruction ID: 277af223e71687cb9c8c0a29f1cc1a4c853728faf632ed610b009dd002eb7235
Opcode Fuzzy Hash: 300b79e05ad90bda8e9bf3422f9688ca35216e02cd1fb6f486b31db6da2d5c23
Instruction Fuzzy Hash: 07122E74F0021A8FDB64DFA8C99469EB7B6BF88300F208569D40AAF755DB309D85CF90

Function 0691A948 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$fq, xrefs: 0691AB06
$fq, xrefs: 0691AA4A
$fq, xrefs: 0691AA3E
$fq, xrefs: 0691AAA5
$fq, xrefs: 0691AAFA
$fq, xrefs: 0691AAC4
$fq, xrefs: 0691AAD0
$fq, xrefs: 0691AA99

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-3929485403
Opcode ID: ea58fb0797cbf5b6d79aff78e602c6068968c343ab1772000ceab0a62497a338
Instruction ID: 7dc51a4fa665c3a7c5b75867a36f6d5fd7189bbbb953cf648173c7233a922640
Opcode Fuzzy Hash: ea58fb0797cbf5b6d79aff78e602c6068968c343ab1772000ceab0a62497a338
Instruction Fuzzy Hash: A5916D70A1120D9FEB64DF64DA947AE7BBAAF84310F308529D401AF794DB749D41CB90

Function 069170A0 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$fq, xrefs: 069173DC
.5~q, xrefs: 069170FB
$fq, xrefs: 069175B4
$fq, xrefs: 06917382
$fq, xrefs: 069175A8
$fq, xrefs: 0691753C
$fq, xrefs: 069173E8

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: .5~q$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-1301248726
Opcode ID: 6ec7bf4396e3f4082458840824650767ce52301a10fc693947a278c310fd6b5d
Instruction ID: c317c960f0c61f33c6d949702374a11e20f28189ea6deea7ad69d53092623c17
Opcode Fuzzy Hash: 6ec7bf4396e3f4082458840824650767ce52301a10fc693947a278c310fd6b5d
Instruction Fuzzy Hash: F3F15F34B0020ACFDB55EFA8D594A6EB7B7BF88340F248528D4159F759CB70AC82CB81

Function 069183D8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$fq, xrefs: 069186A3
$fq, xrefs: 06918697
$fq, xrefs: 06918632
$fq, xrefs: 0691863E

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: e17fcf6e352c6efb86717673c5ee3f2d57ff31e897b7c6da977159af9e16e2a8
Instruction ID: d6c656c616cd41a2d22541921a2ec62087c19129a9be307a2380786938202779
Opcode Fuzzy Hash: e17fcf6e352c6efb86717673c5ee3f2d57ff31e897b7c6da977159af9e16e2a8
Instruction Fuzzy Hash: 21B14B70F102098FDB94EFA8CA946AEB7B6EF84300F348529D4059B795DB74DC82DB80

Function 0691ACD0 Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

$fq, xrefs: 0691AE01
$fq, xrefs: 0691AEAC
$fq, xrefs: 0691AE83
$fq, xrefs: 0691AE54

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: f5785038c39161450b43e6ba4fb69e9eb73976981d4079faaf700cdbe1a31ce5
Instruction ID: d19fc634d31ea1fbc639b0723e56a783d911ab1ab3d7f70d244fbf06c50fe722
Opcode Fuzzy Hash: f5785038c39161450b43e6ba4fb69e9eb73976981d4079faaf700cdbe1a31ce5
Instruction Fuzzy Hash: 0551BD34B122098FDF65DB64D9846AEB7B6EB84301F30892AE806DF755DB309D41CB91

Function 069187F0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRfq, xrefs: 06918932
$fq, xrefs: 0691886F
LRfq, xrefs: 069188E3
$fq, xrefs: 0691887B

Memory Dump Source

Source File: 00000004.00000002.4193172108.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6910000_MV BBG MUARA Ship's Particulars.jbxd

Similarity

API ID:
String ID: LRfq$LRfq$$fq$$fq
API String ID: 0-1810675050
Opcode ID: ecf54daab438fc928f0b12459eb4d247bbc60c20c684f72cf957f90296726f0f
Instruction ID: 752305b6b2b8c0e9901c1660ba200bdedc4779af95aa1554d32d89c8a0565bd1
Opcode Fuzzy Hash: ecf54daab438fc928f0b12459eb4d247bbc60c20c684f72cf957f90296726f0f
Instruction Fuzzy Hash: B351C230B002059FDB58EF68CA90A6A77FAFF88314F248968E4159F395DB70EC41DB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MV BBG MUARA Ship's Particulars.pdf.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV BBG MUARA Ship's Particulars.pdf.scr.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11lz2jrg.ahb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yhln2n40.zeh.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

Windows Analysis Report
MV BBG MUARA Ship's Particulars.pdf.scr.exe

Function 00B5CF90 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 00B5CFA0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00B5AD08 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMON

Function 06C97A34 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 06C97A40 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00B558EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 00B544B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 06C977B0 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 06C977B8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 00B5D5E8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre