Edit tour

Windows Analysis Report
Documenti di spedizione 000293949040405959000.exe

Overview

General Information

Sample name:	Documenti di spedizione 000293949040405959000.exe
Analysis ID:	1560838
MD5:	5d32495cf3af0094a17aa09f76b7d27c
SHA1:	3009c98452cd000828b3bf0ba8ad5b72d05c7f7e
SHA256:	e6f50a0c2551c1d2593b8963bac95b0a3f4aad6d6b60d2a4e09d0c70dfd37649
Tags:	AgentTeslaexeFTPftp-concaribe-comSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Documenti di spedizione 000293949040405959000.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe" MD5: 5D32495CF3AF0094A17AA09F76B7D27C)

Documenti di spedizione 000293949040405959000.exe (PID: 3840 cmdline: "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe" MD5: 5D32495CF3AF0094A17AA09F76B7D27C)

Documenti di spedizione 000293949040405959000.exe (PID: 2260 cmdline: "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe" MD5: 5D32495CF3AF0094A17AA09F76B7D27C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 6396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 6396	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 2260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 2260	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1269cd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1619fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x19c81d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x126a3f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x161a6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x19c88f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x126ac9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x161af9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x19c919:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x126b5b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x161b8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x19c9ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x126bc5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x161bf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x19ca15:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x126c37:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x161c67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x19ca87:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x126ccd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x161cfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x19cb1d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x123d0d:$s2: GetPrivateProfileString 0x15ed3d:$s2: GetPrivateProfileString 0x199b5d:$s2: GetPrivateProfileString 0x123410:$s3: get_OSFullName 0x15e440:$s3: get_OSFullName 0x199260:$s3: get_OSFullName 0x124ae1:$s5: remove_Key 0x124ca9:$s5: remove_Key 0x15fb11:$s5: remove_Key 0x15fcd9:$s5: remove_Key 0x19a931:$s5: remove_Key 0x19aaf9:$s5: remove_Key 0x125bd1:$s6: FtpWebRequest 0x160c01:$s6: FtpWebRequest 0x19ba21:$s6: FtpWebRequest 0x1269af:$s7: logins 0x126f21:$s7: logins 0x129c32:$s7: logins 0x129ce4:$s7: logins 0x12b636:$s7: logins 0x1619df:$s7: logins
0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x1683fd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a342d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1de24d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16846f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a349f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1de2bf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1684f9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a3529:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1de349:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16858b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a35bb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1de3db:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1685f5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a3625:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1de445:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x168667:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a3697:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1de4b7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1686fd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a372d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1de54d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x16573d:$s2: GetPrivateProfileString 0x1a076d:$s2: GetPrivateProfileString 0x1db58d:$s2: GetPrivateProfileString 0x164e40:$s3: get_OSFullName 0x19fe70:$s3: get_OSFullName 0x1dac90:$s3: get_OSFullName 0x166511:$s5: remove_Key 0x1666d9:$s5: remove_Key 0x1a1541:$s5: remove_Key 0x1a1709:$s5: remove_Key 0x1dc361:$s5: remove_Key 0x1dc529:$s5: remove_Key 0x167601:$s6: FtpWebRequest 0x1a2631:$s6: FtpWebRequest 0x1dd451:$s6: FtpWebRequest 0x1683df:$s7: logins 0x168951:$s7: logins 0x16b662:$s7: logins 0x16b714:$s7: logins 0x16d066:$s7: logins 0x1a340f:$s7: logins
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ftp.concaribe.com	Avira URL Cloud: Label: malware
Source: http://concaribe.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for submitted file

Source: Documenti di spedizione 000293949040405959000.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Documenti di spedizione 000293949040405959000.exe

Joe Sandbox ML: detected

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: https://aka.ms/console-logger
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: https://aka.ms/dotnet-test.
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: https://aka.ms/vstest-collect
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: https://aka.ms/vstest-configure-datacollector
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: https://aka.ms/vstest-runsettings-arguments
Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Documenti di spedizione 000293949040405959000.exe

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 0_2_0115E14C	0_2_0115E14C
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027DA228	2_2_027DA228
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027DB21D	2_2_027DB21D
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027D4A58	2_2_027D4A58
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027DDB08	2_2_027DDB08
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027D3E40	2_2_027D3E40
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_027D4188	2_2_027D4188
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064EA8B4	2_2_064EA8B4
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064EA598	2_2_064EA598
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064EBDF0	2_2_064EBDF0
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064EDBF0	2_2_064EDBF0
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_065066C0	2_2_065066C0
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_065056A0	2_2_065056A0
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_0650C240	2_2_0650C240
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_0650B300	2_2_0650B300
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06502380	2_2_06502380
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06507E40	2_2_06507E40
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06507760	2_2_06507760
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_0650E468	2_2_0650E468
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06500040	2_2_06500040
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06505DC8	2_2_06505DC8
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06500006	2_2_06500006
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_06500028	2_2_06500028

Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074519691.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000000.2066101536.0000000000A92000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWaves.exe, vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareGame.dll: vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542684748.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542512598.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs Documenti di spedizione 000293949040405959000.exe
Source: Documenti di spedizione 000293949040405959000.exe	Binary or memory string: OriginalFilenameWaves.exe, vs Documenti di spedizione 000293949040405959000.exe

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.Documenti di spedizione 000293949040405959000.exe.5530000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.5530000.2.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, Form1.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/0@2/2

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Mutant created: NULL

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Documenti di spedizione 000293949040405959000.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Documenti di spedizione 000293949040405959000.exe

ReversingLabs: Detection: 28%

Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: 5-?\|--Help\|/?\|/Help
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: 5-?\|--Help\|/?\|/Help
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: Microsoft.VisualStudio.TestPlatform.CommandLine.Resources.Resources/AddnlInfoMessagesBannerAAppContainerTestPrerequisiteFail/AppxBundleSourceWarning'AssemblyPathInvalid-AttachmentOutputFormat#AttachmentsBannerCAvailableDiscoverersHeaderMessage?AvailableExecutorsHeaderMessage1AvailableExtensionFormatCAvailableExtensionsMetadataFormat;AvailableLoggersHeaderMessageOAvailableSettingsProvidersHeaderMessage)AvailableTestsFormat#BatchSizeRequiredOBlameCollectDumpNotSupportedForPlatformeBlameCollectDumpTestTimeoutNotSupportedForPlatform)BlameIncorrectOption3BuildBasePathArgumentHelp+BuildBasePathNotFound'CannotBeNullOrEmpty5CLIRunSettingsArgumentHelp'CollectArgumentHelpECollectWithTestSettingErrorMessage!CommandLineError1CommandLineInformational%CommandLineWarning)CommaSeparatedFormat3ConfigurationArgumentHelp3CopyrightCommandLineTitleADataCollectorFriendlyNameInvalidDays)DbgTrcMessagesBanner9DesignModeClientTimeoutError+DisableAutoFakesUsageaDisablingCodeCoverageInAppContainerTestExecutionkDisablingCodeCoverageInPhoneAppContainerTestExecutioneDisablingDataCollectionInAppContainerTestExecutionoDisablingDataCollectionInPhoneAppContainerTestExecutionQDisablingDCOnExceptionWhileParsingDCInfo
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: SettingFormat)SkippedTestIndicatorESomeTestsUnavailableAfterFiltering+SpecificTestsRequired!StacktraceBanner#StartingDiscovery#StartingExecution1StartTestSessionTimedOut)StdErrMessagesBanner)StdOutMessagesBanner/StopTestSessionTimedOut9StringFormatToJoinTwoStringsMSuggestTestAdapterPathIfNoTestsIsFound7SupportedFileTypesIndicator;SupportedFileWithoutSeparator5SupportedFileWithSeparatorGSwitchToIsolationInAppContainerModeKSwitchToIsolationInMultiTargetingModeQSwitchToIsolationInPhoneAppContainerMode'SwitchToNoIsolation=TestAdapterLoadingStrategyHelpMTestAdapterLoadingStrategyValueInvalid_TestAdapterLoadingStrategyValueInvalidRecursive7TestAdapterPathDoesNotExist'TestAdapterPathHelp9TestAdapterPathValueRequired_TestAdapterPathValueRequiredWhenStrategyXIsUsed5TestCaseFilterArgumentHelp7TestCaseFilterValueRequired
Source: Documenti di spedizione 000293949040405959000.exe	String found in binary or memory: SettingFormat)SkippedTestIndicatorESomeTestsUnavailableAfterFiltering+SpecificTestsRequired!StacktraceBanner#StartingDiscovery#StartingExecution1StartTestSessionTimedOut)StdErrMessagesBanner)StdOutMessagesBanner/StopTestSessionTimedOut9StringFormatToJoinTwoStringsMSuggestTestAdapterPathIfNoTestsIsFound7SupportedFileTypesIndicator;SupportedFileWithoutSeparator5SupportedFileWithSeparatorGSwitchToIsolationInAppContainerModeKSwitchToIsolationInMultiTargetingModeQSwitchToIsolationInPhoneAppContainerMode'SwitchToNoIsolation=TestAdapterLoadingStrategyHelpMTestAdapterLoadingStrategyValueInvalid_TestAdapterLoadingStrategyValueInvalidRecursive7TestAdapterPathDoesNotExist'TestAdapterPathHelp9TestAdapterPathValueRequired_TestAdapterPathValueRequiredWhenStrategyXIsUsed5TestCaseFilterArgumentHelp7TestCaseFilterValueRequired

Source: unknown	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Documenti di spedizione 000293949040405959000.exe, Tank.cs

.Net Code: Polan System.AppDomain.Load(byte[])

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: 0xA04BB9CD [Mon Mar 22 08:35:25 2055 UTC]

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064EFEF0 push es; ret		2_2_064EFEF4
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Code function: 2_2_064E3FB7 push 24065EDAh; retf		2_2_064E3FD5

Source: Documenti di spedizione 000293949040405959000.exe

Static PE information: section name: .text entropy: 7.1490323177146875

Source: 0.2.Documenti di spedizione 000293949040405959000.exe.5530000.2.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.5530000.2.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, Form1.cs	High entropy of concatenated method names: 'oxycobaltammine', 'fringier', 'unchorded', 'wAhRr7CKv', 'Dispose', 'lVOGV1721', 'ULHqFVpPeqZbNsBNpV', 'TchE2TMnA4CKf52ZUf', 'f0mq9hQrUpsqOwSyGd', 'nTd0Zl0tx6BYOWEqZW'
Source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	High entropy of concatenated method names: 'pwiMsJJwOLAUrsrsiLrJk', 'vkJkyBAyMrJJZpZnJUUsB', 'pBDTEixOwwhDhOiywipLh', 'wZnEyxixGJZZTGvwQsrMDAvGiTwBJLT', 'erhT', 'aerhTteS46w', 'LvfQyBLvviAnvZJBUkfipTGCDTvQDxU', 'F6WFViyxW', 'TE3wDwuNS', 'MyGetProcAddressWrapper'

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Memory allocated: 4970000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599653	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598998	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598342	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597249	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Window / User API: threadDelayed 8259			Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Window / User API: threadDelayed 1599			Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 6768	Thread sleep count: 8259 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 6768	Thread sleep count: 1599 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599653s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598998s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe TID: 320	Thread sleep time: -594624s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599653	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598998	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598342	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597249	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4545882419.0000000005C80000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Process created: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe "C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Documenti di spedizione 000293949040405959000.exe, 00000000.00000000.2066101536.0000000000A92000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: procdump.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 2260, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 2260, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.Documenti di spedizione 000293949040405959000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3f3c9b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Documenti di spedizione 000293949040405959000.exe.3efaf80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 6396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Documenti di spedizione 000293949040405959000.exe PID: 2260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Documenti di spedizione 000293949040405959000.exe	29%	ReversingLabs
Documenti di spedizione 000293949040405959000.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ftp.concaribe.com	100%	Avira URL Cloud	malware
http://concaribe.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.12.205	true	false	high
concaribe.com	192.185.13.234	true	true	unknown
ftp.concaribe.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ftp.concaribe.com	Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/dotnet-test.	Documenti di spedizione 000293949040405959000.exe	false		high
https://aka.ms/vstest-configure-datacollector	Documenti di spedizione 000293949040405959000.exe	false		high
https://account.dyn.com/	Documenti di spedizione 000293949040405959000.exe, 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://concaribe.com	Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.ipify.org/t	Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Documenti di spedizione 000293949040405959000.exe, 00000002.00000002.4543807005.0000000002971000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/vstest-runsettings-arguments	Documenti di spedizione 000293949040405959000.exe	false		high
https://aka.ms/console-logger	Documenti di spedizione 000293949040405959000.exe	false		high
https://aka.ms/vstest-collect	Documenti di spedizione 000293949040405959000.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
192.185.13.234	concaribe.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560838
Start date and time:	2024-11-22 11:55:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Documenti di spedizione 000293949040405959000.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 71 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Documenti di spedizione 000293949040405959000.exe

Simulations

Behavior and APIs

Time	Type	Description
05:56:03	API Interceptor	11698437x Sleep call for process: Documenti di spedizione 000293949040405959000.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
192.185.13.234	draft bl_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	concaribe.com/wp-includes/assets/GkRyQpLAQhPD144.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	RFQ_PO_N39859JFK_ORDER_SPECIFICATIONS_OM.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.13.205
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	104.26.12.205
	DATASHEET.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	datasheet.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	104.26.12.205
	https://url.us.m.mimecastprotect.com/s/cx8GCJ6Aj8C8mZ33UVfXHy0nVz?domain=canva.com	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://dorentop.es/yorii/Odrivex/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	https://vidrariamortagua.pt/index.php/es/inicio/	Get hash	malicious	Unknown	Browse	104.22.50.245
	https:/novembro-24.s3.us-east-2.amazonaws.com/FAT-Comprovativo_Novembro_hky_22-11-2024_21.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	1.1.1.1
	http://cdn-webstats.com	Get hash	malicious	Unknown	Browse	172.67.215.185
	https://start.searchmagiconline.com/nav?emid=0F8BFBFF00050657None421A96011&appId=1654513741549412&string_interpolation=GET_BRAND_NAME	Get hash	malicious	Unknown	Browse	104.18.30.129
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	http://acsltddocu3.technolutionszzzz.net/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.66.38
	http://mweb.webhop.org	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
UNIFIEDLAYER-AS-1US	exe010.exe	Get hash	malicious	Upatre	Browse	192.185.35.56
	88a4dd8-Contract Agreement-Final378208743.pdf	Get hash	malicious	Unknown	Browse	162.241.114.35
	754619b-Contract Agreement-Final727916073.pdf	Get hash	malicious	Unknown	Browse	162.241.114.35
	Invoice_Billing_carolinadunesbh.com_6995261057.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	scam.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://irvinsahnimd.com/m/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TVc1aGNHUT0mdWlkPVVTRVIzMTEwMjAyNFUyNjEwMzE1MQ	Get hash	malicious	Unknown	Browse	192.254.189.167
	https://vintagefarmandbarn.com/%25$$%25$%25/%25$$%25/dBsG4Ne3GFI7tW1iwp6n.html	Get hash	malicious	HTMLPhisher	Browse	69.49.230.170
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	CHARIKLIA JUNIOR DETAILS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	50.87.144.157
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	69.49.245.172

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	sosoliso.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.12.205
	STMod_32bit.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	STMod.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	ST Mod - Patcher.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	STMod_32bit.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	STMod.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Bomke.ps1	Get hash	malicious	LummaC	Browse	104.26.12.205
	Sc.ps1	Get hash	malicious	LummaC	Browse	104.26.12.205
	https://hk-csl5g.top/com	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	104.26.12.205

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.137699977023649
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Documenti di spedizione 000293949040405959000.exe
File size:	598'016 bytes
MD5:	5d32495cf3af0094a17aa09f76b7d27c
SHA1:	3009c98452cd000828b3bf0ba8ad5b72d05c7f7e
SHA256:	e6f50a0c2551c1d2593b8963bac95b0a3f4aad6d6b60d2a4e09d0c70dfd37649
SHA512:	afa9331ef7fdf6b261b1a1164af17ab52fccb3f24ff659bd6242bf01ba210989bf326e4ba0141cdbb994f0759061f87e498a86fad7d77d566aa26dfcad35ebc1
SSDEEP:	12288:7O7LcE7rjYvGrCLXBozBd6bRMgvChOW1AsQ6nBhhdBrGZ:ZEcu29ozBUVMgvNW1AsQOfRG
TLSH:	01D47B44A3F84A29F2FB6F74BAB854214A33FC47AD36E66D254C208D1B63B50D960773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....K...............0..............5... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49350e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA04BB9CD [Mon Mar 22 08:35:25 2055 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x934bc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x94000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x96000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x91514	0x91600	2a1574129f89f6c4b0949b2f0b2e1129	False	0.6438662134565778	SysEx File -	7.1490323177146875	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x94000	0x586	0x600	3725bc2916ed261fb7504eaa278107ef	False	0.4134114583333333	data	4.021983263157424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x96000	0xc	0x200	0760b0782746b15bc40a395c2b19145b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x940a0	0x2fc	data			0.43848167539267013
RT_MANIFEST	0x9439c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 11:56:02.627371073 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:02.627474070 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:02.627573967 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:02.633796930 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:02.633833885 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:03.858349085 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:03.858460903 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:04.065332890 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:04.065371990 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:04.065836906 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:04.108385086 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:04.200516939 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:04.247324944 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:04.524168015 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:04.524256945 CET	443	49706	104.26.12.205	192.168.2.5
Nov 22, 2024 11:56:04.524333000 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:04.530807018 CET	49706	443	192.168.2.5	104.26.12.205
Nov 22, 2024 11:56:05.771034956 CET	49708	21	192.168.2.5	192.185.13.234
Nov 22, 2024 11:56:05.891618013 CET	21	49708	192.185.13.234	192.168.2.5
Nov 22, 2024 11:56:05.891736031 CET	49708	21	192.168.2.5	192.185.13.234
Nov 22, 2024 11:56:05.897455931 CET	49708	21	192.168.2.5	192.185.13.234
Nov 22, 2024 11:56:06.017201900 CET	21	49708	192.185.13.234	192.168.2.5
Nov 22, 2024 11:56:06.017379999 CET	49708	21	192.168.2.5	192.185.13.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 11:56:02.476547003 CET	50339	53	192.168.2.5	1.1.1.1
Nov 22, 2024 11:56:02.618993998 CET	53	50339	1.1.1.1	192.168.2.5
Nov 22, 2024 11:56:05.080461979 CET	58137	53	192.168.2.5	1.1.1.1
Nov 22, 2024 11:56:05.769383907 CET	53	58137	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 11:56:02.476547003 CET	192.168.2.5	1.1.1.1	0x60a0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 11:56:05.080461979 CET	192.168.2.5	1.1.1.1	0x283a	Standard query (0)	ftp.concaribe.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 11:56:02.618993998 CET	1.1.1.1	192.168.2.5	0x60a0	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 22, 2024 11:56:02.618993998 CET	1.1.1.1	192.168.2.5	0x60a0	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 22, 2024 11:56:02.618993998 CET	1.1.1.1	192.168.2.5	0x60a0	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 22, 2024 11:56:05.769383907 CET	1.1.1.1	192.168.2.5	0x283a	No error (0)	ftp.concaribe.com	concaribe.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 11:56:05.769383907 CET	1.1.1.1	192.168.2.5	0x283a	No error (0)	concaribe.com		192.185.13.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.26.12.205	443	2260	C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 10:56:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-22 10:56:04 UTC	399	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 10:56:04 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e68640b38eb420a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1582&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1798029&cwnd=250&unsent_bytes=0&cid=202c12398174d86c&ts=680&x=0"
2024-11-22 10:56:04 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 37 35 Data Ascii: 8.46.123.75

Target ID:	0
Start time:	05:56:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Imagebase:	0xa90000
File size:	598'016 bytes
MD5 hash:	5D32495CF3AF0094A17AA09F76B7D27C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2074626158.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:56:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Imagebase:	0x1f0000
File size:	598'016 bytes
MD5 hash:	5D32495CF3AF0094A17AA09F76B7D27C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:56:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Documenti di spedizione 000293949040405959000.exe"
Imagebase:	0x5e0000
File size:	598'016 bytes
MD5 hash:	5D32495CF3AF0094A17AA09F76B7D27C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4543807005.00000000029EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4543807005.00000000029C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4542512598.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	3

Executed Functions

Function 0115D5D0 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0115D65E
GetCurrentThread.KERNEL32 ref: 0115D69B
GetCurrentProcess.KERNEL32 ref: 0115D6D8
GetCurrentThreadId.KERNEL32 ref: 0115D731

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7966e1b0eeb01296cd409d7e8687b0d4c1ad5654b420a52326084a095d5a2864
Instruction ID: d395bd63ee833c741264d1c856474db12a12e28ebda9f089a23f0e3a2a3792f7
Opcode Fuzzy Hash: 7966e1b0eeb01296cd409d7e8687b0d4c1ad5654b420a52326084a095d5a2864
Instruction Fuzzy Hash: D35144B0900249CFDB58DFAAD548BAEBFF1EF49304F20C45AD419A7261D7389884CB65

Function 0115D5E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0115D65E
GetCurrentThread.KERNEL32 ref: 0115D69B
GetCurrentProcess.KERNEL32 ref: 0115D6D8
GetCurrentThreadId.KERNEL32 ref: 0115D731

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ff0102c393602b0a08f6c1f11c6a43a7970179a4a2651cd58810bbca65b4f6b1
Instruction ID: b4ac5986b5cdb376611bcd02ef65193cc91d687a036e6270b961f5e560a5c27d
Opcode Fuzzy Hash: ff0102c393602b0a08f6c1f11c6a43a7970179a4a2651cd58810bbca65b4f6b1
Instruction Fuzzy Hash: F85145B0900249CFDB58DFAAD548BAEBFF5EF49304F20C45AE419A7260D7349884CB65

Function 0115B33F Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0115B5A6

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 79615ab250eb58ce959a85696603854396996fd916ce6bec75b8998e51153dab
Instruction ID: 7af5a04bab26f32f1e30e6bc8d09b9bc4c9da879d0264139ac685644cfdcb07a
Opcode Fuzzy Hash: 79615ab250eb58ce959a85696603854396996fd916ce6bec75b8998e51153dab
Instruction Fuzzy Hash: 03814670A04B05CFD7A8DF29D0447AABBF2FF48204F10892ED9AAD7A50D734E845CB95

Function 01154248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011559C9

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 812e856f93687f639947c2ba02869fe1e402c4f680cc7fdbe411c6fa8597dc1d
Instruction ID: 4098c647d7d314a55464d337b6bfc8616b30f42ba6ed0267c8ab3872c1254318
Opcode Fuzzy Hash: 812e856f93687f639947c2ba02869fe1e402c4f680cc7fdbe411c6fa8597dc1d
Instruction Fuzzy Hash: EB41F2B0C0071DCBDB68CFA9C844B9DBBF6BF49304F20806AD418AB251DB756946CF91

Function 0115D828 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0115D8AF

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e24df82f858317cab57254e079c6175b2654dc4ab5e92f102704021f0b62cf84
Instruction ID: 44d46751ea90593d9d8f4140e7a98e64140eefa2b7d507f8f55ce9df605747d0
Opcode Fuzzy Hash: e24df82f858317cab57254e079c6175b2654dc4ab5e92f102704021f0b62cf84
Instruction Fuzzy Hash: 8D21B3B5900248DFDB10CF9AD584ADEBBF9FB48310F14845AE918A7350D378A944CFA5

Function 0115D821 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0115D8AF

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 64b729c80eaa981ee3cb3e6dbac54c1e1ef82094e7baf9dd0c20cc58e57fc5fe
Instruction ID: c19260590e40c038b41a2caa6fc05bb90dae108e228ec44cd338112243d8c1e6
Opcode Fuzzy Hash: 64b729c80eaa981ee3cb3e6dbac54c1e1ef82094e7baf9dd0c20cc58e57fc5fe
Instruction Fuzzy Hash: FA21E0B5900208DFDB10CFA9D584ADEBBF4FB08310F14845AE918A7210C378A944CFA5

Function 0115B540 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0115B5A6

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 347335c33ec4c13e398774a8ca7cae1656850602a2c2bcdddbbdf61ea4a170d0
Instruction ID: 4488b579e23a10125b6169eeb78aa3a6db77d1af18b60a349b9cdf223d6b8a88
Opcode Fuzzy Hash: 347335c33ec4c13e398774a8ca7cae1656850602a2c2bcdddbbdf61ea4a170d0
Instruction Fuzzy Hash: FA110FB5C002498FDB14DF9AC444A9EFBF9EB89314F10841AD929B7200C379A545CFA5

Function 010ED61C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071741890.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becb15297c70a0d7b93c397fa6872ba1bcd9393bde7f502cace7fe83700e2d36
Instruction ID: 19743ca56537d5cb38b80e35ead99306f8565d49dd934024f32515f6bd0cc8c2
Opcode Fuzzy Hash: becb15297c70a0d7b93c397fa6872ba1bcd9393bde7f502cace7fe83700e2d36
Instruction Fuzzy Hash: 01210371600244DFDB05DF98D9C8F2ABFE5FB98310F2485A9E98D0B256C33AD416CBA1

Function 010FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071832483.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5b323d411f8d201df6ca14721c132982a98803163931e06f071bf00d60a895
Instruction ID: 979bc18b57ffab6a32bfdc1b75e2856d780ea7e6196960c74b835f86ddc050d7
Opcode Fuzzy Hash: 7c5b323d411f8d201df6ca14721c132982a98803163931e06f071bf00d60a895
Instruction Fuzzy Hash: 10212571504200DFDB15DF68D581B16BFA5FB84314F20C5ADEA894B756C33AD407CB61

Function 010ED617 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071741890.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10ed000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 96eb0a97754d21cf01597a5d1895284993ca3ef4d4f631f8022cc54d2e99dd88
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2711AF76504280CFDB06CF54D5C8B16BFB2FB88314F24C5A9D9890B657C336D45ACBA2

Function 010FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071832483.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10fd000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: a307fca5768906321e53a098932bdbba624da7378b95e9cc8c2871d83360fe43
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: D211D075504280CFDB16CF54D5C4B15FFA2FB84314F24C6AEE9494B656C33AD40ACB62

Non-executed Functions

Function 0115E14C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072305058.0000000001150000.00000040.00000800.00020000.00000000.sdmp, Offset: 01150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1150000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7edaefa5f3ac33823d8e89386027ebafa30d02c54b66460fa4072f6ce5cd0e2
Instruction ID: e3479fe05d9d16ca6aa25c4121b552baf3fd80719d2a3c719c903e2cd274dcb9
Opcode Fuzzy Hash: b7edaefa5f3ac33823d8e89386027ebafa30d02c54b66460fa4072f6ce5cd0e2
Instruction Fuzzy Hash: 38A18032E00216CFCF19DFB4C8845DEBBB6FF85300B15456AE925AB265DB31EA06CB40

Analysis Process: Documenti di spedizione 000293949040405959000.exePID: 2260, Parent PID: 6396COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	86
Total number of Limit Nodes:	12

Executed Functions

Function 06502380 Relevance: 9.0, Strings: 6, Instructions: 1524COMMON

Download Yara Rule

Strings

$]q, xrefs: 0650382E
$]q, xrefs: 06503857
$]q, xrefs: 06503863
$]q, xrefs: 0650387B
$]q, xrefs: 0650383A
$]q, xrefs: 06503887

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 658ce4d59f232f021c918912c4027d42124df8a6ca897d52f9d71bb6e2494efd
Instruction ID: 52e90ea6a6a624ee8174a049cf981e3ad26a14a369c0a9030e62f3faae394954
Opcode Fuzzy Hash: 658ce4d59f232f021c918912c4027d42124df8a6ca897d52f9d71bb6e2494efd
Instruction Fuzzy Hash: 37E23834E002098FDB64DF68C598A9DB7F2FF89310F5485A9D449AB2A5EB34ED85CF40

Function 0650B300 Relevance: 8.3, Strings: 6, Instructions: 767COMMON

Download Yara Rule

Strings

$]q, xrefs: 0650BCCD
$]q, xrefs: 0650BC8D
$]q, xrefs: 0650BC99
$]q, xrefs: 0650BCC1
$]q, xrefs: 0650BC59
$]q, xrefs: 0650BC65

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: c440f5376a035e5dd2ee69badb51dc5db56263a1ef7180d691f3945cb61d7a55
Instruction ID: e4ee0af469e49f2c9e7860cd95d9bff436d5aa7cd0641aa49b24b777820ab3dd
Opcode Fuzzy Hash: c440f5376a035e5dd2ee69badb51dc5db56263a1ef7180d691f3945cb61d7a55
Instruction Fuzzy Hash: BD527F30E102099FEF64DB68D4D07AEB7B6FB85310F20892AE405DB295DB36DD85CB91

Function 06507E40 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 065083E7
$]q, xrefs: 065083DB

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 8a064f4c62af19a0a73e9874d0ecd3915223e097bf7e5f46f4f868f2ce584fe6
Instruction ID: bdcf199f40d900c3f58402352ee2542557d9997c97f0c115cfbe5f140e3782f6
Opcode Fuzzy Hash: 8a064f4c62af19a0a73e9874d0ecd3915223e097bf7e5f46f4f868f2ce584fe6
Instruction Fuzzy Hash: 45027C30B002159FEF58DF68D890AAEB7E6FF88304F148529D4099B395DB35EC86CB81

Function 065066C0 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef0891f34cc99ee51383a1ac9457fda8986ef2a737012a3c8d9fa35908ca327
Instruction ID: 732b50b0f0a6e586dda35c75299e69d3611f3d3acb75dcd7576de9f139a7ce84
Opcode Fuzzy Hash: cef0891f34cc99ee51383a1ac9457fda8986ef2a737012a3c8d9fa35908ca327
Instruction Fuzzy Hash: 4F62AC34B002058FEB54DB68D594AADB7F2FF88314F248469E409EB395DB35ED56CB80

Function 0650C240 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789f1822ed53671f9778b8210ded21de13c38fc3ace913faedfae21df9781cb3
Instruction ID: b06662102a4069634a1e08586a96b301a4b53c30e1e4b6d6ec89a8ecce2d92ec
Opcode Fuzzy Hash: 789f1822ed53671f9778b8210ded21de13c38fc3ace913faedfae21df9781cb3
Instruction Fuzzy Hash: F2328F34B102058FEB54DF68D990AADB7B6FB89310F108629E405DB395DB35EC46CB91

Function 065056A0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e13571df13c61cef7e0e15963e364d8d256bce426ae0cd6a623954da814701
Instruction ID: 193f22f969d744c3be872e6c1d3fd16793c2d6eade40deb7982f0471a65fe58f
Opcode Fuzzy Hash: 76e13571df13c61cef7e0e15963e364d8d256bce426ae0cd6a623954da814701
Instruction Fuzzy Hash: EE12B331F102059FEB64DB64D98066EBBB2FF84310F24886AD8599B385EA34DD45CF91

Function 0650AD98 Relevance: 10.4, Strings: 8, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0650AF18
$]q, xrefs: 0650AEC5
$]q, xrefs: 0650AF47
$]q, xrefs: 0650AEB9
$]q, xrefs: 0650AF64
$]q, xrefs: 0650AF3B
$]q, xrefs: 0650AF0C
$]q, xrefs: 0650AF70

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: b6bfa967e98b94f543b351a1b94e83ad9c7973d96a632a529bfb1933543bffd7
Instruction ID: 64f44ca125e075415f8c8bce7c82fabb60d8adfaa81e3af22fa7fdae193a6ba1
Opcode Fuzzy Hash: b6bfa967e98b94f543b351a1b94e83ad9c7973d96a632a529bfb1933543bffd7
Instruction Fuzzy Hash: 7EE15F30E1030A8FEB69DF68D9906AEB7B6FF85304F108529D409AB395DB35D846CB91

Function 064E320A Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 064E328E
GetCurrentThread.KERNEL32 ref: 064E32CB
GetCurrentProcess.KERNEL32 ref: 064E3308
GetCurrentThreadId.KERNEL32 ref: 064E3361

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f959c63ae4e389ad6158a479c84218d6f4c98e82f433b0beb876af8b3d882afd
Instruction ID: b69b0a9af01ead8456b3422010d5c110901ecefcde2b711e20f200b886e5ae14
Opcode Fuzzy Hash: f959c63ae4e389ad6158a479c84218d6f4c98e82f433b0beb876af8b3d882afd
Instruction Fuzzy Hash: 9A5157B09102498FDB95DFA9D948BEEBBF1FF88304F20845AE119AB360D7349944CF65

Function 064E3210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 064E328E
GetCurrentThread.KERNEL32 ref: 064E32CB
GetCurrentProcess.KERNEL32 ref: 064E3308
GetCurrentThreadId.KERNEL32 ref: 064E3361

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4052edd336e7b7d29fc47c9879701aaaf1f76181060b811410c5844860eb2f1a
Instruction ID: 28554c12a2df88e756c0f691a8a14ca4d3699bac21dfdef60ea572e36f79b658
Opcode Fuzzy Hash: 4052edd336e7b7d29fc47c9879701aaaf1f76181060b811410c5844860eb2f1a
Instruction Fuzzy Hash: C35146B09002498FDB55DFA9D948BEEBBF1EF88304F20845AE109A7360D7349944CF65

Function 06509210 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 065092C7
$]q, xrefs: 065092BB
$]q, xrefs: 06509280
$]q, xrefs: 0650928C

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: dda1f534ba4ba010473a9365a9b493e99f61bbdf4dcaa13a78f4ec73f1972834
Instruction ID: b775ea08d11e72b8bccc88ee7ed21bc772278ad257a70827fca6cacc8a87885b
Opcode Fuzzy Hash: dda1f534ba4ba010473a9365a9b493e99f61bbdf4dcaa13a78f4ec73f1972834
Instruction Fuzzy Hash: D6914F30B0021A8FDB54DF69D850BAEB7F6BF85604F508469D809EB389EB70DD468F91

Function 0650D008 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0650D3FF
$]q, xrefs: 0650D407
$]q, xrefs: 0650D413

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: d4f864989f1dee33bb6c7be306e0a088df30aa4df90da2547cc77942534875c2
Instruction ID: 4510cd0af93abbcf1c9cb2fe961cd43f4a85903a10257ea7a7340eb1179634de
Opcode Fuzzy Hash: d4f864989f1dee33bb6c7be306e0a088df30aa4df90da2547cc77942534875c2
Instruction Fuzzy Hash: E3626230A1021A8FDB55EF68D580A5DB7F6FF84344F208A29D4099F3A9DB75ED46CB80

Function 06504C68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06504DB9
fbq, xrefs: 06504C93
\Obq, xrefs: 06504E43

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 48bc64ffbf3a72f78870f94c041f6e0493df09c838a49d4053b13bd40f0c4a36
Instruction ID: fedd2ee251847fa2e74e153ae6ffafe901d32e52b5ded384cd9d683119ac1ccb
Opcode Fuzzy Hash: 48bc64ffbf3a72f78870f94c041f6e0493df09c838a49d4053b13bd40f0c4a36
Instruction Fuzzy Hash: A1615070E002099FEB549FA4C855BAEBBF6FB88300F208429E505AB395DB758D458F91

Function 06509200 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 065092BB
$]q, xrefs: 06509280

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: da6da232edd81e306b714c41b8e21645f537648c09fa3f20165c9976534bcae9
Instruction ID: 10aeaac9655c38bb6662adca8432332459114dfc48910adad4cf8eabe4316273
Opcode Fuzzy Hash: da6da232edd81e306b714c41b8e21645f537648c09fa3f20165c9976534bcae9
Instruction Fuzzy Hash: E7618030B041065FEB94DB78D891BAEB7F6FB84214F508469D409DB389EA30DC46CF91

Function 06504C59 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XPbq, xrefs: 06504DB9
fbq, xrefs: 06504C93

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: f39a9e8fb7433b3d3eaab6b7f2b2702684404f318f49810d4e3f9bffb23fe2f3
Instruction ID: 741ed91a11fdc007cd8e30533a9cf92772e9e98ccf9c6cf7fb3292050309d672
Opcode Fuzzy Hash: f39a9e8fb7433b3d3eaab6b7f2b2702684404f318f49810d4e3f9bffb23fe2f3
Instruction Fuzzy Hash: 3451AF30F102089FEB14DFB4C855BAEBBF6FF88700F208529E106AB395DA758C018B91

Function 064EB708 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 064EB96E

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6537bc2c2ed2703fdb070f56efcec0656de7a861712e3a9854ee6af426725148
Instruction ID: 7e3bc75bbd8c027bc20d99c64d0a7b406bab6cd87ee265809a92e747f9e76bd0
Opcode Fuzzy Hash: 6537bc2c2ed2703fdb070f56efcec0656de7a861712e3a9854ee6af426725148
Instruction Fuzzy Hash: E88132B0A00B458FD7A5DF29D5407AABBF1FF48201F008A2ED49ADBB50D775E849CB90

Function 064ED8E4 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 064EDA02

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cf7476c5111fc07c85e3adb0d6cae8eb8b9cf2f7c2ce110bc7fc7bfedbdd556e
Instruction ID: f558e3407c5997e527da1255b1478295beb8f260c84d7d3d520f8de01e4db284
Opcode Fuzzy Hash: cf7476c5111fc07c85e3adb0d6cae8eb8b9cf2f7c2ce110bc7fc7bfedbdd556e
Instruction Fuzzy Hash: 4A51B0B1D00349DFDB14CF9AC884ADEBFB5BF89310F24812AE419AB250D775A985CF90

Function 064ED8F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 064EDA02

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4fab698fe13d8452ce5fdf9f7ce76850d45c0d326b1c4b7785366249500616f8
Instruction ID: 3be0bfc3a7b2d5136d8cd5e9b5475491ce3c11de947cae060c7f4ed2d1a43b10
Opcode Fuzzy Hash: 4fab698fe13d8452ce5fdf9f7ce76850d45c0d326b1c4b7785366249500616f8
Instruction Fuzzy Hash: 6B41B0B1D10349DFDB14CF99C884ADEFBB5BF88310F24812AE819AB250D775A985CF90

Function 064E3450 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 064E34DF

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2af34a2104295a32970b3d2e4605b58774b6f8767656cca0f7018c4991d7660d
Instruction ID: ae20c42ff107bc9057238c5a0a57b71fc8c21adc0496f3a7a3c0757977e7ae34
Opcode Fuzzy Hash: 2af34a2104295a32970b3d2e4605b58774b6f8767656cca0f7018c4991d7660d
Instruction Fuzzy Hash: 1521E5B5D002489FDB11CFAAD984ADEBFF9FB48310F14841AE915A7310D379A940CFA1

Function 064E3458 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 064E34DF

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 392026e6a6491ac34a57bba75042e5eb3a042d19cea432dd96b5ab3166be1a20
Instruction ID: 63113222586f1de4821dab73a647a6d94c9576d5af076d0be58989df632aab22
Opcode Fuzzy Hash: 392026e6a6491ac34a57bba75042e5eb3a042d19cea432dd96b5ab3166be1a20
Instruction Fuzzy Hash: 8A21E2B59002489FDB11CFAAD984ADEFBF8FB48310F14801AE918A7310D379A940CFA1

Function 027DECC7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 027DED47

Memory Dump Source

Source File: 00000002.00000002.4543446433.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_27d0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fdd5c08418b99537587ea47056aaabc713e17ae83581580ddec06dbda402c0c5
Instruction ID: 7d4010a7128d17a05da1dc36f9b7a644bd8d1efcc50d583662b9e747e2a3a2af
Opcode Fuzzy Hash: fdd5c08418b99537587ea47056aaabc713e17ae83581580ddec06dbda402c0c5
Instruction Fuzzy Hash: 582144B1C006999FCB10CFAAC9457DEFBF4AF09310F15816AD518B7241D778A944CFA1

Function 027DECE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 027DED47

Memory Dump Source

Source File: 00000002.00000002.4543446433.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_27d0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3afe976101b2c5155f6adb4ad28f26f94e238511755a3caa8b41e7dad4cdf437
Instruction ID: a6ef6ef3c06004970cb4b7dd5ea88fe64d3192fc840dea054ba1d0504436a56c
Opcode Fuzzy Hash: 3afe976101b2c5155f6adb4ad28f26f94e238511755a3caa8b41e7dad4cdf437
Instruction Fuzzy Hash: F411EFB1C0065A9BCB10DF9AC944A9EFBF4AF49320F15816AD918A7240D778A944CFA5

Function 064EB908 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 064EB96E

Memory Dump Source

Source File: 00000002.00000002.4546339823.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_64e0000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0278b8d815efa0acea8c8ed02b942e82822c0c7c5d96576263ac4d2bfe95465d
Instruction ID: 1cdb10f2835da784cd852f379d89320f271ebba3342737e75a8c3e85f78e3c3a
Opcode Fuzzy Hash: 0278b8d815efa0acea8c8ed02b942e82822c0c7c5d96576263ac4d2bfe95465d
Instruction Fuzzy Hash: 5A11DFB5C00649CFDB10DF9AC944A9EFBF4EF88314F10841AD969A7210C379A545CFA1

Function 0650DB7D Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0650DCD9

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 884585a8772e46a8d844afa756820e52ecff73c91f08e1c421bd905af65497d8
Instruction ID: 6f25ba62499bed65bc829d1ca721a63b1381c7eccc7a5c6c6f5968a875251bae
Opcode Fuzzy Hash: 884585a8772e46a8d844afa756820e52ecff73c91f08e1c421bd905af65497d8
Instruction Fuzzy Hash: 1441A130E14249DFEB54DFA4D8546AEBBB2FF85300F244A29D405EB280EBB0D946CF81

Function 065021EB Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06502333

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 0e019bff8623db25037bf26349302bee7c5e46c69027864a94b48ccfd20983fe
Instruction ID: de40232c9b903530a97b32cd19f13106f22045183a93c7ee3b0be4456fbf4bb4
Opcode Fuzzy Hash: 0e019bff8623db25037bf26349302bee7c5e46c69027864a94b48ccfd20983fe
Instruction Fuzzy Hash: AB31E330B102028FEB48ABB4D9557AE77A2BF89204F248428D406EB395DF35DE46CB91

Function 065021F8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06502333

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 27331d6f6f6d43e12c4f3bd4e8775d1746f31747acf2658152491d2ee2345265
Instruction ID: 972e090c1dce3a8eef45791041f54462bd97e92b46a2cc2acc9357d5177b6b7b
Opcode Fuzzy Hash: 27331d6f6f6d43e12c4f3bd4e8775d1746f31747acf2658152491d2ee2345265
Instruction Fuzzy Hash: 6231BE30B102028FEB48ABB4985876F7BA6BFC9300F208428D406DB395DF35DE46CB95

Function 06508390 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$]q, xrefs: 065083DB

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 2f5e7e1b417207669fa33639ed47089d4c84c357076cd7b904d3db40da1e9843
Instruction ID: a55a27bf76b36b5f00def2a2c2893f709bc79e55ae91f295aa67b4420f7df3fe
Opcode Fuzzy Hash: 2f5e7e1b417207669fa33639ed47089d4c84c357076cd7b904d3db40da1e9843
Instruction Fuzzy Hash: 94F0AF31B14100DFEFA89E48E981AB9B3A8FB84318F144466D845CB2C5C731E906CB91

Function 0650B2F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152d376662c9adff2d040e6f1b9a10c4c81da4d8c4d4d6dc51e01983d3e3a2d9
Instruction ID: e2de7dbbb5ed7beb570648cb809df7ec5edd3956ce6936b205211d1b5debdae8
Opcode Fuzzy Hash: 152d376662c9adff2d040e6f1b9a10c4c81da4d8c4d4d6dc51e01983d3e3a2d9
Instruction Fuzzy Hash: AFA1A270F102099FFF649A68D4D07AE77B6FB89310F204825E405EB3D6DA3ADD818B52

Function 0650B708 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10f952107e872598c7bb246da5174a896d72f3ddbbedf7fe8202d68a00ea220
Instruction ID: e7e6f06bfcf6f43e981c743659187bf4af412a0df276ff4f5b4083ac7e9598ac
Opcode Fuzzy Hash: c10f952107e872598c7bb246da5174a896d72f3ddbbedf7fe8202d68a00ea220
Instruction Fuzzy Hash: F7A14870E1020A8FEFA4DB68D5C0BADB7B1FB45314F248926E459DB291D73ADC81CB91

Function 065062C0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cb2ee5441d51b0f34ec45e443bbf64071e59dda0579e10d1a6284e6e43c1b2
Instruction ID: 4a830d5e7adde618f993a01e2a27cf2de38a6d6c2902b1c1778956b9bcd05964
Opcode Fuzzy Hash: d8cb2ee5441d51b0f34ec45e443bbf64071e59dda0579e10d1a6284e6e43c1b2
Instruction Fuzzy Hash: 3E61C171F001214FEB54AA6EC8805AFBADBAFD4220F154479E80EDB3A0DE79DD0287D1

Function 06504399 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bb52bff56e31ea53409cf20c34ba1e0fb17c1e809eb49e244adb66dc2ba810
Instruction ID: 0cdf276e7d38a3b3330311cc211e6540481d2ddb2091c18b28de87fad34e8086
Opcode Fuzzy Hash: c1bb52bff56e31ea53409cf20c34ba1e0fb17c1e809eb49e244adb66dc2ba810
Instruction Fuzzy Hash: 50817030B002099FDB54EFB9D4546AEBBF2BF89304F218429D50ADB395EB35DC468B91

Function 065046B8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bde96c448eb309e7599a960bbbddd367c12b4e03b71feaec65567f4185b6247
Instruction ID: add3287b2defbbdcb9d8fb00781992ee2463f62254e12bdb4817e8c5148b7135
Opcode Fuzzy Hash: 2bde96c448eb309e7599a960bbbddd367c12b4e03b71feaec65567f4185b6247
Instruction Fuzzy Hash: 8E913D30E102198FDF64DF68C890B9DB7B1FF85300F208599D549AB295DB74AA86CF91

Function 065046D0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5748ea9de7db0265c6c421a1452330299f33d98119eee4b0cd11633e46e9914
Instruction ID: 56c5f701b5bcd1476c4d45198fb866b8985c79d69985cfead28db551acdb13cd
Opcode Fuzzy Hash: a5748ea9de7db0265c6c421a1452330299f33d98119eee4b0cd11633e46e9914
Instruction Fuzzy Hash: A4913F30E10219CBDF64DF68C890B9DB7B1FF85300F208599D549BB295DB70AA86CF91

Function 0650EFD8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea652719bdd8a10c676c37f4d568ad8bc4c680eb2bc3ad96f846413903d64fb
Instruction ID: d2c958bf199df487eea5606fc7e38b841ed69edfefe2c2aec304a405f3782583
Opcode Fuzzy Hash: 5ea652719bdd8a10c676c37f4d568ad8bc4c680eb2bc3ad96f846413903d64fb
Instruction Fuzzy Hash: 4A714D70A002099FDB58DFA8D990AAEB7F6FF84300F248429D419EB395DB35ED46CB50

Function 0650EFE8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c66bd462379a2a8cadb13e41817930449769f09a57d64bc2c021639d8d1ede8
Instruction ID: 54f9735919964469cb79b8bc61be80c52b087de75c2afaa1d269995e729410de
Opcode Fuzzy Hash: 3c66bd462379a2a8cadb13e41817930449769f09a57d64bc2c021639d8d1ede8
Instruction Fuzzy Hash: 3A714D70A002499FDB54EFA8D990A9EBBF6FF84300F148429D415EB395DB34ED46CB50

Function 0650FC68 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2727f0e2a88ec26e592d4e14c49624c2e31d9ec4b4dd4829d0ed3ce3ee9cb916
Instruction ID: 1a9fa6199592d8dcc42d0733cd2686f6744a4b274ae77d0baa5ad8b9729b0d5e
Opcode Fuzzy Hash: 2727f0e2a88ec26e592d4e14c49624c2e31d9ec4b4dd4829d0ed3ce3ee9cb916
Instruction Fuzzy Hash: 7551D631E00105DFEF64EB78E4446ADBBB2FF84315F20886AE519D7291DB35D949CB81

Function 0650FA18 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa86395cd629d5c5139e62d1952c0776f6892c95c3451b15aa8e03596b2a07fb
Instruction ID: dc55885aa07411406cfabacd3d7c51c7910e94f7bfd2af0bf71c10c42d8269cd
Opcode Fuzzy Hash: aa86395cd629d5c5139e62d1952c0776f6892c95c3451b15aa8e03596b2a07fb
Instruction Fuzzy Hash: 0151E970B142149FFF74667CD95477F2A5EFB89710F20452AE80AC73D5CA68CC468B92

Function 0650FA28 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231c14e3ce77791c5985acec5c5dc5eb9a4192a24fcf2e0b22ef113ab51926d1
Instruction ID: b5128b0919c66fdfb2293d9e696e31ce994811b70f532dcdbec8bf484e1f4c14
Opcode Fuzzy Hash: 231c14e3ce77791c5985acec5c5dc5eb9a4192a24fcf2e0b22ef113ab51926d1
Instruction Fuzzy Hash: 74518870B102159FFF74666DE95472F265EF789710F20492AEC0AC73D5CA68CC458B92

Function 06505520 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1f13d954fdcd8ecf30e780b187c59de1fd79253048f651cec06035eac9c6d9
Instruction ID: a2cd1bd7b98c01992e1c2448baf849cc438f3741fbfaaeddacc1081d73a2130b
Opcode Fuzzy Hash: 2f1f13d954fdcd8ecf30e780b187c59de1fd79253048f651cec06035eac9c6d9
Instruction Fuzzy Hash: 97414F75E006098BEF70CEA9D980AAFF7B6FB84310F10492AE256D7650E731E9458F91

Function 065020A8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3083edde5a272db182dd43c025760264ae99097bb8cb22acdbb680e169126b
Instruction ID: 6921d3415bade2468b86daa3037449a4530269cb863cd7aa055ab0f6cc5379f7
Opcode Fuzzy Hash: fa3083edde5a272db182dd43c025760264ae99097bb8cb22acdbb680e169126b
Instruction Fuzzy Hash: 2A31B234E146058FDB59CF64D89969EBBB2FF89300F10C529E916EB780DB71E946CB40

Function 065020B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113c032a1720a83810ceb65d09e59a9a0275838c9179ee4f2037ec7eda458750
Instruction ID: a0fed6712f335f0b63699124f0b57fdaaa10d133c27d96512e7a9eceaabdb8c6
Opcode Fuzzy Hash: 113c032a1720a83810ceb65d09e59a9a0275838c9179ee4f2037ec7eda458750
Instruction Fuzzy Hash: E5316F34E146098FDB59CF65D89869EBBB2BF89300F10C529E916E7390DB71E946CB40

Function 06503B98 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c61f5b518e7508db02c011fc0939c1d7ab1ab934e5cc9b2aad2d7046e05cd71
Instruction ID: 278c820ef14f93fdc4c9d9014da37ac9088b77bfeb498e416354b580e6843d0e
Opcode Fuzzy Hash: 1c61f5b518e7508db02c011fc0939c1d7ab1ab934e5cc9b2aad2d7046e05cd71
Instruction Fuzzy Hash: 9921BA75F016169FEB10DF68D880AAEBBF1FB48310F008025E905EB394E734D8428B90

Function 00C4D005 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4542843321.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c4d000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fe389461e56bfd14253ca6636a322b25b4969e59ae3b3922c4dc783c199db9
Instruction ID: 392579e1eb66679f09a61c229cf7e7dda8ebaf63ffc8b13893ccd07b306c1d87
Opcode Fuzzy Hash: a2fe389461e56bfd14253ca6636a322b25b4969e59ae3b3922c4dc783c199db9
Instruction Fuzzy Hash: 04316B7550D3C49FCB13DB24C990711BF71AB47214F29C5EBD9898F2A3C23A980ACB62

Function 06503BA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c54ee9d3cf5389f22c974913c82d02232dacece258fc519522513dca4f53108
Instruction ID: 6581f39c153b79a164ddabbc85bd8d5057eb00012de38084b4b37e090011b366
Opcode Fuzzy Hash: 3c54ee9d3cf5389f22c974913c82d02232dacece258fc519522513dca4f53108
Instruction Fuzzy Hash: 1321BD75F012169FEB50DFA9D881AAEB7F1FB48700F108429E905EB394E735E9418B91

Function 00C4D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4542843321.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c4d000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a78f917de1c46b6caba397edc5c37cb2ec30e5fc3efdd0557cc30d5b34e4608
Instruction ID: d9e5ffaa38dc636506a53b25ce0f08d42d37934689dbc784f7cc61c98fe9cad5
Opcode Fuzzy Hash: 3a78f917de1c46b6caba397edc5c37cb2ec30e5fc3efdd0557cc30d5b34e4608
Instruction Fuzzy Hash: 6B21FF71604204DFCB15EF24D980B26BFA5FB88314F24C56DE90A4B296C37AD846CA62

Function 06506DD8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe9ed187663705b23cc25cd1b621858f39d678a5c3116616521b155fe7ec923
Instruction ID: 1c39a0705197ccfd59ce80f4a373d45c07fe9ed4e38f8c68519ddb02b501432d
Opcode Fuzzy Hash: 1fe9ed187663705b23cc25cd1b621858f39d678a5c3116616521b155fe7ec923
Instruction Fuzzy Hash: 7421AF31B101199FEF94DB68E95469EB7B6FB88310F148435D809EB3C4DB30ED518B80

Function 06505511 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b1163f673dd111c2778d50ed0646520897db3bdbbebf57edaa20631b2b42e0
Instruction ID: 20b4a15b219928905e065c254e981e95d9213ae3c6d651840c30182001c42a26
Opcode Fuzzy Hash: 58b1163f673dd111c2778d50ed0646520897db3bdbbebf57edaa20631b2b42e0
Instruction Fuzzy Hash: 3A114971A006098FDB24CFA9D9C49AFFBB6FF88300B148A2AD15597691D731A849CF90

Function 065042F8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759f57d7236905896a42e5aa5612003680db595178f0f66b1bd9414b99b1df4
Instruction ID: 019111526988470b4313316ba503052a07b8152a7010d02e056bf971cf47cf4e
Opcode Fuzzy Hash: 3759f57d7236905896a42e5aa5612003680db595178f0f66b1bd9414b99b1df4
Instruction Fuzzy Hash: 26114530B042600FEB66D67C94047BEBBDADBCA314F14847EE20DCB392D951CC068791

Function 06503CB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cc61efcafedf9d879693d594d7ab1a57fae7199a9768a91a1ac03d1cbbc081
Instruction ID: 6142a7b3885c5d44bb4109f9892bf8db52cc7b0a10f33f2f23c12a68bad8b0d1
Opcode Fuzzy Hash: 07cc61efcafedf9d879693d594d7ab1a57fae7199a9768a91a1ac03d1cbbc081
Instruction Fuzzy Hash: DB11E132B105298FEB54D668D8146AE73E6FBC8700F00453AD40AE7384DE29CC068BD1

Function 0650F259 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31330e3e958b072f25d44f7259fb27368a62408ccd861b919c1c45b284a10905
Instruction ID: e5aa0f15e7d3dfa97b5ccb1781081c3cd130afa3496cb17f632eaf3370a5ad0a
Opcode Fuzzy Hash: 31330e3e958b072f25d44f7259fb27368a62408ccd861b919c1c45b284a10905
Instruction Fuzzy Hash: DC012835B105514FDB65CABCD854B7A7BD5EBC6314F14846AE40ECB381DA21DC068785

Function 06503CA8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a36d3d98a58ea0abe194903007aa9dd0baad23a041166555cc3c978c3a0f4e1c
Instruction ID: 0db7a22c3d3d736189516c39808cfe3045d3d024bace1597c0ad69b51501d823
Opcode Fuzzy Hash: a36d3d98a58ea0abe194903007aa9dd0baad23a041166555cc3c978c3a0f4e1c
Instruction Fuzzy Hash: 1E01F73AF104295BEB559668DC157FF33EAEBC4610F000036D50AE7284EE64CC064BD2

Function 06503158 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccafd958512fb3b7a42a6194568c4bb15612914a910315f8954db5a9cb3c59a
Instruction ID: 54f5759d8828e738407d7240b9ba82e469e8c606512f159995e74eb93fac8252
Opcode Fuzzy Hash: 3ccafd958512fb3b7a42a6194568c4bb15612914a910315f8954db5a9cb3c59a
Instruction Fuzzy Hash: DD016171E0021A9EDB68DBB9C8505DEF7B5FB89310F108A6AD51AE7240EA30DA45CBD1

Function 06503970 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7743f43171ace681bbefafa1aa625b0ff669d70193bb901a2c3363bda8d858
Instruction ID: 4c33530f340ae5a42a543105b189835f88945ce80b43919f4a471f3b70b81fa4
Opcode Fuzzy Hash: 3c7743f43171ace681bbefafa1aa625b0ff669d70193bb901a2c3363bda8d858
Instruction Fuzzy Hash: DF21F2B1C01259AFCB00CF9AD884ACEFFB4FB48310F10816AE918A3240C374A944CFA5

Function 0650A3C9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d5486900492b99652b76059f914762840b3ca29003da464f26a20daebdbf08
Instruction ID: 0f941c0e8c1fb7eb7274bb90561470249ff8e4f557d66904603d74578a344de4
Opcode Fuzzy Hash: f6d5486900492b99652b76059f914762840b3ca29003da464f26a20daebdbf08
Instruction Fuzzy Hash: B401D434B045200FD751DE3CD964B6A3BE5EB8A700F104469E40ECB3D2DE21DC028B81

Function 06503978 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8579ffc24611ca879d114e0ef2ba600d49d6d933f66fde38169d1b452677a045
Instruction ID: e11d92c3657a5bba855c2ed18709244b393e5e7e31a76ccae51a8fb2977856e5
Opcode Fuzzy Hash: 8579ffc24611ca879d114e0ef2ba600d49d6d933f66fde38169d1b452677a045
Instruction Fuzzy Hash: 6311B3B5D012599FDB00DF9AD885ADEFFF8FB49310F10812AE918A7240C374A554CFA5

Function 06504308 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f791a350fe8688ed7e480662c70d904d79f92b61128501a4368de2a70bd1eb42
Instruction ID: faf3c40f3945b77841414638f1f55e6f7985917e4b16fce87edeef39b175f3d5
Opcode Fuzzy Hash: f791a350fe8688ed7e480662c70d904d79f92b61128501a4368de2a70bd1eb42
Instruction Fuzzy Hash: 2C01F431B001204BEB64DA6DD40476FB3CAEBCA725F20883AE20EC7384DE61DC4247C1

Function 0650F268 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307073eb7a65a7bf3f528bc0f751fa8c1caf186fa0d537de4f80c09aabcc8f98
Instruction ID: 65c3c2b65fc0a0e85f80ba80c52f0aa4e2993c51498f7eebe94f3bf90a0e8f9b
Opcode Fuzzy Hash: 307073eb7a65a7bf3f528bc0f751fa8c1caf186fa0d537de4f80c09aabcc8f98
Instruction Fuzzy Hash: 3E01D135B104110BEB6599ADDC54B2E77CAEBCA724F10843AE90EC7380DE15EC024785

Function 0650A3D8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48321efe2fe6865aebe546e853f52bf5ca6d6d42275e9607f55d74d9c6103d1
Instruction ID: 376f5662b375225336610aa12917235803aa0b6d22971b67ad4b0cb7174290e6
Opcode Fuzzy Hash: a48321efe2fe6865aebe546e853f52bf5ca6d6d42275e9607f55d74d9c6103d1
Instruction Fuzzy Hash: C101A435B105101FDB64EA7CD555B2A77D5EBCA710F108439E50ECB3C6EE21DC428B81

Function 0650C898 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e162825c387dfc39544138ffebd2be4e2586b33d60c11b8d03fb97d5e82c6849
Instruction ID: da237d27b99dd1b29b3cbb1d21cba5fce64b3381c40ac35ce8978ef3f0ebde4e
Opcode Fuzzy Hash: e162825c387dfc39544138ffebd2be4e2586b33d60c11b8d03fb97d5e82c6849
Instruction Fuzzy Hash: D5F0A732E202249BDB14A965DC0059AB73AF786350F104529DD01EB384D731A8008BC0

Function 06506540 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a8a8354d174f1dc84e5f33530e59fd357c7e34ef11f54b2e4c2a8c99ad0486
Instruction ID: 9fa80ad524e4fa0d2eb96ea31891f75292133006a6a4bb7da6d1e7f1d6a3adb5
Opcode Fuzzy Hash: 75a8a8354d174f1dc84e5f33530e59fd357c7e34ef11f54b2e4c2a8c99ad0486
Instruction Fuzzy Hash: 21E0D835D192449FEB91CB709A593AA3B74FB42204F2044E7D408DB183E13ACE518741

Function 06506550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616f49ecab21f6605a30a3e930597ddc1706b10694b91ff6f9ff3ed03d43608b
Instruction ID: 64a1f4b0c67895abe07367d346f40cb5501204ba4a8b0d5606bf9a78123fc52e
Opcode Fuzzy Hash: 616f49ecab21f6605a30a3e930597ddc1706b10694b91ff6f9ff3ed03d43608b
Instruction Fuzzy Hash: B6E0C270E10109ABEF50CEB4CA4975E73BCF701204F6088A4E408C7282E536CA118B40

Non-executed Functions

Function 06507760 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06507C0D
$]q, xrefs: 06507CB8
$]q, xrefs: 0650788D
$]q, xrefs: 06507CCE
$]q, xrefs: 06507881
$]q, xrefs: 0650785C
$]q, xrefs: 06507CC2
$]q, xrefs: 06507850
$]q, xrefs: 06507C19
$]q, xrefs: 06507CAC

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 5dbb76b693e29ebdf37db58339ca4b6862b4f1c8b7b05baf3e6e0685972ae73f
Instruction ID: cadc652c54b748af6d2ae726e8fee4e6bb91e5469ce93848d36dc6b971dba283
Opcode Fuzzy Hash: 5dbb76b693e29ebdf37db58339ca4b6862b4f1c8b7b05baf3e6e0685972ae73f
Instruction Fuzzy Hash: 55120F31E012198FDB68DF69C994A9DB7F2BF88304F208969D409AB394DB34ED45CF91

Function 0650AA00 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0650ABB2
$]q, xrefs: 0650AB88
$]q, xrefs: 0650AAF6
$]q, xrefs: 0650AB7C
$]q, xrefs: 0650AB51
$]q, xrefs: 0650AB02
$]q, xrefs: 0650ABBE
$]q, xrefs: 0650AB5D

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: e1fbbe3fc912717c120ccacea243f41ae7d820c7bfec62a8d23012a35bbb124c
Instruction ID: 09f92eacc7518527b8342c625835caae2c35a1582a2c0efc8fa731b8cc9cbe08
Opcode Fuzzy Hash: e1fbbe3fc912717c120ccacea243f41ae7d820c7bfec62a8d23012a35bbb124c
Instruction Fuzzy Hash: D7914D30A10309DFEB68DF64D995B6E7BB6FF84300F108529E841AB296DB74D845CF90

Function 06507160 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 065074A8
$]q, xrefs: 06507668
.5uq, xrefs: 065071BB
$]q, xrefs: 06507442
$]q, xrefs: 065075FC
$]q, xrefs: 0650749C
$]q, xrefs: 06507674

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 9af26a9f24358a8b8ce4b935c08409f21ec9f86130eeadb44f6a63e595cf1fb8
Instruction ID: 2de89133c97545bb05d9a3d9f5e68cdcaf38f7623001e5c686cdf7ed3cd53c54
Opcode Fuzzy Hash: 9af26a9f24358a8b8ce4b935c08409f21ec9f86130eeadb44f6a63e595cf1fb8
Instruction Fuzzy Hash: C5F13F30B01205CFDB59EF69D554A6EB7B6FF88300F248569D4459B3A9DB35EC82CB80

Function 06508498 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06508757
$]q, xrefs: 065086FE
$]q, xrefs: 065086F2
$]q, xrefs: 06508763

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 94a4fdd8c86a9a17555f4afcdb565e1f3b5c9722a24105abe802d6102dfe82a9
Instruction ID: 123395bf8b1d15a46bd9cc92d5980b62de3a9db2d7bdfd0f7a18c994bf0507f5
Opcode Fuzzy Hash: 94a4fdd8c86a9a17555f4afcdb565e1f3b5c9722a24105abe802d6102dfe82a9
Instruction Fuzzy Hash: D6B12D30E10209CFEB58EF68D594A6EB7B6FF84304F648829D4069B395DB35DC86CB81

Function 0650AD88 Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

$]q, xrefs: 0650AEB9
$]q, xrefs: 0650AF64
$]q, xrefs: 0650AF3B
$]q, xrefs: 0650AF0C

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: b9ed30e701a7550e99a05d47bfcadb574e2dd2b573d0921df00e3bc00c9891d9
Instruction ID: e440da2f124ef77f2020dd20a16dcdbcfc43d20547b81a36f14abaace503b7c0
Opcode Fuzzy Hash: b9ed30e701a7550e99a05d47bfcadb574e2dd2b573d0921df00e3bc00c9891d9
Instruction Fuzzy Hash: 86519274A103058FEBA5DB64D580AAEB7B6FF84311F14852AD805EB296DB30DC41CF90

Function 065088B0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 0650893B
LR]q, xrefs: 065089F2
LR]q, xrefs: 065089A3
$]q, xrefs: 0650892F

Memory Dump Source

Source File: 00000002.00000002.4546408243.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6500000_Documenti di spedizione 000293949040405959000.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: be199628eadfe28905d0f096058fd45cf67aac21fd9bd5889697af927650d4a9
Instruction ID: 6eecc4e5f1e7064b02ec4a9517588d22b101b17a3096917443b356d8c1398373
Opcode Fuzzy Hash: be199628eadfe28905d0f096058fd45cf67aac21fd9bd5889697af927650d4a9
Instruction Fuzzy Hash: 0D517C30B102019FEB58EF68D990E6AB7E6FF84710F148969E4069F3E5DA30EC45CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Documenti di spedizione 000293949040405959000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
Documenti di spedizione 000293949040405959000.exe

Function 0115D5D0 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Function 0115D5E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0115B33F Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 01154248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0115D828 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 0115D821 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 0115B540 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06507E40 Relevance: 3.0, Strings: 2, Instructions: 476
COMMON

Function 0650AD98 Relevance: 10.4, Strings: 8, Instructions: 397
COMMON

Function 064E320A Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 064E3210 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06509210 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 0650D008 Relevance: 4.6, Strings: 3, Instructions: 804
COMMON

Function 06504C68 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 06509200 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Function 06504C59 Relevance: 2.6, Strings: 2, Instructions: 141
COMMON

Function 064EB708 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre