Edit tour

Windows Analysis Report
NSudo.exe

Overview

General Information

Sample name:	NSudo.exe
Analysis ID:	1562125
MD5:	5cae01aea8ed390ce9bec17b6c1237e4
SHA1:	3a80a49efaac5d839400e4fb8f803243fb39a513
SHA256:	19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618
Errors Script error: Line 6118 (File "C:\Program Files (x86)\AutoIt3\Include\analysishelper.au3"): if StringLower(StringRight($path, 4)) == ".htm" or StringLower(StringRight($path, 5)) == ".html" or String No process behavior to analyse as no analysis process or sample was found

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Classification

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: NSudo.exe

ReversingLabs: Detection: 52%

Source: NSudo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdbSS source: NSudo.exe
Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdb source: NSudo.exe

Source: NSudo.exe	String found in binary or memory: https://forums.mydigitallife.net/threads/59268/
Source: NSudo.exe	String found in binary or memory: https://github.com/M2Team/NSudo

Source: classification engine

Classification label: mal48.winEXE@0/0@0/0

Source: NSudo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NSudo.exe

ReversingLabs: Detection: 52%

Source: NSudo.exe	String found in binary or memory: -Help
Source: NSudo.exe	String found in binary or memory: -Install
Source: NSudo.exe	String found in binary or memory: -Help Show this content.
Source: NSudo.exe	String found in binary or memory: -Install Copy NSudo to the Windows directory and add the context menu.
Source: NSudo.exe	String found in binary or memory: -Help Affiche l'aide.
Source: NSudo.exe	String found in binary or memory: -Install Copie NSudo dans le r

Source: NSudo.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NSudo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NSudo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: NSudo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdbSS source: NSudo.exe
Source:	Binary string: E:\Projects\NSudo\Output\Release\x64\NSudo.pdb source: NSudo.exe

Source: NSudo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NSudo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NSudo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NSudo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NSudo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NSudo.exe	53%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://forums.mydigitallife.net/threads/59268/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/M2Team/NSudo	NSudo.exe	false		high
https://forums.mydigitallife.net/threads/59268/	NSudo.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562125
Start date and time:	2024-11-25 08:35:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	0
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NSudo.exe
Detection:	MAL
Classification:	mal48.winEXE@0/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Errors

Script error: Line 6118 (File "C:\Program Files (x86)\AutoIt3\Include\analysishelper.au3"): if StringLower(StringRight($path, 4)) == ".htm" or StringLower(StringRight($path, 5)) == ".html" or StringLower(StringRight($path, 6)) == ".xhtml" or StringLower(StringRight($path, 6)) == ".shtml" or or StringLower(StringRight($path, 4)) == ".svg" then if ^ ERROR Error: Error in expression.
No process behavior to analyse as no analysis process or sample was found

Warnings

VT rate limit hit for: NSudo.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.2191709910374895
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NSudo.exe
File size:	252'928 bytes
MD5:	5cae01aea8ed390ce9bec17b6c1237e4
SHA1:	3a80a49efaac5d839400e4fb8f803243fb39a513
SHA256:	19896a23d7b054625c2f6b1ee1551a0da68ad25cddbb24510a3b74578418e618
SHA512:	c8e54c92133ba686238ea554c1cd82ba441db5fd4b0cbd5082d5eb4ddfcedd15506b9dac553459d0b2221c75778241f926ed3eef64571e4b1e0eb6f80ff9b481
SSDEEP:	3072:n3vg+rJrkQVOUPrxLExK08A+MQ20AFHxH32Hdxkq5:n3vg+rOgOyrNEI3AxQUHK
TLSH:	2D342A4A7E58C0B5D0A791F899438A82F7B1FC16073043BF13A972791F772B1BE2A651
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......( .<lA.olA.olA.o.(.nhA.olA.o[A.o>).noA.o>).nnA.o.'.nmA.o.'.niA.o>).nkA.o.(.nmA.o.(.n}A.o.(.nBA.o.'.nyA.olA.ox@.o.(.niA.o.(oomA.

Static PE Info

General

Entrypoint:	0x14001b3e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C2A0B8A [Mon Dec 31 12:28:58 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	55fa9bd502457bea13d3626a68dc1cad

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F06710B870Ch
dec eax
add esp, 28h
jmp 00007F06710B82C3h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 48h
call 00007F06710B09CCh
mov dword ptr [esp+58h], eax
call 00007F06710B2663h
inc ebp
xor ecx, ecx
dec esp
lea eax, dword ptr [esp+68h]
cmp eax, 01h
dec eax
lea edx, dword ptr [esp+30h]
dec eax
lea eax, dword ptr [esp+58h]
inc ecx
sete cl
dec eax
mov dword ptr [esp+20h], eax
dec eax
lea ecx, dword ptr [esp+60h]
call dword ptr [00003015h]
dec eax
add esp, 48h
ret
dec eax
mov eax, dword ptr [00003011h]
dec eax
jmp eax
int3
int3
int3
int3
int3
int3
xor eax, eax
cmp dword ptr [0000FC98h], eax
setne al
ret
int3
int3
int3
int3
mov dword ptr [00010B8Ah], 00000000h
ret
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [00002E22h]
test eax, eax
je 00007F06710B8426h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F06710B83EDh
xor edx, edx
dec eax
lea ecx, dword ptr [esp+000000F0h]
inc ecx
mov eax, 000004D0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29388	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x113f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2d000	0x1a1c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x2cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x234b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x23610	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23510	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x600	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cf48	0x1d000	2bb6014f49dd048ba2659ec6fa8408e9	False	0.4616615032327586	data	6.274460021502248	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0xc706	0xc800	18ecc7a2e5e307442685c841745b7954	False	0.34921875	OpenPGP Public Key	4.5347891656060115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x1740	0xc00	b0dcf4ba030cb5d2f42927ebe7055487	False	0.22330729166666666	data	3.947592449508497	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2d000	0x1a1c	0x1c00	c08072fef804c27fc3e537a6a8794a5a	False	0.4716796875	data	5.053135403745446	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2f000	0x113f8	0x11400	5b58a5b379d54d695d1d07df30e08922	False	0.23297384510869565	data	5.425036797515047	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x41000	0x2cc	0x400	fb1887e4a47a9e6cdfe77e3e02953396	False	0.5107421875	data	4.33913742192629	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CONFIG	0x2f568	0x33f	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.26594464500601683
STRING	0x3b4c8	0x547	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5144337527757217
STRING	0x3d4f0	0x520	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.40625
STRING	0x3e568	0x5dc	JSON data			0.4266666666666667
STRING	0x3c488	0x561	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.5134350036310821
STRING	0x3bac8	0x9bf	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4220440881763527
STRING	0x3dab8	0xaaf	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.34113345521023763
STRING	0x3ec00	0xcd8	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3524939172749392
STRING	0x3caa8	0xa45	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.4138455686572841
STRING	0x3ba10	0xb2	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.9382022471910112
STRING	0x3da10	0xa7	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.9041916167664671
STRING	0x3eb48	0xb1	ASCII text, with CRLF line terminators			0.864406779661017
STRING	0x3c9f0	0xb2	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	Taiwan	0.9325842696629213
RT_ICON	0x2fa28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.34308510638297873
RT_ICON	0x2fe90	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0			0.261046511627907
RT_ICON	0x30548	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.23934426229508196
RT_ICON	0x30ed0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.1550187617260788
RT_ICON	0x31f78	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0			0.13062130177514794
RT_ICON	0x339e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.12406639004149378
RT_ICON	0x35f88	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0			0.06654463863958432
RT_ICON	0x3a1b0	0x129b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9216880117572959
RT_DIALOG	0x2f4e0	0x84	data			0.7424242424242424
RT_DIALOG	0x2f8a8	0x180	data			0.5
RT_GROUP_ICON	0x3b450	0x76	data			0.7542372881355932
RT_VERSION	0x3f8d8	0x2e8	data			0.4905913978494624
RT_MANIFEST	0x3fbc0	0x835	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2041), with CRLF line terminators	English	United States	0.32032365540218943

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, WaitForSingleObjectEx, GetCurrentProcess, GetCurrentThreadId, ResumeThread, SetPriorityClass, OpenProcess, FreeLibrary, LoadLibraryW, MulDiv, CopyFileW, MoveFileExW, InitializeCriticalSectionEx, TerminateProcess, LoadLibraryExA, VirtualFree, VirtualAlloc, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, GetProcessHeap, HeapFree, HeapAlloc, OutputDebugStringW, InitializeSListHead, EnterCriticalSection, LeaveCriticalSection, DecodePointer, RaiseException, SetFileAttributesW, GetFileAttributesW, DeleteFileW, ExpandEnvironmentStringsW, GetCommandLineW, SizeofResource, LockResource, LoadResource, FindResourceExW, GetSystemWindowsDirectoryW, SleepEx, SetLastError, CloseHandle, VerifyVersionInfoW, GetModuleHandleW, VerSetConditionMask, MultiByteToWideChar, GetProcAddress, GetModuleFileNameW, GetTickCount64, QueryPerformanceCounter, GetLastError, GetSystemTimeAsFileTime, GetCurrentProcessId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, EncodePointer, InitOnceExecuteOnce
USER32.dll	EndPaint, GetWindowTextW, GetClientRect, BeginPaint, LoadImageW, MonitorFromWindow, ChangeWindowMessageFilter, GetDC, SetWindowLongPtrW, UnregisterClassW, DialogBoxParamW, SendMessageW, SetWindowTextW, DrawIconEx, EndDialog, GetDlgItem
GDI32.dll	GetDeviceCaps
COMDLG32.dll	GetOpenFileNameW
ADVAPI32.dll	RegDeleteTreeW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, SetTokenInformation, RevertToSelf, InitializeAcl, GetTokenInformation, GetLengthSid, GetAce, FreeSid, EqualSid, DuplicateTokenEx, CreateRestrictedToken, AllocateAndInitializeSid, AdjustTokenPrivileges, AddAce, AddAccessAllowedAce, OpenProcessToken, SetThreadToken, CreateProcessAsUserW, StartServiceW, QueryServiceStatusEx, OpenServiceW, OpenSCManagerW, CloseServiceHandle
SHELL32.dll	DragQueryFileW, DragFinish
ole32.dll	CoInitializeEx
WTSAPI32.dll	WTSQueryUserToken, WTSEnumerateProcessesW, WTSFreeMemory
USERENV.dll	DestroyEnvironmentBlock, CreateEnvironmentBlock
msvcrt.dll	abort, fseek, __C_specific_handler, _cexit, ??0exception@@QEAA@AEBQEBD@Z, __setusermatherr, _initterm, _initterm_e, exit, _exit, _c_exit, __wgetmainargs, atexit, _wcmdln, _lock, _unlock, _fseeki64, ?terminate@@YAXXZ, _strtoi64, _strtoui64, ??0exception@@QEAA@XZ, ??0exception@@QEAA@AEBV0@@Z, ??1exception@@UEAA@XZ, ?what@exception@@UEBAPEBDXZ, _XcptFilter, fsetpos, fwrite, memmove, memcpy, ??2@YAPEAX_K@Z, memset, setlocale, ??3@YAXPEAX@Z, memcmp, localeconv, ungetc, setvbuf, fread, fputc, fgetpos, fgetc, fflush, fclose, strtod, _set_fmode, malloc, free, _wcsicmp, wcsrchr, _errno, ??_V@YAXPEAX@Z, __CxxFrameHandler3, _CxxThrowException, _wcsnicmp, _iob, _vsnprintf, __set_app_type, _commode, wcslen, __dllonexit, wcsstr, _wfsopen
msvcp60.dll	_Toupper, _Tolower, _Getctype

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
English	United States

Network Behavior

⊘No network behavior found

Statistics

⊘No statistics

System Behavior

⊘No system behavior

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NSudo.exe

Overview

General Information

Detection

Signatures

Classification

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

System Behavior

Disassembly

Windows Analysis Report
NSudo.exe