Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.124914767515535
Filename:	CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe
Filesize:	1191936
MD5:	1ca01a88b80112024883e55a27b1345a
SHA1:	3fdcd8cd1ff882b9c76dd93f680bb7f60fc97c7d
SHA256:	a848e5d8d3a080b81556f4f7ec1fe1103610bf7bbb023065bf2e6696abaf6769
SHA512:	9f978fe421c5217bccf787df0a105f584cd945be1f43e77f1971d688becaa9682a01acf7585b6bcaf4111103835dbcaa2caef59ccd393a16360cedebfb891125
SSDEEP:	24576:Xtb20pkaCqT5TBWgNQ7aaGNhHYefDINn9Zr3qH6A:UVg5tQ7aaaHYaEN9K5
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Access Token Manipulation
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection Disable or Modify Tools
Detected potential crypto function	System Summary	Process Discovery
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evaded block containing many API calls	Malware Analysis System Evasion	Native API Disable or Modify Tools Process Discovery
Found evasive API chain (date check)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Disable or Modify Tools System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality for error logging	System Summary	Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Disable or Modify Tools
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion	Disable or Modify Tools
Reads software policies	System Summary
Sample is known by Antivirus	System Summary	Disable or Modify Tools
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\aut42B5.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut42B5.tmp
Category:	dropped
Dump:	aut42B5.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe
Type:	data
Entropy:	7.916564732301857
Encrypted:	false
Ssdeep:	6144:WRPEVS45BFPse+U467E8n5YAV4QB0Qk7b+yg:WRcVF597NVF0Qk7Dg
Size:	267776
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\lecheries

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\lecheries
Category:	dropped
Dump:	lecheries.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe
Type:	data
Entropy:	7.916564732301857
Encrypted:	false
Ssdeep:	6144:WRPEVS45BFPse+U467E8n5YAV4QB0Qk7b+yg:WRcVF597NVF0Qk7Dg
Size:	267776
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe

"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7420
Target ID:	0
Parent PID:	3968
Name:	CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe
Path:	C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe
Commandline:	"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe"
Size:	1191936
MD5:	1CA01A88B80112024883E55A27B1345A
Time:	07:56:18
Date:	25/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x570000
Modulesize:	1216512
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension File Execution	System Summary
Binary is likely a compiled AutoIt script file	System Summary
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7820
Target ID:	7
Parent PID:	7420
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	07:56:19
Date:	25/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x710000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

https://api.ipify.org/

104.26.12.205

Details

Name:	https://api.ipify.org/
IP:	104.26.12.205
TargetID:	7
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000007.00000002.3732059768.0000000005340000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3729783954.0000000002AB0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3730171766.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3729695166.000000000297E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3731382382.0000000003CB1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000007.00000002.3732059768.0000000005340000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3729783954.0000000002AB0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3729695166.000000000297E000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.3731382382.0000000003CB1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org/t

unknown

Details

Name:	https://api.ipify.org/t
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000007.00000002.3730171766.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000007.00000002.3730171766.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://beirutrest.com

unknown

Details

Name:	http://beirutrest.com
TargetID:	7
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000007.00000002.3730171766.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

beirutrest.com

50.87.144.157

Details

Name:	beirutrest.com
IP:	50.87.144.157
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

104.26.12.205

Details

Name:	api.ipify.org
IP:	104.26.12.205
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

104.26.12.205

api.ipify.org

United States

Details

IP:	104.26.12.205
TargetID:	7
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

50.87.144.157

beirutrest.com

United States

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

5340000

trusted library section

page read and write

2AB0000

trusted library section

page read and write

297E000

heap

page read and write

2D04000

trusted library allocation

page read and write

2D2F000

trusted library allocation

page read and write

3CB1000

trusted library allocation

page read and write

CF4000

trusted library allocation

page read and write

1480000

heap

page read and write

62A000

unkown

page read and write

2C7A000

trusted library allocation

page read and write

2B40000

heap

page execute and read and write

4230000

direct allocation

page read and write

54CC000

stack

page read and write

E13000

heap

page read and write

D50000

heap

page read and write

52D3000

heap

page read and write

2C6E000

trusted library allocation

page read and write

D03000

trusted library allocation

page read and write

1490000

heap

page read and write

571000

unkown

page execute read

6600000

trusted library allocation

page read and write

D28000

heap

page read and write

571000

unkown

page execute read

4230000

direct allocation

page read and write

4090000

direct allocation

page read and write

4230000

direct allocation

page read and write

227E000

stack

page read and write

693E000

stack

page read and write

16BE000

heap

page read and write

DCC000

heap

page read and write

26CB000

trusted library allocation

page execute and read and write

41B3000

direct allocation

page read and write

23C0000

heap

page read and write

141D000

stack

page read and write

F1E000

stack

page read and write

68FE000

stack

page read and write

4359000

direct allocation

page read and write

435D000

direct allocation

page read and write

65F0000

trusted library allocation

page read and write

CF3000

trusted library allocation

page execute and read and write

51EE000

stack

page read and write

41B3000

direct allocation

page read and write

D0D000

trusted library allocation

page execute and read and write

62F000

unkown

page write copy

D10000

trusted library allocation

page read and write

16A3000

heap

page read and write

6608000

trusted library allocation

page read and write

2C5E000

stack

page read and write

26C7000

trusted library allocation

page execute and read and write

2B50000

heap

page read and write

5335000

heap

page read and write

2CB1000

trusted library allocation

page read and write

66FE000

stack

page read and write

BD5000

heap

page read and write

4230000

direct allocation

page read and write

426000

system

page execute and read and write

140F000

stack

page read and write

435D000

direct allocation

page read and write

55CC000

stack

page read and write

5230000

heap

page execute and read and write

3D53000

trusted library allocation

page read and write

B10000

heap

page read and write

2C86000

trusted library allocation

page read and write

D20000

heap

page read and write

435D000

direct allocation

page read and write

2C6B000

trusted library allocation

page read and write

41B3000

direct allocation

page read and write

D8B000

heap

page read and write

AF8000

stack

page read and write

69D0000

heap

page read and write

5200000

trusted library allocation

page read and write

58E0000

trusted library allocation

page read and write

103A000

stack

page read and write

2B10000

trusted library allocation

page read and write

6750000

trusted library allocation

page read and write

4090000

direct allocation

page read and write

41B3000

direct allocation

page read and write

5FD000

unkown

page readonly

43CE000

direct allocation

page read and write

69C0000

heap

page read and write

BBE000

stack

page read and write

2950000

heap

page read and write

16AE000

heap

page read and write

43CE000

direct allocation

page read and write

7A9000

stack

page read and write

177C000

heap

page read and write

2D41000

trusted library allocation

page read and write

43CE000

direct allocation

page read and write

2C66000

trusted library allocation

page read and write

CD0000

trusted library section

page read and write

445000

system

page execute and read and write

1865000

heap

page read and write

4230000

direct allocation

page read and write

4359000

direct allocation

page read and write

4359000

direct allocation

page read and write

61E0000

heap

page read and write

64BE000

stack

page read and write

43CE000

direct allocation

page read and write

4090000

direct allocation

page read and write

2C60000

trusted library allocation

page read and write

18D8000

heap

page read and write

3D73000

trusted library allocation

page read and write

CE0000

trusted library allocation

page read and write

4DAE000

stack

page read and write

15BD000

stack

page read and write

5260000

heap

page read and write

2C7E000

trusted library allocation

page read and write

6CEE000

stack

page read and write

B5E000

stack

page read and write

5390000

heap

page read and write

BC0000

trusted library section

page read and write

4230000

direct allocation

page read and write

1680000

heap

page read and write

637D000

stack

page read and write

2D35000

trusted library allocation

page read and write

2D2D000

trusted library allocation

page read and write

61E000

unkown

page readonly

143C000

stack

page read and write

2957000

heap

page read and write

168A000

heap

page read and write

6740000

trusted library allocation

page read and write

65BE000

stack

page read and write

1839000

heap

page read and write

2C8D000

trusted library allocation

page read and write

26C5000

trusted library allocation

page execute and read and write

2C81000

trusted library allocation

page read and write

647F000

stack

page read and write

2770000

heap

page read and write

D1A000

trusted library allocation

page execute and read and write

2888000

trusted library allocation

page read and write

D00000

trusted library allocation

page read and write

2930000

trusted library allocation

page execute and read and write

5240000

heap

page read and write

666D000

stack

page read and write

177B000

heap

page read and write

1E7E000

stack

page read and write

526A000

heap

page read and write

D12000

trusted library allocation

page read and write

CB0000

heap

page read and write

6620000

trusted library allocation

page read and write

26E0000

trusted library allocation

page read and write

D5A000

heap

page read and write

400000

system

page execute and read and write

570000

unkown

page readonly

4090000

direct allocation

page read and write

3D44000

heap

page read and write

287E000

stack

page read and write

65F4000

trusted library allocation

page read and write

3D40000

heap

page read and write

2920000

heap

page read and write

13FB000

stack

page read and write

2CEA000

trusted library allocation

page read and write

2AAE000

stack

page read and write

697F000

stack

page read and write

CF0000

trusted library allocation

page read and write

2D2B000

trusted library allocation

page read and write

1570000

heap

page read and write

2300000

direct allocation

page read and write

43CE000

direct allocation

page read and write

16CA000

heap

page execute and read and write

26C0000

trusted library allocation

page read and write

1660000

heap

page read and write

62A000

unkown

page write copy

16CA000

heap

page read and write

58ED000

trusted library allocation

page read and write

CFD000

trusted library allocation

page execute and read and write

61E000

unkown

page readonly

2CA0000

heap

page read and write

7F530000

trusted library allocation

page execute and read and write

16CE000

heap

page read and write

3DB4000

trusted library allocation

page read and write

D5D000

heap

page read and write

16CE000

heap

page read and write

4090000

direct allocation

page read and write

4090000

direct allocation

page read and write

52BD000

heap

page read and write

2923000

heap

page read and write

634000

unkown

page readonly

41B3000

direct allocation

page read and write

177B000

heap

page read and write

634000

unkown

page readonly

2C92000

trusted library allocation

page read and write

15FD000

stack

page read and write

2B00000

trusted library allocation

page read and write

43CE000

direct allocation

page read and write

2D00000

trusted library allocation

page read and write

41B3000

direct allocation

page read and write

168E000

heap

page read and write

2C72000

trusted library allocation

page read and write

5244000

heap

page read and write

2B20000

trusted library allocation

page read and write

2CF3000

trusted library allocation

page read and write

D16000

trusted library allocation

page execute and read and write

6990000

trusted library allocation

page execute and read and write

D7D000

heap

page read and write

1710000

heap

page read and write

B60000

heap

page read and write

5FD000

unkown

page readonly

16CA000

heap

page read and write

435D000

direct allocation

page read and write

276C000

stack

page read and write

6980000

trusted library allocation

page read and write

6BEE000

stack

page read and write

435D000

direct allocation

page read and write

4359000

direct allocation

page read and write

BD0000

heap

page read and write

52A3000

heap

page read and write

61F0000

trusted library allocation

page execute and read and write

2940000

trusted library allocation

page read and write

6610000

trusted library allocation

page execute and read and write

673E000

stack

page read and write

4359000

direct allocation

page read and write

272E000

stack

page read and write

4359000

direct allocation

page read and write

26C2000

trusted library allocation

page read and write

435D000

direct allocation

page read and write

6747000

trusted library allocation

page read and write

5248000

heap

page read and write

570000

unkown

page readonly

There are 209 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportCHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
CHARIKLIA JUNIOR DETAILS (1) (1).pdf.exe