Play interactive tour

Edit tour

Analysis Report BrowsingHistoryView.exe

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	126932
Start date:	28.04.2019
Start time:	18:53:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BrowsingHistoryView.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.spyw.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 94 Number of non-executed functions: 149
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	52	0 - 100		false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Process Injection1	Process Injection1	Credential Dumping	Process Discovery2	Application Deployment Software	Data from Local System1	Data Compressed	Standard Cryptographic Protocol1
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Obfuscated Files or Information2	Network Sniffing	System Information Discovery4	Remote Services	Clipboard Data1	Exfiltration Over Other Network Medium	Fallback Channels

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: BrowsingHistoryView.exe

virustotal: Detection: 12%

Perma Link

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_004098C4 FindFirstFileW,FindNextFileW,		0_2_004098C4
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_004098C4 FindFirstFileW,FindNextFileW,		0_1_004098C4

Networking:

Urls found in memory or binary data

Show sources

Source: BrowsingHistoryView.exe	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: BrowsingHistoryView.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: BrowsingHistoryView.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: BrowsingHistoryView.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: BrowsingHistoryView.exe	String found in binary or memory: http://www.nirsoft.net/
Source: BrowsingHistoryView.exe, 00000000.00000002.6158037759.0000000000197000.00000004.sdmp	String found in binary or memory: http://www.nirsoft.net46
Source: BrowsingHistoryView.exe, 00000000.00000002.6162528927.00000000025B7000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: BrowsingHistoryView.exe, 00000000.00000002.6162528927.00000000025B7000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/strun/Be9

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0040F0E8 OpenClipboard,

0_2_0040F0E8

System Summary:

Contains functionality to call native functions

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00409ED0 NtQuerySystemInformation,NtQuerySystemInformation,	0_2_00409ED0
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00409F44 memset,CreateFileW,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,CloseHandle,	0_2_00409F44
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00409ED0 NtQuerySystemInformation,	0_1_00409ED0

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00432671	0_2_00432671
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00415063	0_2_00415063
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_0043F014	0_2_0043F014
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_0043A3EF	0_2_0043A3EF
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_0043D76D	0_2_0043D76D
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_004217C9	0_2_004217C9
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_004079B6	0_2_004079B6
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00413ACB	0_2_00413ACB
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_0043BC0D	0_2_0043BC0D
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_0043AF50	0_2_0043AF50
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00432671	0_1_00432671
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00415063	0_1_00415063
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_0043F014	0_1_0043F014
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_0043A3EF	0_1_0043A3EF
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_0043D76D	0_1_0043D76D
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_004217C9	0_1_004217C9
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_004079B6	0_1_004079B6
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00413ACB	0_1_00413ACB
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_0043BC0D	0_1_0043BC0D
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_0043AF50	0_1_0043AF50

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 004087A3 appears 48 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 004145EC appears 36 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00445240 appears 50 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00423B2E appears 86 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00444B8A appears 34 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00414A64 appears 156 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00414723 appears 56 times
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: String function: 00415D16 appears 40 times

PE file contains strange resources

Show sources

Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BrowsingHistoryView.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Show sources

Source: BrowsingHistoryView.exe	Binary or memory string: OriginalFileName vs BrowsingHistoryView.exe
Source: BrowsingHistoryView.exe, 00000000.00000000.4919506235.0000000000446000.00000002.sdmp	Binary or memory string: )CREATE TABLE BINARYAUTOINCREMENT not allowed on WITHOUT ROWID tablesPRIMARY KEY missing on table %stableTABLECREATE %s %.sUPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%dtbl_name='%q' AND type!='trigger'sqlite_stat%dDELETE FROM %Q.%s WHERE %s=%QDELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'sqlite_stattable %s may not be droppedtblforeign key on %s should reference only one column of table %Tnumber of columns in foreign key does not match the number of columns in the referenced tableunknown column "%s" in foreign key definitionindexcannot create a TEMP index on non-TEMP table "%s"altertab_table %s may not be indexedthere is already a table named %sindex %s already existssqlite_autoindex_%s_%dtable %s has no column named %sconflicting ON CONFLICT clauses specified UNIQUECREATE%s INDEX %.sINSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'no such index: %Sindex associated with UNIQUE or PRIMARY KEY constraint cannot be droppedDELETE FROM %Q.%
Source: BrowsingHistoryView.exe, 00000000.00000002.6186558926.0000000004720000.00000002.sdmp	Binary or memory string: OriginalFilenameuser32j% vs BrowsingHistoryView.exe
Source: BrowsingHistoryView.exe, 00000000.00000002.6186604645.0000000004730000.00000002.sdmp	Binary or memory string: OriginalFilenamecomctl32.DLL.MUIj% vs BrowsingHistoryView.exe
Source: BrowsingHistoryView.exe	Binary or memory string: )CREATE TABLE BINARYAUTOINCREMENT not allowed on WITHOUT ROWID tablesPRIMARY KEY missing on table %stableTABLECREATE %s %.sUPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%dtbl_name='%q' AND type!='trigger'sqlite_stat%dDELETE FROM %Q.%s WHERE %s=%QDELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'sqlite_stattable %s may not be droppedtblforeign key on %s should reference only one column of table %Tnumber of columns in foreign key does not match the number of columns in the referenced tableunknown column "%s" in foreign key definitionindexcannot create a TEMP index on non-TEMP table "%s"altertab_table %s may not be indexedthere is already a table named %sindex %s already existssqlite_autoindex_%s_%dtable %s has no column named %sconflicting ON CONFLICT clauses specified UNIQUECREATE%s INDEX %.sINSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'no such index: %Sindex associated with UNIQUE or PRIMARY KEY constraint cannot be droppedDELETE FROM %Q.%

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Section loaded: wow64log.dll

Jump to behavior

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Show sources

Source: BrowsingHistoryView.exe

Binary string: i@1j@dk@c1Anetmsg.dllUnknown Error\Error %d: %seditkernel32.dll...open %2.2X %s (%s)%2.2d-%2.2d-%4.4d %2.2d:%2.2d:%2.2dSystemTimeToTzSpecificLocalTimeTzSpecificLocalTimeToSystemTime\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy%d*URL index.datdllhost.exetaskhost.exetaskhostex.exetaskhostw.exeC:\bhvContainersContainerIdNameContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:captionmenu_%ddialog_%dstringsgeneralsysdatetimepick32rtlcharsetTranslatorNameTranslatorURLVersion0RTL_lng.ini""

Classification label

Show sources

Source: classification engine

Classification label: mal52.spyw.winEXE@1/0@0/0

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0041133B CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,CloseHandle,free,Process32NextW,CloseHandle,

0_2_0041133B

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_004443FF CoCreateInstance,

0_2_004443FF

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_004127EE FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_004127EE

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\6c4zjj0s.default\places.sqlite-wal

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: BrowsingHistoryView.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries a list of all open handles

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

System information queried: HandleInformation

Jump to behavior

Reads ini files

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

SQL strings found in memory and binary data

Show sources

Source: BrowsingHistoryView.exe

Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

Sample is known by Antivirus

Show sources

Source: BrowsingHistoryView.exe

virustotal: Detection: 12%

Sample might require command line arguments (.Net)

Show sources

Source: BrowsingHistoryView.exe

String found in binary or memory: 3http://crl.usertrust.com/AddTrustExternalCARoot.crl05

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Tries to open an application configuration file (.cfg)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

File opened: C:\Users\user\Desktop\BrowsingHistoryView.cfg

Jump to behavior

Executable creates window controls seldom found in malware

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Window found: window name: msctls_updown32

Jump to behavior

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Window detected: Number of UI elements: 34

PE file contains a mix of resources often seen in goodware

Show sources

Source: BrowsingHistoryView.exe	Static PE information: section name: RT_CURSOR
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_BITMAP
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_ICON
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_MENU
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_DIALOG
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_STRING
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_ACCELERATOR
Source: BrowsingHistoryView.exe	Static PE information: section name: RT_GROUP_ICON

PE file contains a debug data directory

Show sources

Source: BrowsingHistoryView.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:

Binary string: c:\Projects\VS2005\BrowsingHistoryView\Release\BrowsingHistoryView.pdb source: BrowsingHistoryView.exe

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0041153E LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041153E

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00445240 push eax; ret	0_2_00445254
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00445240 push eax; ret	0_2_0044527C
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00444EA1 push ecx; ret	0_2_00444EB1
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00445240 push eax; ret	0_1_00445254
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00445240 push eax; ret	0_1_0044527C
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00444EA1 push ecx; ret	0_1_00444EB1

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (date check)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-35776

Uses the system / local time for branch decision (may execute only at specific dates)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 03h and CTI: jne 00403A46h	0_2_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 02h and CTI: jne 00403A59h	0_2_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 04h and CTI: jne 00403A82h	0_2_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 05h and CTI: jne 00403A97h	0_2_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 03h and CTI: jne 00403A46h	0_1_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 02h and CTI: jne 00403A59h	0_1_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 04h and CTI: jne 00403A82h	0_1_00403A04
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_00403A04 GetSystemTimeAsFileTime followed by cmp: cmp eax, 05h and CTI: jne 00403A97h	0_1_00403A04

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_2_004098C4 FindFirstFileW,FindNextFileW,		0_2_004098C4
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	Code function: 0_1_004098C4 FindFirstFileW,FindNextFileW,		0_1_004098C4

Contains functionality to query system information

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_00417D72 memset,GetSystemInfo,

0_2_00417D72

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0041153E LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041153E

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: BrowsingHistoryView.exe, 00000000.00000002.6160611077.0000000000C90000.00000002.sdmp	Binary or memory string: Shell_TrayWnd
Source: BrowsingHistoryView.exe, 00000000.00000002.6160611077.0000000000C90000.00000002.sdmp	Binary or memory string: Progman
Source: BrowsingHistoryView.exe, 00000000.00000002.6160611077.0000000000C90000.00000002.sdmp	Binary or memory string: Program ManagerUR

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0040264F GetSystemTimeAsFileTime,

0_2_0040264F

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe

Code function: 0_2_0040876E GetVersionExW,

0_2_0040876E

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\6c4zjj0s.default\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\6c4zjj0s.default\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\6c4zjj0s.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\BrowsingHistoryView.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
18:54:48	API Interceptor	3x Sleep call for process: BrowsingHistoryView.exe modified

Antivirus and Machine Learning Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BrowsingHistoryView.exe	12%	virustotal		Browse
BrowsingHistoryView.exe	8%	metadefender		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.nirsoft.net46	0%	Avira URL Cloud	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report BrowsingHistoryView.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Behavior Graph

Simulations

Behavior and APIs

Antivirus and Machine Learning Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails