Edit tour

Windows Analysis Report
Quotation - HDPE Fittings.exe

Overview

General Information

Sample name:	Quotation - HDPE Fittings.exe
Analysis ID:	1417527
MD5:	10f4c53cf6490bcf1f1cf0f3a88250de
SHA1:	4e9d7fd3c9651c205f72a6c696c656e7ae84a9d8
SHA256:	af83c0d8ccb38c430dce3b0c4a18eeda3c91832ae8bb432a9614619fd5727e7b
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Quotation - HDPE Fittings.exe (PID: 4080 cmdline: "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe" MD5: 10F4C53CF6490BCF1F1CF0F3A88250DE)

Quotation - HDPE Fittings.exe (PID: 5440 cmdline: "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe" MD5: 10F4C53CF6490BCF1F1CF0F3A88250DE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3229813317.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3229813317.0000000002D39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1998316965.0000000007450000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1992626012.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quotation - HDPE Fittings.exe PID: 5440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation - HDPE Fittings.exe PID: 5440	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Quotation - HDPE Fittings.exe.32c620c.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.7450000.11.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3182d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3189f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.Quotation - HDPE Fittings.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.Quotation - HDPE Fittings.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.Quotation - HDPE Fittings.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3362d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3369f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x316a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x317c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3182d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3189f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x319c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dc55:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dcc7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dd51:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dde3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3362d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6de4d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3369f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6debf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6df55:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x337c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6dfe5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33435:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6de55:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8675:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x334a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dec7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa86e7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33531:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6df51:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8771:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x335c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6dfe3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8803:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3362d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e04d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa886d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3369f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e0bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa88df:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33735:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e155:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8975:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.225, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe, Initiated: true, ProcessId: 5440, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Quotation - HDPE Fittings.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Quotation - HDPE Fittings.exe	ReversingLabs: Detection: 28%
Source: Quotation - HDPE Fittings.exe	Virustotal: Detection: 38%			Perma Link

Machine Learning detection for sample

Source: Quotation - HDPE Fittings.exe

Joe Sandbox ML: detected

Source: Quotation - HDPE Fittings.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Quotation - HDPE Fittings.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: CZUl.pdbSHA256 source: Quotation - HDPE Fittings.exe
Source:	Binary string: CZUl.pdb source: Quotation - HDPE Fittings.exe

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 208.91.199.225:587

Source: Joe Sandbox View

IP Address: 208.91.199.225 208.91.199.225

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 208.91.199.225:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.0000000001110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0A
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, oAKy.cs	.Net Code: KUbbKSnz
Source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, oAKy.cs	.Net Code: KUbbKSnz

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.Quotation - HDPE Fittings.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Quotation - HDPE Fittings.exe

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_0308E16C	0_2_0308E16C
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_03084B00	0_2_03084B00
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E35790	0_2_07E35790
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E335E0	0_2_07E335E0
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E331A8	0_2_07E331A8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E39E10	0_2_07E39E10
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E32D70	0_2_07E32D70
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 0_2_07E33A18	0_2_07E33A18
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_05203E80	3_2_05203E80
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_05209B28	3_2_05209B28
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_05204A98	3_2_05204A98
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_052041C8	3_2_052041C8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_0520D270	3_2_0520D270
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C2EE8	3_2_062C2EE8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C56C8	3_2_062C56C8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C3F40	3_2_062C3F40
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062CBCF8	3_2_062CBCF8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062CDCF8	3_2_062CDCF8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C9AD8	3_2_062C9AD8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C8B80	3_2_062C8B80
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C0040	3_2_062C0040
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C3637	3_2_062C3637
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_062C4FE8	3_2_062C4FE8
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Code function: 3_2_0520D263	3_2_0520D263

Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1990996811.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1998832361.00000000078B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename63f2af02-233f-4c92-980c-0e5565db4b11.exe4 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000000.00000000.1982055927.0000000000F4A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCZUl.exe2 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000000.00000002.1992626012.0000000003307000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename63f2af02-233f-4c92-980c-0e5565db4b11.exe4 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3228790881.0000000000EF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename63f2af02-233f-4c92-980c-0e5565db4b11.exe4 vs Quotation - HDPE Fittings.exe
Source: Quotation - HDPE Fittings.exe	Binary or memory string: OriginalFilenameCZUl.exe2 vs Quotation - HDPE Fittings.exe

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Section loaded: msasn1.dll	Jump to behavior

Source: Quotation - HDPE Fittings.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.Quotation - HDPE Fittings.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Quotation - HDPE Fittings.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, EqxeUBhVqo82x8DKXi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, ALeZd5HJXthoYYUxWS.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, EqxeUBhVqo82x8DKXi.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.Quotation - HDPE Fittings.exe.332d128.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Quotation - HDPE Fittings.exe.32e07b0.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Quotation - HDPE Fittings.exe.32e87c8.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Quotation - HDPE Fittings.exe.5d90000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation - HDPE Fittings.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Mutant created: NULL

Source: Quotation - HDPE Fittings.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Quotation - HDPE Fittings.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Quotation - HDPE Fittings.exe	ReversingLabs: Detection: 28%
Source: Quotation - HDPE Fittings.exe	Virustotal: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process created: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process created: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Quotation - HDPE Fittings.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Quotation - HDPE Fittings.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Quotation - HDPE Fittings.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: CZUl.pdbSHA256 source: Quotation - HDPE Fittings.exe
Source:	Binary string: CZUl.pdb source: Quotation - HDPE Fittings.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Quotation - HDPE Fittings.exe, Form1.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, I1Ds3abkUA5mh3kywv.cs	.Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, I1Ds3abkUA5mh3kywv.cs	.Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, ALeZd5HJXthoYYUxWS.cs	.Net Code: G6oFW7U3bH System.Reflection.Assembly.Load(byte[])
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, ALeZd5HJXthoYYUxWS.cs	.Net Code: G6oFW7U3bH System.Reflection.Assembly.Load(byte[])

Source: Quotation - HDPE Fittings.exe

Static PE information: section name: .text entropy: 7.964661054278462

Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, R87QTajabri3WprdxA.cs	High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, I1Ds3abkUA5mh3kywv.cs	High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, QEHxtuXFnnkJABhbAo.cs	High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, R87QTajabri3WprdxA.cs	High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, I1Ds3abkUA5mh3kywv.cs	High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs	High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, QEHxtuXFnnkJABhbAo.cs	High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, a46dcsYb1GN3dxPSDA.cs	High entropy of concatenated method names: 'HvleVTx6N9', 'mbCe9V2PGe', 'zameFKHJPQ', 'p7Hecd0Yab', 'IkReTice7q', 'QEme3x01fS', 'GYUe8CRS7K', 'aBruO5xQXO', 'uoBuqOrG3D', 'c2GulKkcQe'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, djKh8xEt83OqpKAHwP.cs	High entropy of concatenated method names: 'Dispose', 'sN1Vlfbydm', 'uRJBMW7V5q', 'N9CPP1GntJ', 'K4pVdtftQV', 'VfjVz3JYgZ', 'ProcessDialogKey', 'vKrBRsGKFM', 'rLJBVHkjfC', 'hQ3BBuQeIq'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, EqxeUBhVqo82x8DKXi.cs	High entropy of concatenated method names: 'TZeTmSLVxt', 'AmATZImUOP', 'fX9TDHXuZq', 'LvyTxy4wFL', 'zbvTNro3Kh', 'HFtToIXIel', 'oVvTOnCS99', 'lg5TqPkUYB', 'nFITlndOry', 'SKBTdVX2Q4'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, hfwFV3FmMvVZ0YY3k3r.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'P5oHmSThlo', 'JvRHZ6RS5T', 'fpAHDT7toV', 'oMBHxJAW1Y', 'axLHN8lFfm', 'gwoHoEs32P', 'h3OHOnS8uL'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, n8FAScXDo3hTORQODp.cs	High entropy of concatenated method names: 'ihMuaYLxng', 'tbyuMPp6L4', 'IihunX4V8n', 'KUTurIerW2', 'oWrumtodGH', 'f6nuwXAxoD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, VhwjYgQqmToFMGt556.cs	High entropy of concatenated method names: 'ka8WGTCIo', 'cjmbGrjfp', 'keXIEbGQq', 'Kr8kiwUcb', 'pJIgyaibq', 'lamyoccV3', 'PkaknYLSyNuZ1CCSQ8', 'GXebrBTcCASvU0Na9Y', 'FnhuJIdu1', 'JHpHr6vhv'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, tawH8fv8SB1ReFJSW9.cs	High entropy of concatenated method names: 'JgwucvlQq5', 'eekuT87i37', 'hNkupCBijo', 'cUnu3QPDbn', 'BZ7u80Ocsi', 'cfMuhHR5pr', 'koluK9rYbK', 'eP4u0gP9Tt', 'vY9uLIUwcE', 'QVYuCtNv1V'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, a18ITTFDe4mAm2pjlkU.cs	High entropy of concatenated method names: 'nFjeXwdL0A', 'SxVeSJ0vab', 'b7EeWFGmGB', 'A8debvYTXj', 'SFheExrCvN', 'GQSeIZyHd3', 'XDdekgrsUB', 'HXhe7g522T', 'zxyegO6oyG', 'srKeyDhG7I'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, q6AE4JCLvVtUywONIH.cs	High entropy of concatenated method names: 'IbMhX6U6e3', 'uxRhSieuaU', 'P8bhWfhvm0', 'MAmhbcZhZ7', 'GYvhEtQWvI', 'WSNhIsngqi', 'OovhkfnUYr', 'Df8h7QqCU5', 'C4xhggUm0O', 'uXohy80YQk'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, hwZhGlsPbIM6or59Pl.cs	High entropy of concatenated method names: 'vWei7jZrRd', 'IMmigykMJw', 'B9lia8Bd3L', 'HZriM7VJ5M', 'QcSiro7WNN', 'KeoiwHnvUO', 'iJCisStF1M', 'enhi6QRD3d', 'Tc3iA5KDq2', 'UwEijBEW1u'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, VfbPmZZaOY1UguhsMy.cs	High entropy of concatenated method names: 'mmV5qrWvFR', 'mvV5dvpFah', 'XocuR3EKrM', 'sIkuVIVvHV', 'Qxr5jUuomn', 'bBS5flUTu2', 'j8t5QUFTys', 'W085m6Pu7C', 'OH95Z6mwHX', 'xG45DOQfPt'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, lIkIQEzIf2H0Hk8Glb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'He6eiRShpW', 'mLeeJRAqhD', 'HGUe49odxI', 'rTse5tCLN0', 'ShYeuoDiXT', 'OXNee8AfmH', 'LlbeHM4R2c'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, fAWMe6Kf8MjVUNnRA8.cs	High entropy of concatenated method names: 'i5X3EjNgle', 'OrM3kDbuX5', 'DdSpnZBrsx', 'UxFprOjrXB', 'cLMpwQ4O0X', 'KNppGWitbF', 'TxvpsGe42s', 'xanp67LyAr', 'P5tpYAZfap', 'bOMpAevt0p'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, HC51PMMstdLFKtk3dK.cs	High entropy of concatenated method names: 'MI8JAqnH7N', 'iV8Jf0Mhu9', 'JrGJme9EhC', 'YgSJZOTLuh', 'QmBJM4kZ8P', 'ticJn9I8xa', 'kVGJrpyEw6', 'kyTJwtcPSW', 'DxIJG4yk4y', 'jyVJsdOLZx'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, R1nIVrArAGh1fWubMB.cs	High entropy of concatenated method names: 'oyYVh4VUrF', 'q2GVKQ44Y1', 'sAeVLynrA5', 'UFtVCrmsIU', 'KsbVJvlWft', 'Dv3V4BLMKy', 'l2aoOTlZa1KkWsyaHA', 'SWy20hOsF3uyCjL4DV', 'ceKVVNjvFP', 'sONV9YD8cE'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, MveMJY969xsZHNoDdw.cs	High entropy of concatenated method names: 'i7T8vP07ui', 'vJN8Tm61u7', 'vvM83MwFLE', 'c1J8hBPDTp', 'Y7i8KKUfOj', 'FZ83NfGoo3', 'ynR3o91imQ', 'm7F3OHYmUn', 'lEc3qTmZhB', 'OFd3lIlV4W'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, ALeZd5HJXthoYYUxWS.cs	High entropy of concatenated method names: 'WKK9vZ1Stu', 'OyW9ckYQ2v', 'fuV9T9rHcQ', 'WOv9pEEmvw', 'Jg993Xrc6R', 'Wbv98QlPFg', 'BpV9hfI1h9', 'doI9Ko8gWF', 'TgE904GxEc', 'IiT9LA5FgA'
Source: 0.2.Quotation - HDPE Fittings.exe.78b0000.12.raw.unpack, AT2Tlt6QMO42fi70Pf.cs	High entropy of concatenated method names: 'yohpbXkV4y', 'r3SpI58ORA', 'bKQp7mNrCL', 'eovpg8OyAT', 'j3NpJaVsju', 'RBkp4qBlLc', 'BbJp50rlCw', 'rTupuaWUY8', 'G5hpeDEqUY', 'UCqpHRwKcK'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, a46dcsYb1GN3dxPSDA.cs	High entropy of concatenated method names: 'HvleVTx6N9', 'mbCe9V2PGe', 'zameFKHJPQ', 'p7Hecd0Yab', 'IkReTice7q', 'QEme3x01fS', 'GYUe8CRS7K', 'aBruO5xQXO', 'uoBuqOrG3D', 'c2GulKkcQe'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, djKh8xEt83OqpKAHwP.cs	High entropy of concatenated method names: 'Dispose', 'sN1Vlfbydm', 'uRJBMW7V5q', 'N9CPP1GntJ', 'K4pVdtftQV', 'VfjVz3JYgZ', 'ProcessDialogKey', 'vKrBRsGKFM', 'rLJBVHkjfC', 'hQ3BBuQeIq'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, EqxeUBhVqo82x8DKXi.cs	High entropy of concatenated method names: 'TZeTmSLVxt', 'AmATZImUOP', 'fX9TDHXuZq', 'LvyTxy4wFL', 'zbvTNro3Kh', 'HFtToIXIel', 'oVvTOnCS99', 'lg5TqPkUYB', 'nFITlndOry', 'SKBTdVX2Q4'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, hfwFV3FmMvVZ0YY3k3r.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'P5oHmSThlo', 'JvRHZ6RS5T', 'fpAHDT7toV', 'oMBHxJAW1Y', 'axLHN8lFfm', 'gwoHoEs32P', 'h3OHOnS8uL'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, n8FAScXDo3hTORQODp.cs	High entropy of concatenated method names: 'ihMuaYLxng', 'tbyuMPp6L4', 'IihunX4V8n', 'KUTurIerW2', 'oWrumtodGH', 'f6nuwXAxoD', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, VhwjYgQqmToFMGt556.cs	High entropy of concatenated method names: 'ka8WGTCIo', 'cjmbGrjfp', 'keXIEbGQq', 'Kr8kiwUcb', 'pJIgyaibq', 'lamyoccV3', 'PkaknYLSyNuZ1CCSQ8', 'GXebrBTcCASvU0Na9Y', 'FnhuJIdu1', 'JHpHr6vhv'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, tawH8fv8SB1ReFJSW9.cs	High entropy of concatenated method names: 'JgwucvlQq5', 'eekuT87i37', 'hNkupCBijo', 'cUnu3QPDbn', 'BZ7u80Ocsi', 'cfMuhHR5pr', 'koluK9rYbK', 'eP4u0gP9Tt', 'vY9uLIUwcE', 'QVYuCtNv1V'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, a18ITTFDe4mAm2pjlkU.cs	High entropy of concatenated method names: 'nFjeXwdL0A', 'SxVeSJ0vab', 'b7EeWFGmGB', 'A8debvYTXj', 'SFheExrCvN', 'GQSeIZyHd3', 'XDdekgrsUB', 'HXhe7g522T', 'zxyegO6oyG', 'srKeyDhG7I'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, q6AE4JCLvVtUywONIH.cs	High entropy of concatenated method names: 'IbMhX6U6e3', 'uxRhSieuaU', 'P8bhWfhvm0', 'MAmhbcZhZ7', 'GYvhEtQWvI', 'WSNhIsngqi', 'OovhkfnUYr', 'Df8h7QqCU5', 'C4xhggUm0O', 'uXohy80YQk'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, hwZhGlsPbIM6or59Pl.cs	High entropy of concatenated method names: 'vWei7jZrRd', 'IMmigykMJw', 'B9lia8Bd3L', 'HZriM7VJ5M', 'QcSiro7WNN', 'KeoiwHnvUO', 'iJCisStF1M', 'enhi6QRD3d', 'Tc3iA5KDq2', 'UwEijBEW1u'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, VfbPmZZaOY1UguhsMy.cs	High entropy of concatenated method names: 'mmV5qrWvFR', 'mvV5dvpFah', 'XocuR3EKrM', 'sIkuVIVvHV', 'Qxr5jUuomn', 'bBS5flUTu2', 'j8t5QUFTys', 'W085m6Pu7C', 'OH95Z6mwHX', 'xG45DOQfPt'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, lIkIQEzIf2H0Hk8Glb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'He6eiRShpW', 'mLeeJRAqhD', 'HGUe49odxI', 'rTse5tCLN0', 'ShYeuoDiXT', 'OXNee8AfmH', 'LlbeHM4R2c'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, fAWMe6Kf8MjVUNnRA8.cs	High entropy of concatenated method names: 'i5X3EjNgle', 'OrM3kDbuX5', 'DdSpnZBrsx', 'UxFprOjrXB', 'cLMpwQ4O0X', 'KNppGWitbF', 'TxvpsGe42s', 'xanp67LyAr', 'P5tpYAZfap', 'bOMpAevt0p'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, HC51PMMstdLFKtk3dK.cs	High entropy of concatenated method names: 'MI8JAqnH7N', 'iV8Jf0Mhu9', 'JrGJme9EhC', 'YgSJZOTLuh', 'QmBJM4kZ8P', 'ticJn9I8xa', 'kVGJrpyEw6', 'kyTJwtcPSW', 'DxIJG4yk4y', 'jyVJsdOLZx'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, R1nIVrArAGh1fWubMB.cs	High entropy of concatenated method names: 'oyYVh4VUrF', 'q2GVKQ44Y1', 'sAeVLynrA5', 'UFtVCrmsIU', 'KsbVJvlWft', 'Dv3V4BLMKy', 'l2aoOTlZa1KkWsyaHA', 'SWy20hOsF3uyCjL4DV', 'ceKVVNjvFP', 'sONV9YD8cE'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, MveMJY969xsZHNoDdw.cs	High entropy of concatenated method names: 'i7T8vP07ui', 'vJN8Tm61u7', 'vvM83MwFLE', 'c1J8hBPDTp', 'Y7i8KKUfOj', 'FZ83NfGoo3', 'ynR3o91imQ', 'm7F3OHYmUn', 'lEc3qTmZhB', 'OFd3lIlV4W'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, ALeZd5HJXthoYYUxWS.cs	High entropy of concatenated method names: 'WKK9vZ1Stu', 'OyW9ckYQ2v', 'fuV9T9rHcQ', 'WOv9pEEmvw', 'Jg993Xrc6R', 'Wbv98QlPFg', 'BpV9hfI1h9', 'doI9Ko8gWF', 'TgE904GxEc', 'IiT9LA5FgA'
Source: 0.2.Quotation - HDPE Fittings.exe.4682c00.8.raw.unpack, AT2Tlt6QMO42fi70Pf.cs	High entropy of concatenated method names: 'yohpbXkV4y', 'r3SpI58ORA', 'bKQp7mNrCL', 'eovpg8OyAT', 'j3NpJaVsju', 'RBkp4qBlLc', 'BbJp50rlCw', 'rTupuaWUY8', 'G5hpeDEqUY', 'UCqpHRwKcK'

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 7E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 8E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 90E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: A0E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Memory allocated: 4CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Window / User API: threadDelayed 507			Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Window / User API: threadDelayed 5971			Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 4028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7228	Thread sleep count: 507 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7228	Thread sleep count: 5971 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -96594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe TID: 7220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98122	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Memory written: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Process created: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe "C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Quotation - HDPE Fittings.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 5440, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1998316965.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1992626012.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Quotation - HDPE Fittings.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Quotation - HDPE Fittings.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 5440, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Quotation - HDPE Fittings.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.45baf60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.4580540.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002D39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 4080, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation - HDPE Fittings.exe PID: 5440, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.32c620c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Quotation - HDPE Fittings.exe.7450000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1998316965.0000000007450000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1992626012.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	111 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation - HDPE Fittings.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
Quotation - HDPE Fittings.exe	38%	Virustotal		Browse
Quotation - HDPE Fittings.exe	100%	Avira	HEUR/AGEN.1309278
Quotation - HDPE Fittings.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	URL Reputation	safe
http://ocsp.sectigo.com0A	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.199.225	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sectigo.com0A	Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3233170604.00000000067B2000.00000004.00000020.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228840094.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Quotation - HDPE Fittings.exe, 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Quotation - HDPE Fittings.exe, 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://us2.smtp.mailhostbox.com	Quotation - HDPE Fittings.exe, 00000003.00000002.3229813317.0000000002D16000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.199.225	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417527
Start date and time:	2024-03-29 15:01:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation - HDPE Fittings.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 84 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:01:55	API Interceptor	33x Sleep call for process: Quotation - HDPE Fittings.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
208.91.199.225	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse
	FedEx_773099516146.exe	Get hash	malicious	AgentTesla	Browse
	FedEx_ 239071091.exe	Get hash	malicious	AgentTesla	Browse
	vJRoTmuNBS4S30j.exe	Get hash	malicious	AgentTesla	Browse
	IHf0UdzLac.exe	Get hash	malicious	AgentTesla	Browse
	FedEx_2341717012.exe	Get hash	malicious	AgentTesla	Browse
	CV INTERNSHIP ENG.exe	Get hash	malicious	AgentTesla	Browse
	HSBC Payment Advice.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	FedEx Invoice.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	FedEx_773099516146.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Maersk Bill of Lading.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	FedEx_ 239071091.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	DHL9407155789.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Maersk Shipping DOC.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	CamScanner.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	207.174.215.2
	Quote#U00a0UPDATE#U00a0#U00a027-03-24.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	PO 20240105.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quote_Q9555.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Quote#U00a0UPDATE#U00a0#U00a027-03-24.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	FedEx Invoice.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223

Process:	C:\Users\user\Desktop\Quotation - HDPE Fittings.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.958887611753827
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Quotation - HDPE Fittings.exe
File size:	683'520 bytes
MD5:	10f4c53cf6490bcf1f1cf0f3a88250de
SHA1:	4e9d7fd3c9651c205f72a6c696c656e7ae84a9d8
SHA256:	af83c0d8ccb38c430dce3b0c4a18eeda3c91832ae8bb432a9614619fd5727e7b
SHA512:	24b71b5339000c364858c137a7955cd7b464466da658ccb44c3659bedc55dcab89c185ceeb2bc5debd42d0e34ffd01f0f81d761c6a22e11dbc70bdd7786f30d5
SSDEEP:	12288:JBLK1sKjd9+wrOGCZ8SBvAxi/MgUd7YN0hMJqGcIlHI16CDYWEVy4Zw13vHruup:JBisKjdTOGu8SVIsmqaM7lHw6COtw1fr
TLSH:	7BE422503BEC0766F4E26FB518B1A10093B7BA57716DE74C2D4C50AC0EBA75A85C27B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..d............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4a81ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6606A2CD [Fri Mar 29 11:15:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
inc ebx
inc edi
inc edi
dec eax
aaa
aaa
inc edi
dec ecx
xor al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax+44h], cl
xor eax, 00000047h
cmp byte ptr [esp+eax*2], dh
inc ebp
push ebx
xor al, 33h
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa8199	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa6648	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa6214	0xa6400	257a4fa9a943281468cabaa2b89270c1	False	0.9536272321428572	data	7.964661054278462	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x59c	0x600	c22bfb586503c2b833cd97a5c4eda7cd	False	0.41796875	data	4.059667991800482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	af05054523563410ae9a10410b3fc7f9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xaa090	0x30c	data			0.43333333333333335
RT_MANIFEST	0xaa3ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:01:57.963246107 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:58.144895077 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:58.144982100 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:58.858696938 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:58.859416008 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.039602041 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.039735079 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.041968107 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.224355936 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.228791952 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.409742117 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.409760952 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.409838915 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.409851074 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.409929991 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.409929991 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.591964960 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.626760960 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:01:59.809027910 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:01:59.820808887 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.002918005 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.003910065 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.187514067 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.188433886 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.375876904 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.376199007 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.559729099 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.559995890 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.766870975 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.767112017 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.949774981 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:00.954921007 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.954998016 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.955029011 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:00.955049038 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:02:01.136066914 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:01.136085987 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:01.267664909 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:02:01.321151972 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:03:37.884021997 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:03:38.066225052 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:03:38.066643953 CET	587	49706	208.91.199.225	192.168.2.5
Mar 29, 2024 15:03:38.066695929 CET	49706	587	192.168.2.5	208.91.199.225
Mar 29, 2024 15:03:38.069710016 CET	49706	587	192.168.2.5	208.91.199.225

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 15:01:57.856822968 CET	51459	53	192.168.2.5	1.1.1.1
Mar 29, 2024 15:01:57.956413984 CET	53	51459	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 15:01:57.856822968 CET	192.168.2.5	1.1.1.1	0xd32d	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 15:01:57.956413984 CET	1.1.1.1	192.168.2.5	0xd32d	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:01:57.956413984 CET	1.1.1.1	192.168.2.5	0xd32d	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:01:57.956413984 CET	1.1.1.1	192.168.2.5	0xd32d	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)	false
Mar 29, 2024 15:01:57.956413984 CET	1.1.1.1	192.168.2.5	0xd32d	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 29, 2024 15:01:58.858696938 CET	587	49706	208.91.199.225	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Mar 29, 2024 15:01:58.859416008 CET	49706	587	192.168.2.5	208.91.199.225	EHLO 910646
Mar 29, 2024 15:01:59.039735079 CET	587	49706	208.91.199.225	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Mar 29, 2024 15:01:59.041968107 CET	49706	587	192.168.2.5	208.91.199.225	STARTTLS
Mar 29, 2024 15:01:59.224355936 CET	587	49706	208.91.199.225	192.168.2.5	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	15:01:55
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\Quotation - HDPE Fittings.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"
Imagebase:	0xea0000
File size:	683'520 bytes
MD5 hash:	10F4C53CF6490BCF1F1CF0F3A88250DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1998316965.0000000007450000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1992626012.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1993283962.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:01:56
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\Quotation - HDPE Fittings.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation - HDPE Fittings.exe"
Imagebase:	0x9e0000
File size:	683'520 bytes
MD5 hash:	10F4C53CF6490BCF1F1CF0F3A88250DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3229813317.0000000002D0E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3229813317.0000000002D39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3228561843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3229813317.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	190
Total number of Limit Nodes:	14

Executed Functions

Function 03084B00 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950008b73eece272d6a3ff3da691a672cd6a82ee5b8efe5a3493dbec29fdc5a7
Instruction ID: c039280cf5d73470b81a882bbca511bd2f5bebcdd85c98cc54c1006fd2a5c2f7
Opcode Fuzzy Hash: 950008b73eece272d6a3ff3da691a672cd6a82ee5b8efe5a3493dbec29fdc5a7
Instruction Fuzzy Hash: ED023D51B1A2D7DFCF62EB7F68129616ADC8BBA218F0D41A5E9C1CF367D065C820C325

Uniqueness

Uniqueness Score: -1.00%

Function 07E35F04 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07E36146

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cfc53e4541fe5a4251776ff2d05ed8da88f1e3f9a2ed3b64eecdcab6a9037af3
Instruction ID: 0d5f0cefd37637df97f8d7b4b6f7c9c4892a482a42dd68d885e18a07e4cb1873
Opcode Fuzzy Hash: cfc53e4541fe5a4251776ff2d05ed8da88f1e3f9a2ed3b64eecdcab6a9037af3
Instruction Fuzzy Hash: 92A18FB1D0121ADFDB24CFA8C845BEDBBF2BF44318F1481A9D808A7250DB759995CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07E35F10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07E36146

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 87483831a280c3f7069ba8eaf698e3fafbef9e17e3b88b775e03f9effdbba19d
Instruction ID: d632c5d4fb357c65124ec77b0008ad84ac74c31fa04a1dd132c220f000e2866d
Opcode Fuzzy Hash: 87483831a280c3f7069ba8eaf698e3fafbef9e17e3b88b775e03f9effdbba19d
Instruction Fuzzy Hash: 34917CB1D0121ADFDB20DFA8C845BEDBBF2BF44318F1481A9D808A7250DB759995CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0308B320 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9535d4368afa69a554ae37b23e9a99ea2e51e66c9ff4c3bb6267a288d71d9ebf
Instruction ID: af46ac95c16e58d9d2ed9a840248c28d8ce999b232fe357c7bb49a6d67241dd6
Opcode Fuzzy Hash: 9535d4368afa69a554ae37b23e9a99ea2e51e66c9ff4c3bb6267a288d71d9ebf
Instruction Fuzzy Hash: A0814570A01B059FD764EF2AD04575ABBF5FF88300F048969D48ADBB50EB78E805CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0308590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030859C9

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 966f0822fa7c69c933405d38fc3a569f506d304077c2a1653c8964954fbd6e30
Instruction ID: 2bb394fbb056d5df57f5351c943440ca59a9c3a60f10f4357dbf9968c4b4f9d4
Opcode Fuzzy Hash: 966f0822fa7c69c933405d38fc3a569f506d304077c2a1653c8964954fbd6e30
Instruction Fuzzy Hash: 73410FB0C01719CBDB24DFA9C884BCDBBF6BF49704F24806AD448AB255DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 030844D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 030859C9

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2f75a481cf370ec1f19503493d18120447b0a775d974d8c05d2f1463a65cbb38
Instruction ID: b2b260dfdf55421aeceedea82075748be9646bd5e2ef44ab8d0a2e81cfe6015d
Opcode Fuzzy Hash: 2f75a481cf370ec1f19503493d18120447b0a775d974d8c05d2f1463a65cbb38
Instruction Fuzzy Hash: EE41FFB0C01619CBDB24DFA9C884BDDBBF6BF49304F24806AD448AB255DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07E35C81 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07E35D18

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 71625fa2c7b4dd4dff6ea8e35b1e9ba944a101dd7a3d08ab9e6da874f83e016d
Instruction ID: 45dfaa91246574f75cebbec111d3a7fc785ed3d4cfcfcd9c298543583ef02bd1
Opcode Fuzzy Hash: 71625fa2c7b4dd4dff6ea8e35b1e9ba944a101dd7a3d08ab9e6da874f83e016d
Instruction Fuzzy Hash: C02146B59003599FCB10CFA9C985BEEBBF5FF48314F10842AE919A7240D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07E35C88 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07E35D18

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7cf0a8ffb050ba502a7f902f97d053da940e6a3e269d0b3ce9198f64b27f5a9d
Instruction ID: 336772c1c541d7c3fb861ee0a15dc9156c67fae2e1376f9c4c926d2db796b8a5
Opcode Fuzzy Hash: 7cf0a8ffb050ba502a7f902f97d053da940e6a3e269d0b3ce9198f64b27f5a9d
Instruction Fuzzy Hash: 8B2139B59003099FCB10DFA9C985BEEBBF5FF48314F108429E919A7340D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07E356B0 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07E35736

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: cf140abd6ce6b62d750a83c43f8f8f0ec66d18065de2bcc67d78fdd63ee101d3
Instruction ID: 537601cee4cae29541790fbf20d50f8193a3493189fcde6d093744b4b1ab2646
Opcode Fuzzy Hash: cf140abd6ce6b62d750a83c43f8f8f0ec66d18065de2bcc67d78fdd63ee101d3
Instruction Fuzzy Hash: 692148B19002099FDB10DFAAC4857EEBBF4EF49314F148429D419A7240CB789645CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E35D70 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07E35DF8

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 688168ce700d490a9637d11d5484777424198da886626bfc945d79140348ec0c
Instruction ID: 0617d432e4d8c9ef4b618ae22c0d917fb3e68d85ed36f71ea762254da2cab3c9
Opcode Fuzzy Hash: 688168ce700d490a9637d11d5484777424198da886626bfc945d79140348ec0c
Instruction Fuzzy Hash: FF2148B1C003499FCB10DFAAC884AEEFBF5FF49314F10842AE919A7250C7389540CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0308D7F8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0308D7C6,?,?,?,?,?), ref: 0308D887

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd11ae311c893ece8fb421797d0b4cac5241f578b7878fb87f15a2d842fd5df6
Instruction ID: cebc13dc7890a13acd5f30ac235b02f1066599d3f529e69b5cfb5766d305c25a
Opcode Fuzzy Hash: bd11ae311c893ece8fb421797d0b4cac5241f578b7878fb87f15a2d842fd5df6
Instruction Fuzzy Hash: 2021F6B5901208EFDB10DF9AD984ADEBBF4FB48310F14841AE954A3250D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0308CE90 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0308D7C6,?,?,?,?,?), ref: 0308D887

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b5aa763a44bf445a3924ca1170297cac96cffb55313a87091309b13b5747d2bc
Instruction ID: 0c7b2e5e45524ad7ce23fec21b9dc690a8fff9cb6fc716dc36e09ed4fcf54240
Opcode Fuzzy Hash: b5aa763a44bf445a3924ca1170297cac96cffb55313a87091309b13b5747d2bc
Instruction Fuzzy Hash: 6E21E7B5901208EFDB10DF9AD584AEEBBF4FB48310F14846AE954A3350D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E356B8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07E35736

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 056054b9c8338daef5fd9f8bb1a9a479de9a0b939e0ea17341b6767237b005c6
Instruction ID: c50c33b118d9284b0b3c3574b96526a3f8ea7d0c69bd2f058126e3098b7ea9ad
Opcode Fuzzy Hash: 056054b9c8338daef5fd9f8bb1a9a479de9a0b939e0ea17341b6767237b005c6
Instruction Fuzzy Hash: 3C2118B5D002099FDB10DFAAC4857EEBBF4EF48314F548429D519A7340DB789A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E35D78 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07E35DF8

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ac284625d9d8b49919be3d98e86b4b7d9fd5bd6015a116757ed25a2c789ca207
Instruction ID: a6ae725bbfe7241da9773650c1a33261e375e5fe058dd952f5d35d151e39197f
Opcode Fuzzy Hash: ac284625d9d8b49919be3d98e86b4b7d9fd5bd6015a116757ed25a2c789ca207
Instruction Fuzzy Hash: DA2138B1C003499FDB10DFAAC885AEEFBF5FF48310F50842AE919A7240C7389940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0308AD60 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0308B601,00000800,00000000,00000000), ref: 0308B812

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9f84a197b43de9c4688f1b5da0f9bc1fb9729f1eb34a3d4c0609736451a9c146
Instruction ID: e58db33418d45b365c74477654430d3cc13eb63f7e201f6b88f0d29e0001e1ff
Opcode Fuzzy Hash: 9f84a197b43de9c4688f1b5da0f9bc1fb9729f1eb34a3d4c0609736451a9c146
Instruction Fuzzy Hash: F11112B6D003499FDB20DF9AD444AAEFBF4EB48320F14842AE959A7300C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E35BC0 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07E35C36

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 92ac0293fcced4f9b38d767dd4a01a37e6117fdc8bc4bb0a1a434e09a0cc72ec
Instruction ID: 233a3e5c528f2d835946f5870da6fb6c0183a338124ddfa777c7d9d84ba3684f
Opcode Fuzzy Hash: 92ac0293fcced4f9b38d767dd4a01a37e6117fdc8bc4bb0a1a434e09a0cc72ec
Instruction Fuzzy Hash: 671179B59002499FCB20DFAAC845AEFBFF5FF48314F108819E519A7250C7799940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07E35BC8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07E35C36

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 78d29bcdd9b527948ed10c9591e4d33dbe1b29d1697afa2770d1b5b2d66080f0
Instruction ID: 9ed12ce30ade0107cc39fe005a36b1d4043ac34d6d67a125ff92fa7ff8083347
Opcode Fuzzy Hash: 78d29bcdd9b527948ed10c9591e4d33dbe1b29d1697afa2770d1b5b2d66080f0
Instruction Fuzzy Hash: FB1137B59002499FCB10DFAAC845AEEBFF5FF48314F148819E519A7250C779A950CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0308B7A3 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0308B601,00000800,00000000,00000000), ref: 0308B812

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1386a10308722c2ef25a9a41c14ecbfb7e206bf3379d1e32c27248e1489dfb89
Instruction ID: 97db483001c15c3ca28e4e8c742e81d75879bc8ae91c82463b57ced42385a360
Opcode Fuzzy Hash: 1386a10308722c2ef25a9a41c14ecbfb7e206bf3379d1e32c27248e1489dfb89
Instruction Fuzzy Hash: AC1123B6C003499FDB10DF9AD844ADEFBF4EB48310F14842AD419A7300C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E35600 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07E3566A

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6f7af328a8657731c43d1cabab186008d88ab2ebeadaba02ba2588eaef85e7e6
Instruction ID: a9b250fe00b1b70269eac818f4f613817ccfc4178144dcb72ef33a210356cfd7
Opcode Fuzzy Hash: 6f7af328a8657731c43d1cabab186008d88ab2ebeadaba02ba2588eaef85e7e6
Instruction Fuzzy Hash: 461146B19003498FDB20DFAAC4457AEFBF5EF89724F24881AD519A7240CB38A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E39C50 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,07E3A3D9,?,?), ref: 07E3A580

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a7996fd9aad1ccb2715efbdd410707d2c62499816555d10987f88593a434a7a0
Instruction ID: a0235d45f24121c9a95f918ff8a356361f95a7bb3dcee00219aed3bed23d14ff
Opcode Fuzzy Hash: a7996fd9aad1ccb2715efbdd410707d2c62499816555d10987f88593a434a7a0
Instruction Fuzzy Hash: F0113AB58003499FDB20DF99C549BEEBBF4EB48320F10842AE559A7340D378A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E35608 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07E3566A

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 83c8c690b1a7e9556f81529cd3e0b004e49ca8b2a6707a2b67a4f1fb2714840b
Instruction ID: dc847dbff5f8aa9b6ce67f2e9fe5534f0644b0e41b53125195bfe901e1abf75a
Opcode Fuzzy Hash: 83c8c690b1a7e9556f81529cd3e0b004e49ca8b2a6707a2b67a4f1fb2714840b
Instruction Fuzzy Hash: 6A1128B1D002498FDB20DFAAC4457AEFBF5EF88324F248819D519A7240CB79A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E3A520 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,07E3A3D9,?,?), ref: 07E3A580

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f8b8fe74c67d69b1db2e2cd7b5ed2bf96ca9c063e4ba2cdccf662837dfb1e949
Instruction ID: 4f0fb0a687ed3a5be28c4a52d66b8354535584b084e69ee682b83653976bd532
Opcode Fuzzy Hash: f8b8fe74c67d69b1db2e2cd7b5ed2bf96ca9c063e4ba2cdccf662837dfb1e949
Instruction Fuzzy Hash: 7F1116B58003499FCB20DF99D545BDEBBF4EB48324F14845AD558A7341D338A684CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07E348E8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07E381CD

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 50125a0200cc2f3d26cffa54937435cb0a06f03debf142160870a8feb1e4cef4
Instruction ID: 6483f08c6bea642a7143b125d89df4d7276b98da3162f10d99ac144bc5a72a25
Opcode Fuzzy Hash: 50125a0200cc2f3d26cffa54937435cb0a06f03debf142160870a8feb1e4cef4
Instruction Fuzzy Hash: 8F1106B58003499FDB10DF9AD449BDEBBF8FB48310F108459E518A7200D379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0308B520 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0308B586

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2e9a8d704d43ba6ffe666e5973cfebe07e0e5ff9410c636a10bcc13f6f1183a1
Instruction ID: 28a3afbeeed4ff738ca81af99a001875cd7f1840c3c5ac93a83408fd64ed7eef
Opcode Fuzzy Hash: 2e9a8d704d43ba6ffe666e5973cfebe07e0e5ff9410c636a10bcc13f6f1183a1
Instruction Fuzzy Hash: 6F11DFB5C012498FDB10DF9AD444B9EFBF4EB89314F14842AD469B7210D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07E3816B Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07E381CD

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7d459041a0e0b825ce2c4daf0198f5a7711971fdf3f695db6319ddf6dc377851
Instruction ID: e2b2a16c29f0324e9c165514a0e906b57e30313fdee93d2d099711a5aa31ec6f
Opcode Fuzzy Hash: 7d459041a0e0b825ce2c4daf0198f5a7711971fdf3f695db6319ddf6dc377851
Instruction Fuzzy Hash: 571103B5800249DFDB20DF99D889BDEBBF4FB88314F148959E518A7300C379A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0172D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c126bc369ed0086b7283e519abb2b612c5dc14639deaafb26a1d52bd8a95ba0
Instruction ID: d178e090ae33bc65a6e4ffbac17d7dcb0aa7533543fe9f3d0f263c83a9c619ae
Opcode Fuzzy Hash: 8c126bc369ed0086b7283e519abb2b612c5dc14639deaafb26a1d52bd8a95ba0
Instruction Fuzzy Hash: 0A210672508240DFDB16DF98D9C4B26FFA5FB89320F20C5A9E9090B256C33AD417CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0172D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5386886e6f58c2d665f0510e50ca590bbb47cc22f71890bac88093564cbdea
Instruction ID: 3ea29b92a37176bcbe650fc3bab719f8124894db95dc721edaba1485f9243093
Opcode Fuzzy Hash: 3e5386886e6f58c2d665f0510e50ca590bbb47cc22f71890bac88093564cbdea
Instruction Fuzzy Hash: 93210371504240DFDB25DF98D9C0F26FF65FB88318F30C5A9E9090B256C37AD456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 019DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991480091.00000000019DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 019DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19dd000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76696b3b5173f9743c50f21ca9d98c0a823c4617240c159c5466a3eb0d9aa12
Instruction ID: 59ec7aec6e016c871fc0fb876aad502369a3dcf9a58a9c268c525cc20de5563b
Opcode Fuzzy Hash: e76696b3b5173f9743c50f21ca9d98c0a823c4617240c159c5466a3eb0d9aa12
Instruction Fuzzy Hash: F321D071604204DFDB15DFA8D984F26BFA9EBC8354F24C969D90E4B296C33AD406CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 019DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991480091.00000000019DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 019DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19dd000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cce2e6724fc061b91134f7148be4171f06fbc8194ffed6b3c95b68ac1c46a35
Instruction ID: 12b252b62f3c38096201591eecb0bc9a7affc397b8d37eb207dadfa3e968842d
Opcode Fuzzy Hash: 7cce2e6724fc061b91134f7148be4171f06fbc8194ffed6b3c95b68ac1c46a35
Instruction Fuzzy Hash: CB21F571544204EFDB05DFA8D9C0F26BBA9FB84324F20C96DDA4D4B296C33AD406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 019DD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991480091.00000000019DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 019DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19dd000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df1b655a736082d3e39f0dc5f10b8303bb8a1e7446110ac545b88bf942e6131
Instruction ID: d238d12acc5de6d234b790421457cee0183acad9d83149f096826da1c2bbf864
Opcode Fuzzy Hash: 3df1b655a736082d3e39f0dc5f10b8303bb8a1e7446110ac545b88bf942e6131
Instruction Fuzzy Hash: 3921A4755093C08FDB13CF24D994715BFB1EB86214F28C5DAD8498B697C33A940ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0172D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 4606c010c8eb69469c8e926a962083336b21b132e2c0f20ac526841f8e0d93bd
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: 6821CD76408240CFDB16CF44D9C4B16FFA2FB89320F24C5A9DD080A256C33AD42ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0172D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: c18dff122618d1c63fd292bf045bd9652457aaecd417b4428c9498ff5d305175
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2111CA72404280CFDB12CF54D9C4B16BF62FB88228F34C6A9D9490B256C33AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 019DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991480091.00000000019DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 019DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19dd000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 9c3243cffcc470a5aa72dec0b27b323aede5dd28adf83d149100a32cbe702820
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 4B11BB75504280DFDB02CF54C5C4B15BFB1FB84224F24C6A9D9494B696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0172D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a1e153cd982f9779ca8be8052001038823249afa54118edbd1722f4b4801cf
Instruction ID: 1cc5d31fc39944306eaa4566b74c8c3d18e68e74af30dee8c820a823c90aca0f
Opcode Fuzzy Hash: 47a1e153cd982f9779ca8be8052001038823249afa54118edbd1722f4b4801cf
Instruction Fuzzy Hash: C5012B310043909AE7308EA9CD84B67FF9CEF45324F18C56AED084A386D23D9802CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0172D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991288393.000000000172D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0172D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_172d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4c7c5c18ca32b7cf904348dde6c3729eaa3c2e77d3f0f38b6e072652769c71
Instruction ID: a16f18ffdb915a1bc1b5e189d06354dd3c48e1f903670bacbc98b65aa9258728
Opcode Fuzzy Hash: bb4c7c5c18ca32b7cf904348dde6c3729eaa3c2e77d3f0f38b6e072652769c71
Instruction Fuzzy Hash: 61F0F6714043949EE7208E1ACC88B62FFD8EF45334F18C45AED484B386C3799841CBB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07E39E10 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc101b8d89d92f11d72759fef8b9071193450a953df0780040b5b69d28a8917
Instruction ID: 00042fbf7a6b0156802a9cc5a78407f86d030888f7e338011640cf7a6caf4a09
Opcode Fuzzy Hash: bfc101b8d89d92f11d72759fef8b9071193450a953df0780040b5b69d28a8917
Instruction Fuzzy Hash: 4ED1DDB07067018FDB19EB35C4147AEB7F6AF89304F14846ED1869B791DB39E882CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07E35790 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b4e9d8a5d5335607801fc3072ac7b0a68b8ac45daa783d0a7c7138507e3358
Instruction ID: 50d11cc20640093bf8ce85c43f9cbf6e91b1bf68e035da0b014f4361b0938bbb
Opcode Fuzzy Hash: 78b4e9d8a5d5335607801fc3072ac7b0a68b8ac45daa783d0a7c7138507e3358
Instruction Fuzzy Hash: 8EE119B4E012198FCB14CFA9C5849AEFBB2FF89305F249169E815AB356D730AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07E335E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f271a2c6496b8587f730ce361a2969d7525f66488721e1c55fd7072b5ecc5b2
Instruction ID: 4fdeab1577f950d9d6492886d1964ca257534de65a09ab46f9cdc249ea30538d
Opcode Fuzzy Hash: 4f271a2c6496b8587f730ce361a2969d7525f66488721e1c55fd7072b5ecc5b2
Instruction Fuzzy Hash: 6DE11AB4E011198FCB14CFA9C5849AEFBB2FF89305F249169D815AB35AD730AD81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07E32D70 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6861c157fa36ad9dabca5da87905375694df1e07087fc93f3f2720fe15030ef2
Instruction ID: fd335cb2da2dc55c8c9a52d334b07d3f25506c08b7c1be3a1c2942bed2341a0a
Opcode Fuzzy Hash: 6861c157fa36ad9dabca5da87905375694df1e07087fc93f3f2720fe15030ef2
Instruction Fuzzy Hash: D8E118B4E011198FCB14CFA9C5849AEFBB2FF89305F249269E815AB356C730AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07E33A18 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687d6d05aa89af1d4883b4db1c9a75c59e5e3512c91f8ab9fc0a06ea649e106f
Instruction ID: badb0195e4497918dc607ee070b6b4ca065bd1cce6b44c8ff644bb0ccfd1ba34
Opcode Fuzzy Hash: 687d6d05aa89af1d4883b4db1c9a75c59e5e3512c91f8ab9fc0a06ea649e106f
Instruction Fuzzy Hash: 0BE12AB4E012198FCB14CFA9C5849AEFBB2FF89305F249169D815AB356C730AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07E331A8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1999003559.0000000007E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e30000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a029c28b9287b1e4635ed6a533deae2b95fdf847ebf45394e1062f52d0415f
Instruction ID: 2eaaaa2dd7aab0bbe3aeb542d78c680be4e1dd017c04cb1da3f55c71072d5a6c
Opcode Fuzzy Hash: 13a029c28b9287b1e4635ed6a533deae2b95fdf847ebf45394e1062f52d0415f
Instruction Fuzzy Hash: 1AE108B4E011198FCB14CFA9C5849AEFBB2FF89305F248169E815AB356D734AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0308E16C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991797715.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3080000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2201a973ad5b632c55494108c72276090f6ba0e55e7362ff84eb3aef29ab95
Instruction ID: ab1c776cb6785efd794e4166d7a265bc1d8123e1aa125dac0d5a193e1c01c896
Opcode Fuzzy Hash: cf2201a973ad5b632c55494108c72276090f6ba0e55e7362ff84eb3aef29ab95
Instruction Fuzzy Hash: CCA18F36E0120ACFCF15EFB4D8404DEB7B2FF85300B19856AE845AB265DB31E955CB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Quotation - HDPE Fittings.exePID: 5440, Parent PID: 4080COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 05209B28 Relevance: 2.8, Instructions: 2849COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47967306d5e405d5b31de80f4a18f037620df8710130f8f58c0722b6e97e5ca9
Instruction ID: 09cddb13973881dbbde170ad1167c320f327f446f0dbee20f2766689d9082c63
Opcode Fuzzy Hash: 47967306d5e405d5b31de80f4a18f037620df8710130f8f58c0722b6e97e5ca9
Instruction Fuzzy Hash: 3563E731D10B1A8ADB11EB68C8849ADF7B1FF99300F51D79AE45877121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05204A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16c8f814f4d2d91ddcc110c8fccf4875bfccd182052ea1459906935765e53fa
Instruction ID: bf0e431ab0472badbd2dcd26dd354cb46e712ee68cb06481fe479ad4f0eca7b7
Opcode Fuzzy Hash: d16c8f814f4d2d91ddcc110c8fccf4875bfccd182052ea1459906935765e53fa
Instruction Fuzzy Hash: 5DB19070E1120A9FDF10EFA8C8857ADBBF2BF88314F14D129D519A7295EB749842CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05203E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b3d5adb20fa2b2a459ce915e6e35b16d8751967c71c3544bdfe9d3a9a01d43
Instruction ID: 4032ea87fcbd936c9360da51a41046732bfe11496d267cf09a082898f479728a
Opcode Fuzzy Hash: 72b3d5adb20fa2b2a459ce915e6e35b16d8751967c71c3544bdfe9d3a9a01d43
Instruction Fuzzy Hash: 2B91CF70E1120ACFDF10DFA8C9857DEBBF2BF88304F149129E409A7294EB349846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05206ED3 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 05206FB5
LR]q, xrefs: 05206F06

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 2084cdeeb5692ccd1605928fc33e6ed64e87b02bf15440dded7d92b248288f3e
Instruction ID: 4e203e9faf53de092def17e84e1b5929f078d2398b0e3e3b49951d0433bc9ab2
Opcode Fuzzy Hash: 2084cdeeb5692ccd1605928fc33e6ed64e87b02bf15440dded7d92b248288f3e
Instruction Fuzzy Hash: 7A41E531A2121A9FDB15DB74C4547AEB7B3FF85304F148529E40AEB381EB71A846CB51

Uniqueness

Uniqueness Score: -1.00%

Function 062CE190 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3232899987.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a129bbc881a170c9fbc907c9412dfb0649ef86b0ed60c95a249c201105f05d6
Instruction ID: 4fc124db6a800b0173ec6a5b9a97d4d8a2c9013d1f19e8d6a374fa72207b21b7
Opcode Fuzzy Hash: 7a129bbc881a170c9fbc907c9412dfb0649ef86b0ed60c95a249c201105f05d6
Instruction Fuzzy Hash: 69416671D143968FCB04CF68D8502EEBFF1AF89220F0586AAD849A7241DB389844CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 062CE278 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B550542), ref: 062CE2DF

Memory Dump Source

Source File: 00000003.00000002.3232899987.00000000062C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_62c0000_Quotation - HDPE Fittings.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2b8b489d4573a1ccb29b6e04013f749b4bd5e55dd9a688dc31f6e461c4b516b9
Instruction ID: 4015f081d3e4fcbcc761c75cc0bf7e6a041d95fca64ba2fe50d8336973efd2c6
Opcode Fuzzy Hash: 2b8b489d4573a1ccb29b6e04013f749b4bd5e55dd9a688dc31f6e461c4b516b9
Instruction Fuzzy Hash: 2311E2B1C1066A9BCB10DF9AC544B9EFBF4AF48320F15816AD818A7640D778A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 05203E74 Relevance: 1.5, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 05203E74

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 14bdb570248a451c8ad72dc7955cdb21401f615b4700ce80067606604e978f86
Instruction ID: f5beb8f5486e3c65925d8fa4b5db05250f6cc8c923bec21a4b4c860a8b14f60d
Opcode Fuzzy Hash: 14bdb570248a451c8ad72dc7955cdb21401f615b4700ce80067606604e978f86
Instruction Fuzzy Hash: F791AF70E1520ADFDF10DFA8C9857DEBBF2BF88304F149129E509A7295EB749846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0520F3F5 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0520F543

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: a2663a2354a7da329315256640919530594305a760bc18e4fd8759dea8cc012c
Instruction ID: 91c05b2ae8998714f00275d6e6b3664a7d9a1c1f8cccbc7cb95ccf359e127549
Opcode Fuzzy Hash: a2663a2354a7da329315256640919530594305a760bc18e4fd8759dea8cc012c
Instruction Fuzzy Hash: 77312E307102028FDB29AB3496A4A6F3BE3BF89240F244538D40ADB396EF35DC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 05206F70 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 05206FB5

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: b4d75642ed6ba00ef7f96d4193937f4f17a2b5f3975119b1e89bc0181f3fe134
Instruction ID: 44ca5999a0e82e311c5514a9d1819c013279c8c84d94fe33d9a540ebed4dd9b3
Opcode Fuzzy Hash: b4d75642ed6ba00ef7f96d4193937f4f17a2b5f3975119b1e89bc0181f3fe134
Instruction Fuzzy Hash: EB31A430E2121A9FDF14CF64C454BAEB7B3FF85300F249529E40AE7281EBB1A946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 05206B99 Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

LR]q, xrefs: 05206BCF

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 2a557d1959ba8a62b632d161268d25955d3bcea8f02b05541f6e36d772e4ec00
Instruction ID: 210f47a3d79701b27c6264367b577c5b1c2daab7de63643439887aa99a40acef
Opcode Fuzzy Hash: 2a557d1959ba8a62b632d161268d25955d3bcea8f02b05541f6e36d772e4ec00
Instruction Fuzzy Hash: 7E11C432714204AFC31AAB78C46436E7BF6EF8A714F1048AED116CB391DE75A8518791

Uniqueness

Uniqueness Score: -1.00%

Function 05207903 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e493394c6182b1f988fa03560066bc9062e8199cd2bc7ececf6ebb1740a18581
Instruction ID: 19c2e8344e18da9e647e86690c91b38cccedb028e4115c583796b38c587f0e7c
Opcode Fuzzy Hash: e493394c6182b1f988fa03560066bc9062e8199cd2bc7ececf6ebb1740a18581
Instruction Fuzzy Hash: 0712B1307212168BCB2DEB38E588A2837A7FF85714B544939E019CB3A5DF35EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 052096D8 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d89060dd42ab39e52d73148e6ccfe741096523024033a908a608b54ada3a37
Instruction ID: 38c8cb107cc98403401a52253b1be538de0711f50b052165930e7101098dc274
Opcode Fuzzy Hash: 25d89060dd42ab39e52d73148e6ccfe741096523024033a908a608b54ada3a37
Instruction Fuzzy Hash: D7C1D371B112068FDB14CFA9D880BAEB7B2FF88310F148569D50ADB396DB70D885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0520935C Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9427fbd5ac20d6b1006c4cf10fe306b447a1594ed64e873b6f44ff726b8c109
Instruction ID: 2987ef9bc7f85a584c9f36b1f73fa27b2f1f605d3ff1e1399aabfe013aeac4bb
Opcode Fuzzy Hash: a9427fbd5ac20d6b1006c4cf10fe306b447a1594ed64e873b6f44ff726b8c109
Instruction Fuzzy Hash: 73B19F35B152158FCB18DFA4D584AADBBB2FF88310F158569E40AE73A6CB74DC82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05204A8F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42daec625eb9c21658748ec1f05fbcf06f12a96192c520aae820706fcfe5c776
Instruction ID: 4374b01ca2a8d20d338ffbaa224c5b2f1a797171c434926f9e06f5a39050532d
Opcode Fuzzy Hash: 42daec625eb9c21658748ec1f05fbcf06f12a96192c520aae820706fcfe5c776
Instruction Fuzzy Hash: DDA19E70E1120A9FDF10EFA8C8857ADBBF2BF48314F14D129D519A7295EB749882CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05204810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95a2a86244b242828697ec2b3b329187cda30500ecf15662c164e77cb349abb
Instruction ID: c0db43fedc7cbe18ccdc183330ac7a5846a21a553ec729aab0b6a26e7796c639
Opcode Fuzzy Hash: d95a2a86244b242828697ec2b3b329187cda30500ecf15662c164e77cb349abb
Instruction Fuzzy Hash: 7471AD70E1121ACFDF10DFA9C884B9EBBF2BF88304F14C129E519A7294EB349841CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05204804 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f6f0d5718563479a7afc842abc0131af8f03fe2fde592900090edd8181e73f
Instruction ID: e8fff1f050d1aa671331425a38681f598b7fa20ab24cdbe8fbee3a735a287aca
Opcode Fuzzy Hash: 55f6f0d5718563479a7afc842abc0131af8f03fe2fde592900090edd8181e73f
Instruction Fuzzy Hash: 2971AE70E1125ACFDF10DFA9C885B9DBBF2BF88314F14C129E519A7295EB349841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05206CD4 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed7d3988600c53395a6f58760225e6ee767cc39f8b58eef7680448420bb969d
Instruction ID: 84dbdd2331e0b49395169f297a092d8c5c0bda026d995ffdea003b7bd49800ee
Opcode Fuzzy Hash: 0ed7d3988600c53395a6f58760225e6ee767cc39f8b58eef7680448420bb969d
Instruction Fuzzy Hash: F3513670D212298FDB14CFA9C889B9DBBF1BF48304F14811AD81ABB392D774A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05206CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f1cff7920577b9e1919bc08dc48752716c66f39eb4af888443fdf190c38568
Instruction ID: c4270401f2fbb066a9830fff7dffa23f9c5ef8ee7a8294a4e5089f807306e096
Opcode Fuzzy Hash: 05f1cff7920577b9e1919bc08dc48752716c66f39eb4af888443fdf190c38568
Instruction Fuzzy Hash: E4512570D212298FDB14CFA9C889B9DBBF1BF48314F148129D81ABB391D774A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0520D19E Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869de2e482565c944985399b8db3eaa4a89fb88fdfdd92c835fa633c4680ac24
Instruction ID: f82e42a14c1aef16ec14321728aee18eb1e110349773521f81b6469429ac6466
Opcode Fuzzy Hash: 869de2e482565c944985399b8db3eaa4a89fb88fdfdd92c835fa633c4680ac24
Instruction Fuzzy Hash: 3C41E275B01211AFDB05CF78D880E7A7BBAFF84304F148059E4059B29ACB35E843CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05201128 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1c11c7d70767d1dd8653726262400b29b07c4bf9c24cc33b9e6069b465aaf5
Instruction ID: 98c214ceaecf47dac38d65d5d4ee1fa72aa0fed656c65af2ed50c64e8733b3e6
Opcode Fuzzy Hash: ed1c11c7d70767d1dd8653726262400b29b07c4bf9c24cc33b9e6069b465aaf5
Instruction Fuzzy Hash: 8B51C831522281CFCB09FF28F981B543F79BB993047089979D0519762EEB786D89DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05201138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986807776181a7531034a3a8a8d1626b7618d9c61ff448e21a1212e7e5e136bd
Instruction ID: 7ecd6060d896a0ef15a4bbef6e59b3671d1f3d7d826742275fb480a826e12bb0
Opcode Fuzzy Hash: 986807776181a7531034a3a8a8d1626b7618d9c61ff448e21a1212e7e5e136bd
Instruction Fuzzy Hash: 5851AA71522281CFCB09FF28F981A543F79FB953043089979D0419763EEB786D89DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0520F2B8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b260148bd98fa7c86f1965b340fa0a5a8656871cf239ea2bdbbb53568499daf6
Instruction ID: 83ae20e842521a520215cc58473d836ccfdbc34e64f9ef13aa40b8c8a8ae62e7
Opcode Fuzzy Hash: b260148bd98fa7c86f1965b340fa0a5a8656871cf239ea2bdbbb53568499daf6
Instruction Fuzzy Hash: 7731B235E242168FCB18CF65D4946AEBBB2FF89310F108519E81AE7795DF70AC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 052026DF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394f1138cfedf5ea1b34b764b8a13d5a5509a14674dd532cdc52ee9089dbcd58
Instruction ID: cd2ec4e1b11815bce127c60940f03564c5af441b57c158dc1c22d34ec2da7a4b
Opcode Fuzzy Hash: 394f1138cfedf5ea1b34b764b8a13d5a5509a14674dd532cdc52ee9089dbcd58
Instruction Fuzzy Hash: 3E4101B4D11349DFDB14DFA9C584ADEBBF5FF48300F14842AE409AB254DB749945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0520F2C8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e1a71a01eed0e59f84d72aa401056d3162dcdeeaccfe9521026c9a35cadcf3f
Instruction ID: 7e92227a533c8396d3dd09046cae009f4c849612f99c38ec36f0ada957c40d53
Opcode Fuzzy Hash: 7e1a71a01eed0e59f84d72aa401056d3162dcdeeaccfe9521026c9a35cadcf3f
Instruction Fuzzy Hash: E2319434E242169BCB29CF65D594AAEB7B2FF89310F10C519E81AE7395DF70AC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 052026E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf5b65e15fd8f0f4c901179f75b68f8ae39813e51b1bdfcba26d605376a8d5d
Instruction ID: 7dd662e0da6baff14decc1458e3971c43985ed21dae0753f38d493dcea4d67b5
Opcode Fuzzy Hash: 0cf5b65e15fd8f0f4c901179f75b68f8ae39813e51b1bdfcba26d605376a8d5d
Instruction Fuzzy Hash: C9410FB4D00349DFDB10DFA9C484ADEBFB5FF48310F20802AE809AB254DB75A949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 052050A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800436158e1a5067af70e8cd0214b43828795cab54a71fe7bd2f380e56179f78
Instruction ID: 6e3a7d68a1ea0e6821f21067a0c32645a54929ee863535a50f50005c9b333436
Opcode Fuzzy Hash: 800436158e1a5067af70e8cd0214b43828795cab54a71fe7bd2f380e56179f78
Instruction Fuzzy Hash: 39313A34B21216CFDB14EB74C9546AE77B6BF88244F100468D806EB7A6EF36DC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05205099 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10161c60dedbfd421ae9480b961a1340cb8dadfb7153150d1a9017fe2b8fd95e
Instruction ID: fb7712338cd12e1d0edcd94c4bc793f17611657b44e17b795c9081f51f78a937
Opcode Fuzzy Hash: 10161c60dedbfd421ae9480b961a1340cb8dadfb7153150d1a9017fe2b8fd95e
Instruction Fuzzy Hash: 9C315A34B22216CFDB14EB74C9546AEB7B6BF48344F100468D806EB7A6EB36DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05209247 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0dabfe950ccbac48078b40846c7e05e7acf3e97c646cf77f8435fdce3c6845
Instruction ID: 259cbdcda725fe8a0ebd8d0646b8901216ba0157cc92e678801d4b01839ba70e
Opcode Fuzzy Hash: 6f0dabfe950ccbac48078b40846c7e05e7acf3e97c646cf77f8435fdce3c6845
Instruction Fuzzy Hash: 0B318271E1520A9BDB09DFA4D49079EB7B2FF89300F54C515E406EB386DB709886CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05209258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2622e98071854a18e4422b985e42cffe5af88f94855ca0098bf2fa595468073
Instruction ID: 0322204fcf9294bdeded6ff05150c729288e66e904ca49f71794e1b4f08ce2a1
Opcode Fuzzy Hash: a2622e98071854a18e4422b985e42cffe5af88f94855ca0098bf2fa595468073
Instruction Fuzzy Hash: 0021A231E1420A9BDB09CFA4D480A9EF7B2FF85300F10C615E406EB286DB709886CB80

Uniqueness

Uniqueness Score: -1.00%

Function 052016A3 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abaa8e447961b25286c958a25b6da15e013cab4aba37d14199557844819717d1
Instruction ID: 17c851698380697897d99ca3469268a5e7cd09231e6951c106cc145ca0045671
Opcode Fuzzy Hash: abaa8e447961b25286c958a25b6da15e013cab4aba37d14199557844819717d1
Instruction Fuzzy Hash: 2C2130346211428BDB16FB28FC89B79376AFF45304F109625D009C72ABDB78DC55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05209148 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe4ec0177e58f5f5db103439814d886b173d7950ea83ccaf37de7c6ba988a2c
Instruction ID: da386063479f68839b7d3b6eb1a19d08232fefd449fb8eac22fb94343a5dc8ae
Opcode Fuzzy Hash: dbe4ec0177e58f5f5db103439814d886b173d7950ea83ccaf37de7c6ba988a2c
Instruction Fuzzy Hash: 4F217431E152169BDB09CFA4C8546EDF7B2AF89300F10951AE816F7392DB709985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0520137F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5297a11a4f4b496b62c6cd4a93c825948f39e123cc6c8f19b9becb803e2550bf
Instruction ID: 6de1f33359c767bb413ea725372bdc55ada4a185ac62c06155d3c2ce1d58f2ec
Opcode Fuzzy Hash: 5297a11a4f4b496b62c6cd4a93c825948f39e123cc6c8f19b9becb803e2550bf
Instruction Fuzzy Hash: 5421F370A322464BEB79A724E88EB3C3B66FF06311F541469E40AC72D6DA69CC94C742

Uniqueness

Uniqueness Score: -1.00%

Function 05204F8B Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a6c439ec4ecd8b0a7f8ed6eb665eb82bf482085759512597be2f986cbe7e74
Instruction ID: a49c740db4dda293d5c7285c9bd5103f1bbb6f0e593b63b9a4e7aec80b25dc44
Opcode Fuzzy Hash: 99a6c439ec4ecd8b0a7f8ed6eb665eb82bf482085759512597be2f986cbe7e74
Instruction Fuzzy Hash: 33212835721209CFCB14EB68C958AAE77F2FF8D241B1044A8E406EB3A5DB729D00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0115D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3229462490.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_115d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c3493f8a23bf0a3fb5a76e7ac85d47205407326b985947498b8845e50f720b
Instruction ID: 6e88c3a54ee9fc492c921e10e5a286983ad3cf6e6fde8ca81fc710c32e5fa19c
Opcode Fuzzy Hash: f5c3493f8a23bf0a3fb5a76e7ac85d47205407326b985947498b8845e50f720b
Instruction Fuzzy Hash: A1210071604204DFDF59DF98E980B26BBA5EB84314F20C569DD0A4A256C33AD447CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05201878 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864d38406c79a797bf796077116e5c0ed201309347decefab3898a958041fc09
Instruction ID: 8a13c8be9292176ff773750f23ab115895fb90a5dc733733abc86829b4bf1b0b
Opcode Fuzzy Hash: 864d38406c79a797bf796077116e5c0ed201309347decefab3898a958041fc09
Instruction Fuzzy Hash: C3217F30B25249CFEF14EB78C9597AE77B6BF49304F140469D406EB292EB358D10CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05209158 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc939379649c197f47f004704b6c33dd60e7a43fe7089131c70001f7c31d6e76
Instruction ID: 7aca94a8dcf493ab35e02140801aec7cc4121314816f7421f366ca1e115300f5
Opcode Fuzzy Hash: fc939379649c197f47f004704b6c33dd60e7a43fe7089131c70001f7c31d6e76
Instruction Fuzzy Hash: EE215031E1521A9BDB18CF64C8549DEF7B2BF89300F10D51AE816F7392DB709985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05201888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce46385492d64ea1b7dafd6da9e769395f922730b6623e8ad6ad1f33da7a280
Instruction ID: dd1c4d473d9cfa4209637ed3bdcc11fa25ca38dbca2bee60838499337e5620e6
Opcode Fuzzy Hash: 9ce46385492d64ea1b7dafd6da9e769395f922730b6623e8ad6ad1f33da7a280
Instruction Fuzzy Hash: 94214C30B21209CFDF14EB68C9557AE77B6BF49344F100468D506EB795EB368D10CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0115D006 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3229462490.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_115d000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9948bf1a6c34a601f974f0df8783deaaf499db9962dc31730ef0df05c18f6cf3
Instruction ID: cba084de92e4be6cc27aa74470ea666c93e266b31f9c99a089e05a2f5d5f4b13
Opcode Fuzzy Hash: 9948bf1a6c34a601f974f0df8783deaaf499db9962dc31730ef0df05c18f6cf3
Instruction Fuzzy Hash: CF216B715093C0DFDB07CB64D990711BF71EB46214F29C5DBD8898B2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 052016B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbf92e08bc9906f3d36e0c4aabcc685cce3750f5d9ea30142407a39f33cbacd
Instruction ID: 7fc01ea561bde7c03429f330d8855effd7144d88334c29ea91f4c549cbf79c72
Opcode Fuzzy Hash: 9dbf92e08bc9906f3d36e0c4aabcc685cce3750f5d9ea30142407a39f33cbacd
Instruction Fuzzy Hash: 72212F346211424BDB26FB28FD88B79376AEF45304F109625D00AC72ABDB78DC55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05204F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb19256e35589810d36e06cfacf48d60e0749c766c26447a4fdb7b7963bcc0f
Instruction ID: 3fec2ffccce208042f09446a185dca4dcfa5ac65785479aa89d50473343cd5da
Opcode Fuzzy Hash: 4bb19256e35589810d36e06cfacf48d60e0749c766c26447a4fdb7b7963bcc0f
Instruction Fuzzy Hash: 3A211634B11205CFCB18EB78C558AAE77F6BF8D341B1044A8E406EB3A5DB769D00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05200848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebc18b996a55de74bfca526e953420698fbb15355319d2de84d72b2fb5e2568
Instruction ID: e8b6458dcbb8e1b7d4bd130cc64478e822f22852408a72ce257ea6965d8f963a
Opcode Fuzzy Hash: 4ebc18b996a55de74bfca526e953420698fbb15355319d2de84d72b2fb5e2568
Instruction Fuzzy Hash: 8A119030B322058BFF54AA79E44CB7E3696FF41214F90593AD00ACB2D2DA64CC858BC0

Uniqueness

Uniqueness Score: -1.00%

Function 05201488 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e07299525d00e8a75ff13fcb672562b2f6c0c950c6092d9550f38d4917dbc8c
Instruction ID: b16c663ecaf01e9a09c5d24a48d2238d8259d75862cbd771924ba1f0ea373a0e
Opcode Fuzzy Hash: 2e07299525d00e8a75ff13fcb672562b2f6c0c950c6092d9550f38d4917dbc8c
Instruction Fuzzy Hash: 5711CA31A222158FCF61EFB888582AD7BB1FF48310B141079D405E7382EB35C942C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 05200838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9935e55a5ae054ba9a9b786b3ae7f1aa703669401db86ed7cb8f3c377b4ec98e
Instruction ID: 1b3b57f03ea34b2cf8adbb9536fe5240c6024c86b30a86f878e4fb13bd2c0b98
Opcode Fuzzy Hash: 9935e55a5ae054ba9a9b786b3ae7f1aa703669401db86ed7cb8f3c377b4ec98e
Instruction Fuzzy Hash: CE11A731A322458BFF14A675E54CB7D3657FF41254F94553AD40ADB2C3DA64CC818BC1

Uniqueness

Uniqueness Score: -1.00%

Function 052017C3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2620a8c481b06aa5141d4fa7b6866d8d173becc788812b06d21f7115ecd1654
Instruction ID: a273ebbcee7cc9f8d86c2e203e903358614c33d42502b44ca45c5544de0a09d0
Opcode Fuzzy Hash: a2620a8c481b06aa5141d4fa7b6866d8d173becc788812b06d21f7115ecd1654
Instruction Fuzzy Hash: 9611C272B212159BDB10EB75AC4866E7EA5EF48620F140429E909D3381EA34C901C791

Uniqueness

Uniqueness Score: -1.00%

Function 05201498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21965307739a974627bd3c4851b2c7bdfa1aad884e5fab7d5b685c85d9d74314
Instruction ID: 81a9dbaea7f57fa4cad07a0a3fb2eb09cd67ed88ca073f3c78d5129e1272fb54
Opcode Fuzzy Hash: 21965307739a974627bd3c4851b2c7bdfa1aad884e5fab7d5b685c85d9d74314
Instruction Fuzzy Hash: EF015E31A122158BCB21EFB888982AD7AB5BF48210B151479D80AEB282EB35D951CB91

Uniqueness

Uniqueness Score: -1.00%

Function 052080E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22d9fe90473f1a049b0818d7ab4b2f89e6616912e9819152d4b57991d27c06c
Instruction ID: 4ef451d375b67de6e768cf71827ead29ae31ed9d3019c3451c0fe8f70a93faa6
Opcode Fuzzy Hash: e22d9fe90473f1a049b0818d7ab4b2f89e6616912e9819152d4b57991d27c06c
Instruction Fuzzy Hash: D9014F349202599FDB0AFBB4F984A9C7BB5EF40304F409279C408D7256EB356E09C791

Uniqueness

Uniqueness Score: -1.00%

Function 05201524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2b6d5132848475ca818de622dfebff3c5528a84ed97a3c4ca118a322eab6a9
Instruction ID: 848ac81e0b44b8d839d9b77b5b4a7c2b2daeabffdb0f9bcd2ddff8fcfd44873f
Opcode Fuzzy Hash: bd2b6d5132848475ca818de622dfebff3c5528a84ed97a3c4ca118a322eab6a9
Instruction Fuzzy Hash: 5DF0F632A261508BD722CBA48C982AC7FA1FE58321B5920D7C806DF2D2D765D512C751

Uniqueness

Uniqueness Score: -1.00%

Function 05207088 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8d0106ca1e29a929a852e7f138aa85452005ee82555da106a484c0936ce89c
Instruction ID: 56b152eca5aa98377753342ba7e77a0ae89b664a96da5c0b378a0316b86ad944
Opcode Fuzzy Hash: 1d8d0106ca1e29a929a852e7f138aa85452005ee82555da106a484c0936ce89c
Instruction Fuzzy Hash: 69F01435B102088FCB14EB64E5A8B6C77B2FF88215F1440A8E50ADB3A0CF31AD42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 052080F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3232009327.0000000005200000.00000040.00000800.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5200000_Quotation - HDPE Fittings.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920259e17250ef8f9b881e7faf3483fcb5be0a6d5239bf054e8ff5356ec304e0
Instruction ID: 5766089d8c24333793d538a000a8d11613b4669b84823e1a51d2ba94922840a3
Opcode Fuzzy Hash: 920259e17250ef8f9b881e7faf3483fcb5be0a6d5239bf054e8ff5356ec304e0
Instruction Fuzzy Hash: 71F01D30A101199FCB09FFB4FA80A9D7BB9EF40208F508679C409DB259DB356E09CB81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation - HDPE Fittings.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation - HDPE Fittings.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Windows Analysis Report
Quotation - HDPE Fittings.exe

Function 07E35F04 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 07E35F10 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0308B320 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 0308590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 030844D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 07E35C81 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 07E35C88 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 07E356B0 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 0308D7F8 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre