Edit tour

Windows Analysis Report
KJKJJJECFI.exe

Overview

General Information

Sample name:	KJKJJJECFI.exe
Analysis ID:	1420081
MD5:	ce355f68f7fb9bcc5a1e140da2398489
SHA1:	917b5d290b3a0a28e092ccd53d6f9206223d9293
SHA256:	56fd2541a36680249ec670d07a5682d2ef5a343d1feccbcf2c3da86bd546af85
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected UAC Bypass using CMSTP

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

KJKJJJECFI.exe (PID: 380 cmdline: "C:\Users\user\Desktop\KJKJJJECFI.exe" MD5: CE355F68F7FB9BCC5A1E140DA2398489)

cmd.exe (PID: 892 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2792 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

Sendevsvc.exe (PID: 6048 cmdline: "C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe" MD5: CE355F68F7FB9BCC5A1E140DA2398489)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "pleasurecanbesafe.com/7vAficZogD/index.php", "Version": "4.18"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\qsbtcxh	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2254651788.0000000006040000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.2255985779.0000000002981000.00000020.00000001.01000000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: KJKJJJECFI.exe PID: 380	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: cmd.exe PID: 892	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 2792	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.KJKJJJECFI.exe.5c0f6ab.7.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.KJKJJJECFI.exe.5c0f6ab.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
6.2.explorer.exe.4cbac93.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.explorer.exe.4cbac93.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
6.2.explorer.exe.4cba093.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.explorer.exe.4cba093.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
2.2.cmd.exe.60400c8.7.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.KJKJJJECFI.exe.5bd3e7a.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.KJKJJJECFI.exe.5bd3e7a.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x594b9:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59745:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59544:$s1: CoGetObject 0x597d0:$s1: CoGetObject 0x5949d:$s2: Elevation:Administrator!new: 0x59729:$s2: Elevation:Administrator!new:
2.2.cmd.exe.56aec93.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.56aec93.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
2.2.cmd.exe.56ae093.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.56ae093.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1dc88:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1df14:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1dd13:$s1: CoGetObject 0x1df9f:$s1: CoGetObject 0x1dc6c:$s2: Elevation:Administrator!new: 0x1def8:$s2: Elevation:Administrator!new:
0.2.KJKJJJECFI.exe.5c102ab.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.KJKJJJECFI.exe.5c102ab.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x1d088:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d314:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1d113:$s1: CoGetObject 0x1d39f:$s1: CoGetObject 0x1d06c:$s2: Elevation:Administrator!new: 0x1d2f8:$s2: Elevation:Administrator!new:
2.2.cmd.exe.5672862.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.cmd.exe.5672862.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x594b9:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59745:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59544:$s1: CoGetObject 0x597d0:$s1: CoGetObject 0x5949d:$s2: Elevation:Administrator!new: 0x59729:$s2: Elevation:Administrator!new:
2.2.cmd.exe.60400c8.7.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorer.exe.4c7e862.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.explorer.exe.4c7e862.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x594b9:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59745:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x59544:$s1: CoGetObject 0x597d0:$s1: CoGetObject 0x5949d:$s2: Elevation:Administrator!new: 0x59729:$s2: Elevation:Administrator!new:
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 892, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 2792, ProcessName: explorer.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: pleasurecanbesafe.com/7vAficZogD/index.php

Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\qsbtcxh

Avira: detection malicious, Label: HEUR/AGEN.1319380

Found malware configuration

Source: 2.2.cmd.exe.60400c8.7.unpack

Malware Configuration Extractor: Amadey {"C2 url": "pleasurecanbesafe.com/7vAficZogD/index.php", "Version": "4.18"}

Multi AV Scanner detection for domain / URL

Source: pleasurecanbesafe.com/7vAficZogD/index.php

Virustotal: Detection: 18%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\qsbtcxh	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\qsbtcxh	Virustotal: Detection: 76%			Perma Link

Multi AV Scanner detection for submitted file

Source: KJKJJJECFI.exe	ReversingLabs: Detection: 87%
Source: KJKJJJECFI.exe	Virustotal: Detection: 68%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\qsbtcxh

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: pleasurecanbesafe.com
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: /7vAficZogD/index.php
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: S-%lu-
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: 40c3273379
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Dctooux.exe
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Startup
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: rundll32
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Programs
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: %USERPROFILE%
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: http://
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: https://
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: /Plugins/
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: &unit=
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: shell32.dll
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: kernel32.dll
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: GetNativeSystemInfo
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: ProgramData\
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: AVAST Software
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Kaspersky Lab
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Panda Security
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Doctor Web
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: 360TotalSecurity
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Bitdefender
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Norton
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Sophos
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Comodo
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: WinDefender
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: 0123456789
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: ------
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: ?scr=1
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: ComputerName
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: -unicode-
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: VideoID
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: DefaultSettings.XResolution
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: DefaultSettings.YResolution
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: ProductName
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: CurrentBuild
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: rundll32.exe
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: "taskkill /f /im "
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: " && timeout 1 && del
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: && Exit"
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: " && ren
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: Powershell.exe
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: shutdown -s -t 0
Source: 2.2.cmd.exe.60400c8.7.unpack	String decryptor: random

Source: KJKJJJECFI.exe, 00000000.00000002.1996673675.000000000126D000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_e2355f6c-3

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 0.2.KJKJJJECFI.exe.5c0f6ab.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorer.exe.4cbac93.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorer.exe.4cba093.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KJKJJJECFI.exe.5bd3e7a.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.56aec93.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.56ae093.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.KJKJJJECFI.exe.5c102ab.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.5672862.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorer.exe.4c7e862.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KJKJJJECFI.exe PID: 380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2792, type: MEMORYSTR

Source: KJKJJJECFI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 155.101.98.133:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: KJKJJJECFI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\ex_data.c source: KJKJJJECFI.exe
Source:	Binary string: CareUEyes.pdb source: KJKJJJECFI.exe
Source:	Binary string: wntdll.pdbUGP source: KJKJJJECFI.exe, 00000000.00000002.1999017093.0000000005CA9000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999157020.0000000006000000.00000004.00000800.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999318510.00000000063C4000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254063422.00000000052C6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254267571.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256396897.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256202347.00000000048C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: KJKJJJECFI.exe
Source:	Binary string: wntdll.pdb source: KJKJJJECFI.exe, 00000000.00000002.1999017093.0000000005CA9000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999157020.0000000006000000.00000004.00000800.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999318510.00000000063C4000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254063422.00000000052C6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254267571.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256396897.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256202347.00000000048C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CareUEyes.pdb&a source: KJKJJJECFI.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: pleasurecanbesafe.com/7vAficZogD/index.php

Source: Joe Sandbox View

IP Address: 155.101.98.133 155.101.98.133

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /docs/info/regex_1.html HTTP/1.1User-Agent: howHost: www.math.utah.edu

Source: unknown

DNS traffic detected: queries for: www.math.utah.edu

Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: KJKJJJECFI.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: KJKJJJECFI.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: KJKJJJECFI.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: KJKJJJECFI.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: KJKJJJECFI.exe	String found in binary or memory: http://care-eyes.com/careueyes/v1/analyzer/tj.html?uuid=%s&tm=%I64d&ver=%s&it=%s&reg=%dhttp://care-e
Source: KJKJJJECFI.exe	String found in binary or memory: http://care-eyes.com/careueyes/v1/config/switch.datenablehttp://care-eyes.com/careueyes/v1/config/sw
Source: KJKJJJECFI.exe	String found in binary or memory: http://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eye
Source: KJKJJJECFI.exe	String found in binary or memory: http://care-eyes.com/careueyes/v1/pay/query_license.php&method=leftcodesubscriptionend
Source: KJKJJJECFI.exe	String found in binary or memory: http://care-eyes.com/invite/query_rewards.phpid=http://care-eyes.com/invite.html?inv=%s/RtlGetNtVers
Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.d
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: KJKJJJECFI.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: KJKJJJECFI.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: KJKJJJECFI.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: KJKJJJECFI.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicer
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: KJKJJJECFI.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: KJKJJJECFI.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: KJKJJJECFI.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: KJKJJJECFI.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: KJKJJJECFI.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: KJKJJJECFI.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: KJKJJJECFI.exe	String found in binary or memory: http://s.symcd.com06
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: KJKJJJECFI.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: KJKJJJECFI.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: KJKJJJECFI.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: KJKJJJECFI.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005B77000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.0000000005623000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: KJKJJJECFI.exe	String found in binary or memory: https://api.myip.la/en?jsonhttp://ip-api.com/jsonhttps://ipv4.ip.nf/me.jsonhttps://freegeoip.app/jso
Source: KJKJJJECFI.exe	String found in binary or memory: https://bit.ly/3feVIiY
Source: Sendevsvc.exe, 00000007.00000003.2228548837.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, Sendevsvc.exe, 00000007.00000003.2228163024.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3feVIiYUEyes
Source: KJKJJJECFI.exe, 00000000.00000003.1976607989.0000000001A10000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1997071563.0000000001A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bit.ly/3feVIiYfinder
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/buy.html?uuid=%s&tm=%I64d&ver=%s&it=%sd
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/how-to-use-magicx-feature/%.2fs$
Source: KJKJJJECFI.exe, 00000000.00000002.1996673675.000000000126D000.00000002.00000001.01000000.00000003.sdmp, KJKJJJECFI.exe, 00000000.00000000.1973658720.000000000126D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://care-eyes.com/how-to-use-magicx-feature/%.2fs$8
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/how-to-use-sunrise-sunset-feature/openslider_orange_progressslider_orange_bart
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/license-reset.html
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com/what-is-pomodoro-technique/
Source: KJKJJJECFI.exe	String found in binary or memory: https://care-eyes.com?about
Source: KJKJJJECFI.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.co
Source: KJKJJJECFI.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: KJKJJJECFI.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: KJKJJJECFI.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/
Source: KJKJJJECFI.exe	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.html
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.html/
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.html0
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.htmlU
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.htmlws
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.math.utah.edu/docs/info/regex_1.htmly

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 155.101.98.133:443 -> 192.168.2.5:49707 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.KJKJJJECFI.exe.5c0f6ab.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.explorer.exe.4cbac93.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.explorer.exe.4cba093.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.KJKJJJECFI.exe.5bd3e7a.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.56aec93.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.56ae093.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.KJKJJJECFI.exe.5c102ab.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.cmd.exe.5672862.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.explorer.exe.4c7e862.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: KJKJJJECFI.exe

Static PE information: invalid certificate

Source: KJKJJJECFI.exe, 00000000.00000002.1999157020.000000000612D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe, 00000000.00000002.1999318510.00000000064E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe, 00000000.00000002.1996673675.000000000126D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: kernel32SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICMSoftware\Microsoft\Windows\CurrentVersion\RunGdiICMGammaRangeSOFTWARE\DisplayLink\Core /trayEnableGammaRamptrue"%s" %shttp://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eyes.com/careueyes/v1/main/report.php?uuid=%s&tm=%I64d&ver=%s&ty=%d&sty=%d&it=%s&channel=%d&active=%d&os=%d&build=%d&gamma_dc=%d&gamma_ddraw=%d&adv_api=%dSoftware\Google\Chrome\NativeMessagingHosts\com.careueyes.dimmercontent=%s&mail=%s&os=%d&build=%dhttps://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd\VarFileInfo\TranslationCompanyName\StringFileInfo\%04X%04X\FileVersionFileDescriptionLegalCopyrightInternalNameProductNameOriginalFileNameCommentsProductVersionPrivateBuildLegalTrademarksSpecialBuild vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe, 00000000.00000002.1998361646.0000000005422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Ekernel32SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICMSoftware\Microsoft\Windows\CurrentVersion\RunGdiICMGammaRangeSOFTWARE\DisplayLink\Core /trayEnableGammaRamptrue"%s" %shttp://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eyes.com/careueyes/v1/main/report.php?uuid=%s&tm=%I64d&ver=%s&ty=%d&sty=%d&it=%s&channel=%d&active=%d&os=%d&build=%d&gamma_dc=%d&gamma_ddraw=%d&adv_api=%dSoftware\Google\Chrome\NativeMessagingHosts\com.careueyes.dimmercontent=%s&mail=%s&os=%d&build=%dhttps://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd\VarFileInfo\TranslationCompanyName\StringFileInfo\%04X%04X\FileVersionFileDescriptionLegalCopyrightInternalNameProductNameOriginalFileNameCommentsProductVersionPrivateBuildLegalTrademarksSpecialBuild vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe, 00000000.00000000.1973658720.000000000126D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: kernel32SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICMSoftware\Microsoft\Windows\CurrentVersion\RunGdiICMGammaRangeSOFTWARE\DisplayLink\Core /trayEnableGammaRamptrue"%s" %shttp://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eyes.com/careueyes/v1/main/report.php?uuid=%s&tm=%I64d&ver=%s&ty=%d&sty=%d&it=%s&channel=%d&active=%d&os=%d&build=%d&gamma_dc=%d&gamma_ddraw=%d&adv_api=%dSoftware\Google\Chrome\NativeMessagingHosts\com.careueyes.dimmercontent=%s&mail=%s&os=%d&build=%dhttps://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd\VarFileInfo\TranslationCompanyName\StringFileInfo\%04X%04X\FileVersionFileDescriptionLegalCopyrightInternalNameProductNameOriginalFileNameCommentsProductVersionPrivateBuildLegalTrademarksSpecialBuild vs KJKJJJECFI.exe
Source: KJKJJJECFI.exe	Binary or memory string: Ekernel32SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICMSoftware\Microsoft\Windows\CurrentVersion\RunGdiICMGammaRangeSOFTWARE\DisplayLink\Core /trayEnableGammaRamptrue"%s" %shttp://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eyes.com/careueyes/v1/main/report.php?uuid=%s&tm=%I64d&ver=%s&ty=%d&sty=%d&it=%s&channel=%d&active=%d&os=%d&build=%d&gamma_dc=%d&gamma_ddraw=%d&adv_api=%dSoftware\Google\Chrome\NativeMessagingHosts\com.careueyes.dimmercontent=%s&mail=%s&os=%d&build=%dhttps://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd\VarFileInfo\TranslationCompanyName\StringFileInfo\%04X%04X\FileVersionFileDescriptionLegalCopyrightInternalNameProductNameOriginalFileNameCommentsProductVersionPrivateBuildLegalTrademarksSpecialBuild vs KJKJJJECFI.exe

Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: nvapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe	Section loaded: profapi.dll	Jump to behavior

Source: KJKJJJECFI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.KJKJJJECFI.exe.5c0f6ab.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.explorer.exe.4cbac93.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.explorer.exe.4cba093.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.KJKJJJECFI.exe.5bd3e7a.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.56aec93.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.56ae093.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.KJKJJJECFI.exe.5c102ab.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.cmd.exe.5672862.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.explorer.exe.4c7e862.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@7/4@1/1

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

File created: C:\Users\user\AppData\Roaming\careueyes

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

File created: C:\Users\user\AppData\Local\Temp\4476cd9c

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: KJKJJJECFI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KJKJJJECFI.exe	ReversingLabs: Detection: 87%
Source: KJKJJJECFI.exe	Virustotal: Detection: 68%

Source: KJKJJJECFI.exe	String found in binary or memory: id-cmc-addExtensions
Source: KJKJJJECFI.exe	String found in binary or memory: set-addPolicy

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

File read: C:\Users\user\Desktop\KJKJJJECFI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\KJKJJJECFI.exe "C:\Users\user\Desktop\KJKJJJECFI.exe"
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe "C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe"
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: ivls.2.dr

LNK file: ..\..\Roaming\NBFoundation\Sendevsvc.exe

Source: KJKJJJECFI.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: KJKJJJECFI.exe

Static file information: File size 6699592 > 1048576

Source: KJKJJJECFI.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x37b800
Source: KJKJJJECFI.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x137600
Source: KJKJJJECFI.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x163600

Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: KJKJJJECFI.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: KJKJJJECFI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: KJKJJJECFI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASMcrypto\ex_data.c source: KJKJJJECFI.exe
Source:	Binary string: CareUEyes.pdb source: KJKJJJECFI.exe
Source:	Binary string: wntdll.pdbUGP source: KJKJJJECFI.exe, 00000000.00000002.1999017093.0000000005CA9000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999157020.0000000006000000.00000004.00000800.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999318510.00000000063C4000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254063422.00000000052C6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254267571.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256396897.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256202347.00000000048C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAESNI_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPOLY1305_ASM source: KJKJJJECFI.exe
Source:	Binary string: wntdll.pdb source: KJKJJJECFI.exe, 00000000.00000002.1999017093.0000000005CA9000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999157020.0000000006000000.00000004.00000800.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1999318510.00000000063C4000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254063422.00000000052C6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254267571.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256396897.0000000004D50000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256202347.00000000048C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CareUEyes.pdb&a source: KJKJJJECFI.exe

Source: qsbtcxh.2.dr	Static PE information: real checksum: 0x0 should be: 0x6e9ad
Source: KJKJJJECFI.exe	Static PE information: real checksum: 0x3dab6c should be: 0x66661f

Source: qsbtcxh.2.dr

Static PE information: section name: lxp

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\qsbtcxh

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\qsbtcxh

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\QSBTCXH

Source: C:\Windows\SysWOW64\cmd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\qsbtcxh

Jump to dropped file

Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Qvmware
Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1997071563.0000000001A8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\KJKJJJECFI.exe	NtSetInformationThread: Direct from: 0x10F1A4F			Jump to behavior
Source: C:\Users\user\Desktop\KJKJJJECFI.exe	NtQuerySystemInformation: Direct from: 0x5A9D020			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2792 base: 5179C0 value: 55			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 2792 base: 2980000 value: 00			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 5179C0			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2980000			Jump to behavior

Source: C:\Users\user\Desktop\KJKJJJECFI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: KJKJJJECFI.exe	Binary or memory string: Eskin_slide_select_btnskin_slide_btn%sLight: %02d:%02dDark user32.dllShell_TrayWndShell_SecondaryTrayWndcomboboxl
Source: KJKJJJECFI.exe, 00000000.00000002.1996673675.000000000126D000.00000002.00000001.01000000.00000003.sdmp, KJKJJJECFI.exe, 00000000.00000000.1973658720.000000000126D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: skin_slide_select_btnskin_slide_btn%sLight: %02d:%02dDark user32.dllShell_TrayWndShell_SecondaryTrayWndcomboboxl
Source: Sendevsvc.exe, 00000007.00000000.2222647313.000000000074D000.00000002.00000001.01000000.0000000C.sdmp, Sendevsvc.exe, 00000007.00000002.2229766624.000000000074D000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Bskin_slide_select_btnskin_slide_btn%sLight: %02d:%02dDark user32.dllShell_TrayWndShell_SecondaryTrayWndcomboboxl

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\KJKJJJECFI.exe

Code function: 0_2_01047996 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_01047996

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.cmd.exe.60400c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.cmd.exe.60400c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2254651788.0000000006040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2255985779.0000000002981000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\qsbtcxh, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	11 DLL Side-Loading	312 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	312 Process Injection	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
KJKJJJECFI.exe	88%	ReversingLabs	Win32.Spyware.Lummastealer
KJKJJJECFI.exe	68%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\qsbtcxh	100%	Avira	HEUR/AGEN.1319380
C:\Users\user\AppData\Local\Temp\qsbtcxh	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\qsbtcxh	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\qsbtcxh	76%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://c0rl.m	0%	URL Reputation	safe
https://care-eyes.com/what-is-pomodoro-technique/	0%	Avira URL Cloud	safe
http://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eye	0%	Avira URL Cloud	safe
https://care-eyes.com?about	0%	Avira URL Cloud	safe
http://care-eyes.com/careueyes/v1/config/switch.datenablehttp://care-eyes.com/careueyes/v1/config/sw	0%	Avira URL Cloud	safe
http://care-eyes.com/careueyes/v1/pay/query_license.php&method=leftcodesubscriptionend	0%	Avira URL Cloud	safe
pleasurecanbesafe.com/7vAficZogD/index.php	100%	Avira URL Cloud	phishing
http://care-eyes.com/careueyes/v1/pay/query_license.php&method=leftcodesubscriptionend	0%	Virustotal		Browse
http://crl4.digicer	0%	Avira URL Cloud	safe
http://care-eyes.com/careueyes/v1/config/switch.datenablehttp://care-eyes.com/careueyes/v1/config/sw	1%	Virustotal		Browse
https://care-eyes.com?about	1%	Virustotal		Browse
https://d.symcb.co	0%	Avira URL Cloud	safe
http://care-eyes.com/invite/query_rewards.phpid=http://care-eyes.com/invite.html?inv=%s/RtlGetNtVers	0%	Avira URL Cloud	safe
https://care-eyes.com/how-to-use-magicx-feature/%.2fs$8	0%	Avira URL Cloud	safe
https://care-eyes.com/buy.html?uuid=%s&tm=%I64d&ver=%s&it=%sd	0%	Avira URL Cloud	safe
http://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eye	1%	Virustotal		Browse
https://care-eyes.com/license-reset.html	0%	Avira URL Cloud	safe
https://d.symcb.co	0%	Virustotal		Browse
https://api.myip.la/en?jsonhttp://ip-api.com/jsonhttps://ipv4.ip.nf/me.jsonhttps://freegeoip.app/jso	0%	Avira URL Cloud	safe
https://care-eyes.com/how-to-use-sunrise-sunset-feature/openslider_orange_progressslider_orange_bart	0%	Avira URL Cloud	safe
https://care-eyes.com/buy.html?uuid=%s&tm=%I64d&ver=%s&it=%sd	1%	Virustotal		Browse
http://care-eyes.com/careueyes/v1/analyzer/tj.html?uuid=%s&tm=%I64d&ver=%s&it=%s&reg=%dhttp://care-e	0%	Avira URL Cloud	safe
pleasurecanbesafe.com/7vAficZogD/index.php	18%	Virustotal		Browse
https://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd	0%	Avira URL Cloud	safe
https://care-eyes.com/license-reset.html	0%	Virustotal		Browse
https://api.myip.la/en?jsonhttp://ip-api.com/jsonhttps://ipv4.ip.nf/me.jsonhttps://freegeoip.app/jso	0%	Virustotal		Browse
http://crl3.d	0%	Avira URL Cloud	safe
https://care-eyes.com/how-to-use-magicx-feature/%.2fs$	0%	Avira URL Cloud	safe
http://care-eyes.com/invite/query_rewards.phpid=http://care-eyes.com/invite.html?inv=%s/RtlGetNtVers	0%	Virustotal		Browse
https://care-eyes.com/what-is-pomodoro-technique/	1%	Virustotal		Browse
https://care-eyes.com/how-to-use-sunrise-sunset-feature/openslider_orange_progressslider_orange_bart	0%	Virustotal		Browse
https://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd	1%	Virustotal		Browse
https://care-eyes.com/how-to-use-magicx-feature/%.2fs$	1%	Virustotal		Browse
http://care-eyes.com/careueyes/v1/analyzer/tj.html?uuid=%s&tm=%I64d&ver=%s&it=%s&reg=%dhttp://care-e	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.math.utah.edu	155.101.98.133	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pleasurecanbesafe.com/7vAficZogD/index.php	true	18%, Virustotal, Browse Avira URL Cloud: phishing	low
https://www.math.utah.edu/docs/info/regex_1.html	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.math.utah.edu/docs/info/regex_1.html/	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.math.utah.edu/docs/info/regex_1.html0	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://care-eyes.com/careueyes/v1/pay/query_license.php&method=leftcodesubscriptionend	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://care-eyes.com/careueyes/v1/config/switch.datenablehttp://care-eyes.com/careueyes/v1/config/sw	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://care-eyes.com/careueyes/v1/main/feedback_msg.php?uuid=%s&tm=%I64d&ver=%s&it=%shttp://care-eye	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://care-eyes.com/what-is-pomodoro-technique/	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.math.utah.edu/docs/info/regex_1.htmly	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.vmware.com/0/	KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://care-eyes.com?about	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bit.ly/3feVIiYfinder	KJKJJJECFI.exe, 00000000.00000003.1976607989.0000000001A10000.00000004.00000020.00020000.00000000.sdmp, KJKJJJECFI.exe, 00000000.00000002.1997071563.0000000001A07000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.math.utah.edu/docs/info/regex_1.htmlws	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl4.digicer	KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://d.symcb.co	KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://c0rl.m	KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	KJKJJJECFI.exe	false		high
http://care-eyes.com/invite/query_rewards.phpid=http://care-eyes.com/invite.html?inv=%s/RtlGetNtVers	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://care-eyes.com/how-to-use-magicx-feature/%.2fs$8	KJKJJJECFI.exe, 00000000.00000002.1996673675.000000000126D000.00000002.00000001.01000000.00000003.sdmp, KJKJJJECFI.exe, 00000000.00000000.1973658720.000000000126D000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://care-eyes.com/buy.html?uuid=%s&tm=%I64d&ver=%s&it=%sd	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bit.ly/3feVIiY	KJKJJJECFI.exe	false		high
https://bit.ly/3feVIiYUEyes	Sendevsvc.exe, 00000007.00000003.2228548837.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, Sendevsvc.exe, 00000007.00000003.2228163024.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.math.utah.edu/docs/info/regex_1.htmlU	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://care-eyes.com/license-reset.html	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.myip.la/en?jsonhttp://ip-api.com/jsonhttps://ipv4.ip.nf/me.jsonhttps://freegeoip.app/jso	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	KJKJJJECFI.exe, 00000000.00000002.1998916468.0000000005B77000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.2254182536.0000000005623000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000006.00000002.2256315034.0000000004C2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://care-eyes.com/how-to-use-sunrise-sunset-feature/openslider_orange_progressslider_orange_bart	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.math.utah.edu/	KJKJJJECFI.exe, 00000000.00000002.1997650869.000000000477C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://care-eyes.com/careueyes/v1/analyzer/tj.html?uuid=%s&tm=%I64d&ver=%s&it=%s&reg=%dhttp://care-e	KJKJJJECFI.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://care-eyes.com/uninstall.htmlcom.careueyes.dimmer.json%s?activate=%dchannelconfig.datupd	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl3.d	KJKJJJECFI.exe, 00000000.00000002.1998842076.0000000005A9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://care-eyes.com/how-to-use-magicx-feature/%.2fs$	KJKJJJECFI.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
155.101.98.133	www.math.utah.edu	United States		17055	UTAHUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1420081
Start date and time:	2024-04-04 12:36:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KJKJJJECFI.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@7/4@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target KJKJJJECFI.exe, PID 380 because there are no executed function
Execution Graph export aborted for target Sendevsvc.exe, PID 6048 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:36:55	API Interceptor	1x Sleep call for process: KJKJJJECFI.exe modified
12:37:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sendevsvc.lnk
12:37:11	API Interceptor	2x Sleep call for process: cmd.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
155.101.98.133	CocFAer8MC.exe	Get hash	malicious	Unknown	Browse
	vGPoWZM3lZ.exe	Get hash	malicious	Amadey	Browse
	SecuriteInfo.com.Trojan.Win32.Penguish.aqk.2138.32152.exe	Get hash	malicious	AsyncRAT	Browse
	SecuriteInfo.com.Win64.Malware-gen.6815.27736.exe	Get hash	malicious	AsyncRAT	Browse
	7VAFdANAsr.exe	Get hash	malicious	Unknown	Browse
	7VAFdANAsr.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.math.utah.edu	CocFAer8MC.exe	Get hash	malicious	Unknown	Browse	155.101.98.133
	vGPoWZM3lZ.exe	Get hash	malicious	Amadey	Browse	155.101.98.133
	SecuriteInfo.com.Trojan.Win32.Penguish.aqk.2138.32152.exe	Get hash	malicious	AsyncRAT	Browse	155.101.98.133
	SecuriteInfo.com.Win64.Malware-gen.6815.27736.exe	Get hash	malicious	AsyncRAT	Browse	155.101.98.133
	7VAFdANAsr.exe	Get hash	malicious	Unknown	Browse	155.101.98.133
	7VAFdANAsr.exe	Get hash	malicious	Unknown	Browse	155.101.98.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTAHUS	FewiVGKGLr.elf	Get hash	malicious	Mirai, Gafgyt	Browse	155.101.54.113
	nTDlOKAKOW.elf	Get hash	malicious	Unknown	Browse	128.110.228.100
	CocFAer8MC.exe	Get hash	malicious	Unknown	Browse	155.101.98.133
	kt46zhUGCl.elf	Get hash	malicious	Mirai	Browse	155.97.31.14
	pERaPMaznu.elf	Get hash	malicious	Mirai	Browse	155.101.143.110
	f6JaV6F9NN.elf	Get hash	malicious	Mirai	Browse	155.103.234.200
	vGPoWZM3lZ.exe	Get hash	malicious	Amadey	Browse	155.101.98.133
	pUQL9ZI8ks.elf	Get hash	malicious	Mirai	Browse	74.82.45.122
	SecuriteInfo.com.Trojan.Win32.Penguish.aqk.2138.32152.exe	Get hash	malicious	AsyncRAT	Browse	155.101.98.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	WAhYftpepO.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	155.101.98.133
	file.exe	Get hash	malicious	Unknown	Browse	155.101.98.133
	Purchasing_49427020424_8568658.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	155.101.98.133
	03-04024 AQQ -T7630-CVE84 7281 Rieckermann.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	155.101.98.133
	UNLP-9004898-Oferta#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	155.101.98.133
	SCO 2024.PDF.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	155.101.98.133
	Order inquiry.vbs	Get hash	malicious	Remcos	Browse	155.101.98.133
	U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	155.101.98.133
	New Wage Structure pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	155.101.98.133
	RFQ20240403_Commerical_List_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	155.101.98.133

Process:	C:\Users\user\Desktop\KJKJJJECFI.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	27645
Entropy (8bit):	5.154952528259852
Encrypted:	false
SSDEEP:	384:uvVzoGQocsTVqly+F3kfbmg6OtGCqUx/BRvNy4Ifq93HE/N4GjDgbJwefnmccFsx:uv5ojDaE50mupBx3vNfKa2DgbJz1MsuG
MD5:	3BCAC0C44DB080CE09E54DA0902D215B
SHA1:	63FD5AA932400DB98514798180CB3AFB9039F622
SHA-256:	E2BDD382B97FE8630663685ADC8C718E67C405B4D66AC54F9FA5BA5DC04A8D07
SHA-512:	DD3D302DB6846CBD3611C94A1D48B0F57217EA7B154FBA29421135E72AFBFF155054FDF5D0F6DEE4AF1BEF77BAEBF77A21B717E873D474B7231CE58123D63000
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">.<HTML>.<HEAD>. This HTML file has been created by texi2html 1.45. from /home/share/emacs-18.58/man/regex.texinfo on 8 March 1996 -->..<TITLE>Untitled Document - regex regular expression matching library.</TITLE>.</HEAD>.<BODY>.Go to the first, previous, next, last section, <A HREF="regex_toc.html">table of contents</A>..<HR>...<H1><A NAME="SEC1" HREF="regex_toc.html#SEC1"><STRONG>regex</STRONG> regular expression matching library.</A></H1>....<H2><A NAME="SEC2" HREF="regex_toc.html#SEC2">Overview</A></H2>..<P>.Regular expression matching allows you to test whether a string fits.into a specific syntactic shape. You can also search a string for a.substring that fits a pattern...</P>.<P>.A regular expression describes a set of strings. The simplest case is.one that describes a particular string; for example, the string <SAMP>`foo'</SAMP>.when regarded as a regular expression matches <SAMP>`foo'</SAMP> and nothing else..Nontrivial re

C:\Users\user\AppData\Local\Temp\4476cd9c

Download File

Process:	C:\Users\user\Desktop\KJKJJJECFI.exe
File Type:	data
Category:	dropped
Size (bytes):	1124138
Entropy (8bit):	7.621968104191185
Encrypted:	false
SSDEEP:	24576:qJEj1Ac2DN95fgVDOoUWlpUzNT6W6TZHXAQqSzH2JVkDC1zfMWXwNh1:qKjWc2D35fgVDOoBlpUBTbQZHXAQqSDh
MD5:	04AFEC2C99CD93234E4FF565A7D19794
SHA1:	61321775F904DB8AC0B19ABF3EBF84D4D84BC9DD
SHA-256:	C563247275EEEC2A8C9C6A486AED1858B2FA5FED674C4EE3E171D138B66BEAC8
SHA-512:	525B58B15897EAF13F57706EA8DC4837DC93E58EC8DD1E59E5BF2DDAAB832C4E68E022761625D2166BEC28BAEF070F4E98B9D4A6B9C037247D4EA1DCDC207048
Malicious:	false
Reputation:	low
Preview:	.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ivls

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 13:16:50 2023, mtime=Thu Apr 4 09:36:55 2024, atime=Thu Apr 4 09:36:52 2024, length=6699592, window=hide
Category:	dropped
Size (bytes):	912
Entropy (8bit):	5.076432546061586
Encrypted:	false
SSDEEP:	12:8T2IKe4f8Ed88CTlsY//6dL6/raCslnUQd8SKmr4AjAbnHXYLJg+0hpmV:8T2ff8EO8IZSpvWQAML63pm
MD5:	AEB050D811A6A888EA7862E28F0A744E
SHA1:	D6D2C44432BD89C62634F991ED5A8890B7A6EBBB
SHA-256:	8C829AD064618C8AB75F11130A027A28B179327335897EF07DF2E47245F0DED3
SHA-512:	FDB8E1F9363CA88892FDD3CA56FCA0051154C7800CCC5E56FA59D21FC33B97FCB5D43DD633411861F1B1EADE366BD80D6ED54C608BA5C916B5343617E74032E4
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....j........\|...G...\|...H:f.......................:..DG..Yr?.D..U..k0.&...&...... M......~..{...!h..\|.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X.T....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......X.T..Roaming.@......DWSl.X.T....C.......................).R.o.a.m.i.n.g.....b.1......X.T..NBFOUN~1..J......X.T.X.T....l.....................ij..N.B.F.o.u.n.d.a.t.i.o.n.....h.2.H:f..X.T .SENDEV~1.EXE..L......DW.r.X.T....x......................1..S.e.n.d.e.v.s.v.c...e.x.e.......i...............-.......h.............q.....C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe..(.....\.....\.R.o.a.m.i.n.g.\.N.B.F.o.u.n.d.a.t.i.o.n.\.S.e.n.d.e.v.s.v.c...e.x.e.`.......X.......715575...........hT..CrF.f4... .!.2=.b...,...W..hT..CrF.f4... .!.2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\qsbtcxh

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	429568
Entropy (8bit):	6.513117480954766
Encrypted:	false
SSDEEP:	12288:xIp0oG34tODC5TPCZzynB/qupORs7HwNI:I0V34tOCV6yVyI
MD5:	3E36745728E1302C0DD36455A818DA59
SHA1:	83207703EE94B56A583D676FD281A1078832798C
SHA-256:	8B224791DCD7DD8337A5115B432E1B847F6D5D418BADB39BC0F50C19981C9D9A
SHA-512:	384817845E81CC864C7488CF06E9CF1C5F81262D4474A7DD5A8C4E92F7A1D7EA1162ED9092383107291B9870FD986CE099349FA9B819FF730203712EA9310908
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\qsbtcxh, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 76%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L......Y..........................................@.......................................@.................................L........`.......................p...K..0...8...........................h...@............................................text............................... ..`.rdata..............................@..@.data....E.......2..................@....rsrc........`.......0..............@..@.reloc...K...p...L...2..............@..Blxp..................~..............@...........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.02894012544124
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KJKJJJECFI.exe
File size:	6'699'592 bytes
MD5:	ce355f68f7fb9bcc5a1e140da2398489
SHA1:	917b5d290b3a0a28e092ccd53d6f9206223d9293
SHA256:	56fd2541a36680249ec670d07a5682d2ef5a343d1feccbcf2c3da86bd546af85
SHA512:	69e19e29b0d72b444288d6f575cb0b65066495c609ecb4a476b929837299f54cedf1704475928d8683e17aedb74a5af993a84ea3c2f2e75af1cc2e48c4f87637
SSDEEP:	196608:6BBgUSIC1sbmHSZ9S8OqHRKrxQe5Ajz+T0:6BBgUSIC1sbWSZ9BzxExQ/z+T0
TLSH:	8A66BF02F9D18471E1630231356DB7AAADBDA9618B31D5CFB78C162E8F309C19B37B91
File Content Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$..........`..a3..a3..a3)R.3..a3)R.3P.a3)R.3..a3...3..a3..e2..a3..b2..a3<.e2..a3..d2..a3...3..a3...3..a3..a3..a3..e2..a3..k3..a3...3..a

File Icon


Icon Hash:	499669d8d82916a8

Static PE Info

General

Entrypoint:	0x556cb4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65703BBA [Wed Dec 6 09:15:38 2023 UTC]
TLS Callbacks:	0x70518c
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	101a1ec978d0316fc91f9ad0f1533e6b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/12/2021 01:00:00 09/01/2025 00:59:59
Subject Chain	CN=philandro Software GmbH, O=philandro Software GmbH, L=Stuttgart, S=Baden-W\xfcrttemberg, C=DE
Version:	3
Thumbprint MD5:	EAE713DFC05244CF4301BF1C9F68B1BE
Thumbprint SHA-1:	9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE
Thumbprint SHA-256:	9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF
Serial:	0DBF152DEAF0B981A8A938D53F769DB8

Entrypoint Preview

Instruction
call 00007F32A07D931Fh
jmp 00007F32A07D846Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F32A07D7AF3h
jmp 00007F32A07D85D2h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F32A07D7AE4h
jmp 00007F32A07D85C3h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B58E8h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B58E8h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B58E8h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[ C ] VS98 (6.0) SP6 build 8804
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b1400	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e5000	0x163444	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x65f400	0x4648	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x649000	0x331d6
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4774d0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x477540	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x397bd8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x37d000	0x908	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4b139c	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37b7f3	0x37b800	f4cff882e51783311699ec8eac1a9885	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37d000	0x137408	0x137600	a553269feef5c20192e3ac241e8b003f	False	0.3314800469189081	data	5.05991244260527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4b5000	0x2f9a4	0x15a00	a098909401b0880bba6cc5f95248ed55	False	0.21347769147398843	data	5.132238992675893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4e5000	0x163444	0x163600	4bb24fe2e41d22f3596255ece9cc16cd	False	0.6922746108863876	data	7.6192929340838305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x649000	0x33134	0x33200	516ef0ba9663e1f2219d5ecaf18d414f	False	0.498476658007335	GLS_BINARY_LSB_FIRST	6.547441120857822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BAO	0x4e8378	0xd6dde	PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced	English	United States	0.9607394210163914
IMG	0x5bf158	0x584	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7889518413597734
IMG	0x5bf6dc	0x72	PNG image data, 4 x 4, 8-bit/color RGB, non-interlaced	Chinese	China	0.9912280701754386
IMG	0x5bf750	0x2c5	PNG image data, 112 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0155148095909732
IMG	0x5bfa18	0x67	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9805825242718447
IMG	0x5bfa80	0x52b	PNG image data, 42 x 60, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7898715041572184
IMG	0x5bffac	0x114	PNG image data, 8 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0181159420289856
IMG	0x5c00c0	0x2f2	PNG image data, 96 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0145888594164456
IMG	0x5c03b4	0x80d	PNG image data, 21 x 21, 8-bit/color RGBA, non-interlaced	Chinese	China	0.881125667151868
IMG	0x5c0bc4	0x191	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	1.027431421446384
IMG	0x5c0d58	0x5e5	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8210735586481114
IMG	0x5c1340	0x235	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0194690265486726
IMG	0x5c1578	0x191	PNG image data, 18 x 18, 8-bit colormap, non-interlaced	Chinese	China	1.027431421446384
IMG	0x5c170c	0x5b4	PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8136986301369863
IMG	0x5c1cc0	0x533	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0082644628099173
IMG	0x5c21f4	0x1ac	PNG image data, 54 x 10, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0257009345794392
IMG	0x5c23a0	0x14c	PNG image data, 20 x 20, 8-bit colormap, non-interlaced	Chinese	China	0.7891566265060241
IMG	0x5c24ec	0x1a5	PNG image data, 96 x 32, 8-bit/color RGB, non-interlaced	Chinese	China	1.0261282660332542
IMG	0x5c2694	0x1a2	PNG image data, 20 x 20, 8-bit colormap, non-interlaced	Chinese	China	0.7655502392344498
IMG	0x5c2838	0x230	PNG image data, 44 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.019642857142857
IMG	0x5c2a68	0x4df	PNG image data, 112 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.008821170809944
IMG	0x5c2f48	0x8ba	PNG image data, 112 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.004923903312444
IMG	0x5c3804	0x404	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0107003891050583
IMG	0x5c3c08	0x50d	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.008507347254447
IMG	0x5c4118	0x49a	PNG image data, 160 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0093378607809846
IMG	0x5c45b4	0x49d	PNG image data, 160 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0093141405588484
IMG	0x5c4a54	0x8f	PNG image data, 210 x 85, 2-bit colormap, non-interlaced	Chinese	China	0.9300699300699301
IMG	0x5c4ae4	0x8f	PNG image data, 210 x 85, 2-bit colormap, non-interlaced	Chinese	China	0.958041958041958
IMG	0x5c4b74	0x97	PNG image data, 210 x 85, 2-bit colormap, non-interlaced	Chinese	China	0.9668874172185431
IMG	0x5c4c0c	0x14e	PNG image data, 50 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9970059880239521
IMG	0x5c4d5c	0x2dd	PNG image data, 112 x 14, 8-bit colormap, non-interlaced	Chinese	China	0.9822646657571623
IMG	0x5c503c	0x67	PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9805825242718447
IMG	0x5c50a4	0x6b0	PNG image data, 96 x 32, 8-bit colormap, non-interlaced	Chinese	China	1.0064252336448598
IMG	0x5c5754	0x579	PNG image data, 96 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0078515346181298
IMG	0x5c5cd0	0xc8a	PNG image data, 100 x 100, 8-bit colormap, non-interlaced	Chinese	China	1.0034267912772585
IMG	0x5c695c	0x592	PNG image data, 84 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0077138849929874
IMG	0x5c6ef0	0x5df	PNG image data, 78 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0073186959414504
IMG	0x5c74d0	0x167	PNG image data, 78 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9805013927576601
IMG	0x5c7638	0x862	PNG image data, 78 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.005125815470643
IMG	0x5c7e9c	0x69a	PNG image data, 96 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.006508875739645
IMG	0x5c8538	0x45a	PNG image data, 71 x 48, 8-bit colormap, non-interlaced	Chinese	China	1.0098743267504489
IMG	0x5c8994	0x5ba	PNG image data, 71 x 48, 8-bit colormap, non-interlaced	Chinese	China	1.0075034106412006
IMG	0x5c8f50	0xac	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9593023255813954
IMG	0x5c8ffc	0x96	PNG image data, 80 x 5, 8-bit/color RGBA, non-interlaced	Chinese	China	0.98
IMG	0x5c9094	0x70	PNG image data, 80 x 5, 8-bit/color RGB, non-interlaced	Chinese	China	1.0
IMG	0x5c9104	0x5d	PNG image data, 4 x 1, 8-bit/color RGB, non-interlaced	Chinese	China	0.989247311827957
IMG	0x5c9164	0x5c	PNG image data, 4 x 1, 8-bit/color RGB, non-interlaced	Chinese	China	0.9891304347826086
IMG	0x5c91c0	0x5f6	PNG image data, 71 x 48, 8-bit colormap, non-interlaced	Chinese	China	1.0072083879423328
IMG	0x5c97b8	0x821	PNG image data, 81 x 27, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0052859202306583
IMG	0x5c9fdc	0x3d6	PNG image data, 81 x 27, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0112016293279023
IMG	0x5ca3b4	0xd3	PNG image data, 8 x 7, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0
IMG	0x5ca488	0x95	PNG image data, 8 x 7, 4-bit colormap, non-interlaced	Chinese	China	0.9731543624161074
IMG	0x5ca520	0x90	PNG image data, 8 x 7, 4-bit colormap, non-interlaced	Chinese	China	0.9097222222222222
IMG	0x5ca5b0	0x2dd	PNG image data, 28 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China	1.015006821282401
IMG	0x5ca890	0x2c1	PNG image data, 28 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0156028368794325
IMG	0x5cab54	0x16b8	PNG image data, 552 x 418, 8-bit colormap, non-interlaced	Chinese	China	0.967503438789546
IMG	0x5cc20c	0x4bd	PNG image data, 125 x 418, 2-bit colormap, non-interlaced	Chinese	China	1.0090684253915911
IMG	0x5cc6cc	0x4c6	PNG image data, 125 x 418, 2-bit colormap, non-interlaced	Chinese	China	1.0090016366612111
IMG	0x5ccb94	0x395	PNG image data, 72 x 24, 8-bit colormap, non-interlaced	Chinese	China	0.8767720828789531
IMG	0x5ccf2c	0x445	PNG image data, 51 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6989935956084172
IMG	0x5cd374	0x13c	PNG image data, 51 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9715189873417721
IMG	0x5cd4b0	0x191	PNG image data, 100 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0124688279301746
IMG	0x5cd644	0x4dd	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7726907630522089
LAYOUT	0x5cdb24	0x78e	Unicode text, UTF-8 (with BOM) text	Chinese	China	0.2828335056876939
LAYOUT	0x5ce2b4	0xc2d	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.29547641963426374
LAYOUT	0x5ceee4	0x126	Unicode text, UTF-8 (with BOM) text	Chinese	China	0.7448979591836735
LAYOUT	0x5cf00c	0xce	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.7815533980582524
LAYOUT	0x5cf0dc	0xb50	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.31353591160220995
LAYOUT	0x5cfc2c	0xbb	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.7272727272727273
LAYOUT	0x5cfce8	0x73c	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4087473002159827
LAYOUT	0x5d0424	0x1703	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.246477677813614
LAYOUT	0x5d1b28	0x759	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.42955874534821903
LAYOUT	0x5d2284	0x7f2	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4444444444444444
LAYOUT	0x5d2a78	0x1ff	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.6301369863013698
LAYOUT	0x5d2c78	0x350	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4834905660377358
LAYOUT	0x5d2fc8	0x221	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.5853211009174312
LAYOUT	0x5d31ec	0x80e	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3617846750727449
LAYOUT	0x5d39fc	0x11f	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.7317073170731707
LAYOUT	0x5d3b1c	0x6ba	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4645760743321719
LAYOUT	0x5d41d8	0x29e	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.5432835820895522
LAYOUT	0x5d4478	0x69c	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.41371158392434987
LAYOUT	0x5d4b14	0x668	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4304878048780488
LAYOUT	0x5d517c	0x4f5	Unicode text, UTF-8 (with BOM) text	Chinese	China	0.3979511426319937
LAYOUT	0x5d5674	0xbb	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.7272727272727273
LAYOUT	0x5d5730	0x9c2	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3366693354683747
LAYOUT	0x5d60f4	0x27b	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.5291338582677165
LAYOUT	0x5d6370	0x4fa	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4073783359497645
LAYOUT	0x5d686c	0xcc	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.7892156862745098
LAYOUT	0x5d6938	0xaa0	Unicode text, UTF-8 (with BOM) text, with very long lines (430), with CRLF line terminators	Chinese	China	0.35441176470588237
LAYOUT	0x5d73d8	0x5af	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4336769759450172
LAYOUT	0x5d7988	0x3d7	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4313326551373347
LAYOUT	0x5d7d60	0x595	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3198040587823653
LAYOUT	0x5d82f8	0x8a0	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.353713768115942
LAYOUT	0x5d8b98	0x940	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.16300675675675674
LAYOUT	0x5d94d8	0x202b	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.19368548876745598
LAYOUT	0x5db504	0x927	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.39479300042680326
LAYOUT	0x5dbe2c	0x60d	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4525500322788896
LAYOUT	0x5dc43c	0x67e	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3953068592057762
LAYOUT	0x5dcabc	0x2aa	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.6085043988269795
LAYOUT	0x5dcd68	0x9ea	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3195429472025217
LAYOUT	0x5dd754	0x54c	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.47271386430678464
LAYOUT	0x5ddca0	0x1a42	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.19994049390062482
LAYOUT	0x5df6e4	0x7db	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3545499751367479
LAYOUT	0x5dfec0	0x69f	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3775811209439528
LAYOUT	0x5e0560	0x59d	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.37230340988169797
LAYOUT	0x5e0b00	0x562	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.4462989840348331
LAYOUT	0x5e1064	0x1216	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.30107991360691144
LAYOUT	0x5e227c	0x17d	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.6482939632545932
LAYOUT	0x5e23fc	0x22b	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.6072072072072072
PNG	0x5e2628	0x4a8	PNG image data, 52 x 26, 8-bit/color RGB, non-interlaced	Chinese	China	0.735738255033557
PNG	0x5e2ad0	0x108f	PNG image data, 114 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0025949516395376
PNG	0x5e3b60	0xe73	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0029737766964044
PNG	0x5e49d4	0xd7c	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031865585168018
PNG	0x5e5750	0x3ee7	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	0.11097311060050923
PNG	0x5e9638	0x1fa	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0217391304347827
PNG	0x5e9834	0xf37	PNG image data, 108 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China	1.002824133504493
PNG	0x5ea76c	0xdb9	PNG image data, 120 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031312268716197
PNG	0x5eb528	0xcf2	PNG image data, 48 x 16, 8-bit/color RGB, non-interlaced	Chinese	China	1.0033192516596259
PNG	0x5ec21c	0xb1f	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0038637161924833
PNG	0x5ecd3c	0xcdf	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0033383915022762
PNG	0x5eda1c	0x715	PNG image data, 360 x 35, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0060672917815774
PNG	0x5ee134	0x1867	PNG image data, 192 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0017608452056987
PNG	0x5ef99c	0xb79	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.00374531835206
PNG	0x5f0518	0xb87	PNG image data, 26 x 26, 8-bit/color RGB, non-interlaced	Chinese	China	1.0037275499830567
PNG	0x5f10a0	0xdd0	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0031108597285068
PNG	0x5f1e70	0xaf7	PNG image data, 50 x 2, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0039187744923406
PNG	0x5f2968	0xb97	PNG image data, 200 x 26, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037074486012807
PNG	0x5f3500	0xe6	PNG image data, 9 x 8, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0304347826086957
PNG	0x5f35e8	0x1ca	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0240174672489082
PNG	0x5f37b4	0x1163	PNG image data, 120 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0024713547517412
PNG	0x5f4918	0x1361	PNG image data, 144 x 48, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0022172949002217
PNG	0x5f5c7c	0x1650	PNG image data, 80 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0019257703081232
PNG	0x5f72cc	0xd14	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0032855436081243
PNG	0x5f7fe0	0xd0a	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0032953864589575
PNG	0x5f8cec	0xc37	PNG image data, 85 x 6, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035177486408697
PNG	0x5f9924	0xc3c	PNG image data, 6 x 85, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0035121328224776
PNG	0x5fa560	0x3fa	PNG image data, 282 x 38, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0108055009823183
PNG	0x5fa95c	0xfc8	PNG image data, 153 x 17, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0027227722772276
PNG	0x5fb924	0x186	PNG image data, 162 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9153846153846154
PNG	0x5fbaac	0xca2	PNG image data, 102 x 17, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0034013605442176
PNG	0x5fc750	0xb67	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0037684138403562
PNG	0x5fd2b8	0x1ca	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0240174672489082
PNG	0x5fd484	0x50f	PNG image data, 13 x 85, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7598455598455598
SKIN	0x5fd994	0x18d0	JSON data	Chinese	China	0.13759445843828716
SMENU	0x5ff264	0x6ea	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.29774011299435027
SMENU	0x5ff950	0x6ee	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.2993235625704622
TRANSLATOR	0x600040	0xa1a8	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.17912719891745602
TRANSLATOR	0x60a1e8	0xab9d	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.1740149773518767
TRANSLATOR	0x614d88	0xaeb6	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (304), with CRLF line terminators	Chinese	China	0.16918570853642176
TRANSLATOR	0x61fc40	0xac36	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.16683300821122352
TRANSLATOR	0x62a878	0xaa1d	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.16748949459229834
TRANSLATOR	0x635298	0xa20b	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	Chinese	China	0.17860328327266592
TRANSLATOR	0x63f4a4	0x9c	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.9230769230769231
UIDEF	0x63f540	0xa6b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	Chinese	China	0.29733783277090364
VALUES	0x63ffac	0xe2	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.6238938053097345
VALUES	0x640090	0x2c45	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (317), with CRLF line terminators	Chinese	China	0.17709344392482132
VALUES	0x642cd8	0x9fc	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.3877151799687011
XML	0x6436d4	0x135	ASCII text, with CRLF line terminators	Chinese	China	0.5436893203883495
XML	0x64380c	0x6e5	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	Chinese	China	0.42039660056657224
XML	0x643ef4	0xbe4	ASCII text, with CRLF line terminators	Chinese	China	0.2585413929040736
RT_CURSOR	0x644ad8	0x8ac	Targa image data 64 x 65536 x 1 +32 "\010"	Chinese	China	0.06531531531531531
RT_ICON	0x645384	0x1b8e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9167848029486816
RT_ICON	0x646f14	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0			0.299390243902439
RT_ICON	0x64757c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0			0.478494623655914
RT_ICON	0x647864	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 0			0.48155737704918034
RT_ICON	0x647a4c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0			0.597972972972973
RT_GROUP_CURSOR	0x647b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_ICON	0x647b88	0x4c	data			0.8026315789473685
RT_VERSION	0x647bd4	0x250	data	English	United States	0.4814189189189189
RT_MANIFEST	0x647e24	0x61f	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1507), with CRLF line terminators	English	United States	0.400765794511806

Imports

DLL	Import
WINMM.dll	timeKillEvent, mciSendStringW, timeSetEvent
WTSAPI32.dll	WTSRegisterSessionNotification, WTSUnRegisterSessionNotification
KERNEL32.dll	DeleteFileW, GetFileAttributesExW, GetCurrentDirectoryW, MapViewOfFile, GetVolumeInformationW, GetFileAttributesW, SetFilePointerEx, SetEndOfFile, FlushFileBuffers, GetFileInformationByHandle, CreateToolhelp32Snapshot, GetFileSizeEx, FormatMessageW, SystemTimeToFileTime, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, GetVersionExW, GetSystemInfo, GetSystemDirectoryW, GetTimeZoneInformation, GetUserDefaultLangID, FindFirstChangeNotificationW, FindCloseChangeNotification, WaitForMultipleObjects, FindNextChangeNotification, Process32FirstW, Process32NextW, ResetEvent, OpenFileMappingW, IsBadReadPtr, GetSystemTime, GetCurrentDirectoryA, GetModuleFileNameA, GetVersionExA, HeapCreate, FreeResource, GetFullPathNameW, SleepEx, VerSetConditionMask, QueryPerformanceFrequency, VerifyVersionInfoW, QueryPerformanceCounter, MoveFileExA, GetSystemTimeAsFileTime, CompareFileTime, GetFileType, GetStdHandle, PeekNamedPipe, FormatMessageA, InterlockedDecrement, CreateFileMappingW, GetFileSize, WriteFile, UnmapViewOfFile, SuspendThread, lstrlenA, InterlockedIncrement, GlobalAlloc, GlobalLock, GetThreadContext, VirtualFree, VirtualAlloc, FlushInstructionCache, VirtualProtect, GetEnvironmentVariableW, GetEnvironmentVariableA, CreateProcessW, ResumeThread, TerminateProcess, ReadProcessMemory, LoadLibraryExA, LoadLibraryA, FindNextFileW, ConvertThreadToFiber, ConvertFiberToThread, CreateFiber, DeleteFiber, SwitchToFiber, ReadConsoleA, SetConsoleMode, WriteConsoleW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, IsValidCodePage, FindFirstFileExW, SetConsoleCtrlHandler, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetConsoleCP, ReadConsoleW, GetConsoleMode, GetACP, GetDriveTypeW, SetStdHandle, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, CreateThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlUnwind, GetStartupInfoW, UnhandledExceptionFilter, GetCPInfo, LocalFree, InitializeCriticalSectionEx, GetStringTypeW, GetExitCodeThread, WaitForSingleObjectEx, IsProcessorFeaturePresent, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, EncodePointer, IsDebuggerPresent, GetLocalTime, OutputDebugStringW, IsBadWritePtr, SetLastError, lstrcmpW, GetCurrentThreadId, ExitProcess, GlobalAddAtomA, Sleep, GetTickCount, InterlockedCompareExchange, FindFirstFileW, FindClose, ReadFile, CreateFileW, GlobalUnlock, MulDiv, GetComputerNameA, WideCharToMultiByte, OutputDebugStringA, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TerminateThread, GetProcAddress, FreeLibrary, GetLastError, GetCurrentProcess, GetCurrentProcessId, GetCommandLineA, LoadLibraryW, GetModuleHandleA, CloseHandle, SetEvent, CreateEventW, WaitForSingleObject, InitializeCriticalSection, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, GetCommandLineW, GetModuleHandleW, SetCurrentDirectoryW, InitializeCriticalSectionAndSpinCount, lstrcmpiW, LockResource, SizeofResource, FindResourceExW, DecodePointer, RaiseException, MultiByteToWideChar, LoadResource, FindResourceW, LoadLibraryExW, GetCurrentThread, GetModuleFileNameW, VirtualQuery, SetUnhandledExceptionFilter
USER32.dll	IsWindowVisible, GetFocus, GetDlgItem, GetDlgCtrlID, IsChild, GetWindow, SetFocus, RedrawWindow, GetActiveWindow, RegisterClassExW, MessageBoxW, UpdateLayeredWindow, MapVirtualKeyA, CharLowerBuffW, SystemParametersInfoA, DrawTextW, MsgWaitForMultipleObjects, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExW, ReleaseDC, GetDC, LoadCursorW, GetClassInfoExW, RegisterWindowMessageW, DefWindowProcW, CreateAcceleratorTableW, FillRect, DestroyAcceleratorTable, GetSysColor, GetParent, ShowWindow, SetWindowPos, DestroyWindow, SendMessageW, UnregisterClassW, CharNextW, OffsetRect, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindow, FindWindowW, GetWindowRect, MonitorFromRect, PostMessageW, UnhookWinEvent, SetWinEventHook, GetForegroundWindow, BringWindowToTop, SetWindowLongW, GetCursorPos, PtInRect, SetForegroundWindow, GetUserObjectInformationW, GetProcessWindowStation, DrawIconEx, CallWindowProcW, WindowFromPoint, EqualRect, IsIconic, MonitorFromPoint, GetSystemMetrics, GetMonitorInfoW, GetAsyncKeyState, UnregisterHotKey, RegisterHotKey, EnumDisplayMonitors, CopyRect, ScreenToClient, GetWindowLongW, MonitorFromWindow, GetClassNameW, GetShellWindow, GetAncestor, ClientToScreen, GetWindowThreadProcessId, SystemParametersInfoW, AttachThreadInput, LockWorkStation, SetCursor, SetCapture, ReleaseCapture, GetDesktopWindow, CreateWindowExW, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, MoveWindow, GetClientRect, BeginPaint, EndPaint, SetClassLongW, GetClassLongW, RemovePropW, GetPropW, SetPropW, SetMenuContextHelpId, GetMenuItemInfoW, SetMenuInfo, GetMenuInfo, TrackPopupMenu, AppendMenuW, GetMenuItemCount, DestroyMenu, CreatePopupMenu, IsMenu, GetIconInfo, SetLayeredWindowAttributes, EnumDisplayDevicesW, SetTimer, KillTimer, DestroyIcon, SendMessageA, GetWindowDC, GetWindowRgn, IsZoomed, SetSysColors, DestroyCursor, GetKeyState, EnableMenuItem, SetRect, InflateRect, InvalidateRect, SetActiveWindow, IsWindowEnabled, EnableWindow, LoadImageW, CreateIconFromResource, LoadBitmapW, MapWindowPoints, SetCaretPos, HideCaret, GetCaretBlinkTime, CreateCaret, UpdateWindow, GetCapture, AnimateWindow, PostQuitMessage, TrackMouseEvent, PeekMessageW, DispatchMessageW, TranslateMessage, GetMessageW, IsRectEmpty, UnionRect, IntersectRect, InvalidateRgn
GDI32.dll	ExcludeClipRect, CreateRoundRectRgn, SetGraphicsMode, Rectangle, FrameRgn, SetROP2, CreateRectRgn, SetDeviceGammaRamp, RestoreDC, GetObjectW, GetStockObject, DeleteDC, BitBlt, CreateCompatibleDC, CreateCompatibleBitmap, CreateSolidBrush, DeleteObject, GetDeviceCaps, SaveDC, EnumFontsW, CreateBitmap, CreateFontIndirectW, SetBkMode, StretchBlt, SetViewportOrgEx, ExtCreateRegion, GetRegionData, IntersectClipRect, SelectClipRgn, CreateDIBSection, GetCurrentObject, GetViewportOrgEx, GetGlyphIndicesW, GetTextExtentPointI, AddFontMemResourceEx, RemoveFontMemResourceEx, SetTextColor, SetTextAlign, GetTextMetricsW, CreatePen, SetWorldTransform, ExtTextOutW, GetTextFaceW, GdiFlush, SelectObject, CreateHatchBrush, EnumFontFamiliesExW, GetCharABCWidthsW, GetFontData, GetGlyphOutlineW, GetOutlineTextMetricsW, GetFontUnicodeRanges
COMDLG32.dll	ChooseColorW, GetOpenFileNameW
ADVAPI32.dll	CryptGetUserKey, CryptSignHashW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegNotifyChangeKeyValue, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptGetProvParam, CryptSetHashParam, CryptDestroyKey, CryptReleaseContext, CryptAcquireContextW, ReportEventW, RegisterEventSourceW, RegQueryValueExW, GetUserNameA, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, RegDeleteKeyW, DeregisterEventSource, CryptEnumProvidersW
SHELL32.dll	ShellExecuteW, SHCreateDirectoryExW, SHGetSpecialFolderPathW, SHGetSpecialFolderLocation, SHBrowseForFolderW, SHGetPathFromIDListW, SHFileOperationW, Shell_NotifyIconW
ole32.dll	CreateStreamOnHGlobal, IIDFromString, CreateBindCtx, CoCreateGuid, OleLockRunning, StringFromGUID2, CoGetClassObject, CLSIDFromProgID, CLSIDFromString, CoTaskMemRealloc, OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance
OLEAUT32.dll	LoadTypeLib, LoadRegTypeLib, VariantClear, OleCreateFontIndirect, DispCallFunc, VarUdateFromDate, SysStringLen, VariantInit, SysAllocStringLen, SysFreeString, SysAllocString, VarUI4FromStr, VariantTimeToSystemTime, SystemTimeToVariantTime, VarBstrFromDate
SHLWAPI.dll	PathAppendW, PathRemoveFileSpecW, PathFindExtensionW, PathIsDirectoryW, PathFileExistsW, StrToIntExW, PathQuoteSpacesW
gdiplus.dll	GdiplusShutdown, GdiplusStartup, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipSaveImageToFile, GdipGetPropertyItem, GdipGetPropertyItemSize, GdipGraphicsClear, GdipImageGetFrameCount, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageRectI, GdipDeleteGraphics, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCreateBitmapFromFile, GdipGetImageEncodersSize, GdipAlloc, GdipFree, GdipGetImageEncoders, GdipImageSelectActiveFrame
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeA, GetFileVersionInfoA
dwmapi.dll	DwmGetWindowAttribute
WS2_32.dll	getnameinfo, gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, __WSAFDIsSet, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, shutdown
IPHLPAPI.DLL	GetAdaptersInfo
IMM32.dll	ImmReleaseContext, ImmAssociateContext, ImmGetContext
CRYPT32.dll	CertGetCertificateContextProperty, CertDuplicateCertificateContext, CertFindCertificateInStore, CertOpenStore, CertOpenSystemStoreA, CertGetIntendedKeyUsage, CertGetEnhancedKeyUsage, CertFreeCertificateContext, CertEnumCertificatesInStore, CertCloseStore
WLDAP32.dll
USP10.dll	ScriptItemize, ScriptFreeCache, ScriptShape

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2024 12:36:55.038450003 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.038474083 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.038570881 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.047399044 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.047415018 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.428030968 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.428184986 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.627238989 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.627262115 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.627543926 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.627597094 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.630459070 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.676229954 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.814026117 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.814093113 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997432947 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997443914 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997463942 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997524023 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997541904 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997687101 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997687101 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997901917 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997931004 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997961998 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997967005 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.997987032 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.997999907 CEST	443	49707	155.101.98.133	192.168.2.5
Apr 4, 2024 12:36:55.998002052 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.998039961 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.998128891 CEST	49707	443	192.168.2.5	155.101.98.133
Apr 4, 2024 12:36:55.998136997 CEST	443	49707	155.101.98.133	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2024 12:36:54.767431021 CEST	50333	53	192.168.2.5	1.1.1.1
Apr 4, 2024 12:36:55.032830954 CEST	53	50333	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 4, 2024 12:36:54.767431021 CEST	192.168.2.5	1.1.1.1	0xe23e	Standard query (0)	www.math.utah.edu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 4, 2024 12:36:55.032830954 CEST	1.1.1.1	192.168.2.5	0xe23e	No error (0)	www.math.utah.edu		155.101.98.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.math.utah.edu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	155.101.98.133	443	380	C:\Users\user\Desktop\KJKJJJECFI.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 10:36:55 UTC	82	OUT	GET /docs/info/regex_1.html HTTP/1.1 User-Agent: how Host: www.math.utah.edu
2024-04-04 10:36:55 UTC	184	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 10:36:55 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 27645 Connection: close Content-Type: text/html
2024-04-04 10:36:55 UTC	16384	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 21 2d 2d 20 54 68 69 73 20 48 54 4d 4c 20 66 69 6c 65 20 68 61 73 20 62 65 65 6e 20 63 72 65 61 74 65 64 20 62 79 20 74 65 78 69 32 68 74 6d 6c 20 31 2e 34 35 0a 20 20 20 20 20 66 72 6f 6d 20 2f 68 6f 6d 65 2f 73 68 61 72 65 2f 65 6d 61 63 73 2d 31 38 2e 35 38 2f 6d 61 6e 2f 72 65 67 65 78 2e 74 65 78 69 6e 66 6f 20 6f 6e 20 38 20 4d 61 72 63 68 20 31 39 39 36 20 2d 2d 3e 0a 0a 3c 54 49 54 4c 45 3e 55 6e 74 69 74 6c 65 64 20 44 6f 63 75 6d 65 6e 74 20 2d 20 72 65 67 65 78 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 61 74 63 68 69 6e 67 20 6c 69 62 72 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"><HTML><HEAD>... This HTML file has been created by texi2html 1.45 from /home/share/emacs-18.58/man/regex.texinfo on 8 March 1996 --><TITLE>Untitled Document - regex regular expression matching libra
2024-04-04 10:36:55 UTC	11261	IN	Data Raw: 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 0a 69 6e 74 6f 20 74 68 65 20 62 75 66 66 65 72 3a 0a 0a 3c 50 52 45 3e 0a 72 65 5f 63 6f 6d 70 69 6c 65 5f 70 61 74 74 65 72 6e 20 28 3c 56 41 52 3e 72 65 67 65 78 3c 2f 56 41 52 3e 2c 20 3c 56 41 52 3e 72 65 67 65 78 5f 73 69 7a 65 3c 2f 56 41 52 3e 2c 20 3c 56 41 52 3e 62 75 66 3c 2f 56 41 52 3e 29 0a 3c 2f 50 52 45 3e 0a 0a 3c 50 3e 0a 3c 56 41 52 3e 72 65 67 65 78 3c 2f 56 41 52 3e 20 69 73 20 74 68 65 20 61 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 20 28 3c 43 4f 44 45 3e 63 68 61 72 20 2a 3c 2f 43 4f 44 45 3e 29 2c 0a 3c 56 41 52 3e 72 65 67 65 78 5f 73 69 7a 65 3c 2f 56 41 52 3e 20 69 73 20 69 74 73 20 6c 65 6e 67 74 68 20 28 3c 43 Data Ascii: a regular expressioninto the buffer:<PRE>re_compile_pattern (<VAR>regex</VAR>, <VAR>regex_size</VAR>, <VAR>buf</VAR>)</PRE><P><VAR>regex</VAR> is the address of the regular expression (<CODE>char *</CODE>),<VAR>regex_size</VAR> is its length (<C

Target ID:	0
Start time:	12:36:53
Start date:	04/04/2024
Path:	C:\Users\user\Desktop\KJKJJJECFI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KJKJJJECFI.exe"
Imagebase:	0xef0000
File size:	6'699'592 bytes
MD5 hash:	CE355F68F7FB9BCC5A1E140DA2398489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1998916468.0000000005BCD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:36:55
Start date:	04/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2254651788.0000000006040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2254182536.000000000566B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:36:55
Start date:	04/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:37:13
Start date:	04/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x430000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2255985779.0000000002981000.00000020.00000001.01000000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.2256315034.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:37:18
Start date:	04/04/2024
Path:	C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\NBFoundation\Sendevsvc.exe"
Imagebase:	0x3d0000
File size:	6'699'592 bytes
MD5 hash:	CE355F68F7FB9BCC5A1E140DA2398489
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KJKJJJECFI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\regex_1[1].htm

C:\Users\user\AppData\Local\Temp\4476cd9c

C:\Users\user\AppData\Local\Temp\ivls

C:\Users\user\AppData\Local\Temp\qsbtcxh

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
KJKJJJECFI.exe