Edit tour

Windows Analysis Report
OlympusViewer-win2-4-1.exe

Overview

General Information

Sample name:	OlympusViewer-win2-4-1.exe
Analysis ID:	1427879
MD5:	19ec441c0bfa8e22aae49acefe0ed8a6
SHA1:	b691145b15142206e66c57401d7212448d296ce5
SHA256:	aa268da45a8cfdb6848e516b6ffdb2b0c1b07c91d5f8860c7dca8f0e34282cee

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

PE file contains executable resources (Code or Archives)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

OlympusViewer-win2-4-1.exe (PID: 7004 cmdline: "C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe" MD5: 19EC441C0BFA8E22AAE49ACEFE0ED8A6)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: OlympusViewer-win2-4-1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe

Window detected: Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.EVIDENT END-USER LICENSE AGREEMENTAll titles and copyrights of the Software and the Manual (collectively called as gSoftwareh and if referring only to Manual or others called as gManualh) included in this program are owned by EVIDENT CORPORATION ("EVIDENT") and/or its licensors. The Software is also protected by copyright laws and other intellectual property laws and treaties. The Software is to be licensed not to be sold. The Software may include (i) some open source software and (ii) other third party software (collectivelly "Third Party Software"). Regarding the use of the Third Party Software you shall follow the license terms and conditions applied to such Third Party Software. Any part of this Agreement does not restrict change or alter any of your rights and obligations imposed by the license terms and conditions of the Third Party Software. EVIDENT grants to you a non-exclusive license to use the Software on the computer provided that you agree to the terms and conditions of this agreement. It is regarded that you agree to all provisions of this Agreement when you install the Software. Please read this Agreement carefully before installing the Software. If you do not agree to this Agreement you cannot install the Software. The descriptions in this Agreement may be changed by prior notice through this site. Also EVIDENT may modify stop or discontinue this site service without prior notice to you. Section 1 (Software)The Software may be modified by EVIDENT or its licensors for correcting bugs upgrading or any other purposes without any prior notice. After modifications are made only the modified Software is regarded as the Software under this Agreement and you may not use the Software before modification. Section 2 (Rental and Transfer)You may not rent or sublicense the Software or any of its copy. You may however transfer all of your rights under this Agreement provided you transfer all of the Software without retaining any copy and the recipient agrees to the terms and conditions of this Agreement.Section 3 (Restrictions)(1) You may not sell a whole or part of the Software without EVIDENTf written approval. (2) Unless otherwise provided in this Agreement or the Manual you may not make any copy of the Software without EVIDENTf approval other than backup purposes.(3) Unless otherwise provided in this Agreement or the Manual you may not create transfer sell or rent any derivative work of the Software.(4) You may not reverse engineer decompile disassemble or print out any part of the Software. (5) You agree that Software is subject to the export control laws and regulations of Japan U.S.A. and other countries.(6) You may not delete any copyright warning and other notices on the Software.(7) You may not alter or adapt a whole or part of the Software without EVIDENTf written approval. Section 4 (Waiver)(1) THE SOFTWARE IS PROVIDED TO Y

Source:	Binary string: wextract.pdb source: OlympusViewer-win2-4-1.exe
Source:	Binary string: wextract.pdbU source: OlympusViewer-win2-4-1.exe

Source: OlympusViewer-win2-4-1.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 81872744 bytes, 1 file, at 0x2c +A "OlympusViewer-package.zip", ID 2533, number 1, 2589 datablocks, 0x1503 compression

Source: OlympusViewer-win2-4-1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean0.winEXE@1/0@0/0

Source: OlympusViewer-win2-4-1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK
Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe	Automated click: OK

Source: C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe

Source: OlympusViewer-win2-4-1.exe

Static file information: File size 81938432 > 1048576

Source: OlympusViewer-win2-4-1.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x4e1b800

Source: OlympusViewer-win2-4-1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: OlympusViewer-win2-4-1.exe
Source:	Binary string: wextract.pdbU source: OlympusViewer-win2-4-1.exe

Source: OlympusViewer-win2-4-1.exe

Binary or memory string: GHGfS

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OlympusViewer-win2-4-1.exe	3%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427879
Start date and time:	2024-04-18 09:49:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OlympusViewer-win2-4-1.exe
Detection:	CLEAN
Classification:	clean0.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: OlympusViewer-win2-4-1.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive
Entropy (8bit):	7.998955346897448
TrID:	Win32 Executable (generic) a (10002005/4) 97.02% Win32 MS Cabinet Self-Extractor (WExtract stub) (303627/2) 2.95% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OlympusViewer-win2-4-1.exe
File size:	81'938'432 bytes
MD5:	19ec441c0bfa8e22aae49acefe0ed8a6
SHA1:	b691145b15142206e66c57401d7212448d296ce5
SHA256:	aa268da45a8cfdb6848e516b6ffdb2b0c1b07c91d5f8860c7dca8f0e34282cee
SHA512:	269eb89b700ce87fe4fd533f188c81fd4a3791a228c0de8ed9dc828a2f82fcbc0b528ad28f909f252cfccefd6354e52ec7f1761a518346208d6c6c339262a423
SSDEEP:	1572864:spxT8fgwTpYGSndi9V7y/C9wk/f5dbEyO/IBwzu9I333LEoGRusNxck1qoolOCaD:spFP2pYPnU77yji0ABo4qHLuFL5
TLSH:	8708333EF581F739E4068179C8E7A903826E1E69BC9081BD8BA5D806C5117D377FB9C2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......->..i_..i_..i_...\|..d_..i_..._...\|..h_...\|..q_...\|..h_..Richi_..........PE..L...%.n=.............................Z.............

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x1005ae4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x3D6E0425 [Thu Aug 29 11:23:17 2002 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	1494de9b53e05fc1f40cb92afbdd6ce4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 44h
push esi
call dword ptr [0100115Ch]
mov esi, eax
mov al, byte ptr [esi]
cmp al, 22h
jne 00007F49D932E7A4h
inc esi
mov al, byte ptr [esi]
test al, al
je 00007F49D932E796h
cmp al, 22h
jne 00007F49D932E787h
cmp byte ptr [esi], 00000022h
jne 00007F49D932E7A5h
jmp 00007F49D932E7A2h
cmp al, 20h
jle 00007F49D932E79Fh
inc esi
cmp byte ptr [esi], 00000020h
jnle 00007F49D932E78Ch
jmp 00007F49D932E797h
cmp al, 20h
jnle 00007F49D932E799h
inc esi
mov al, byte ptr [esi]
test al, al
jne 00007F49D932E787h
and dword ptr [ebp-18h], 00000000h
lea eax, dword ptr [ebp-44h]
push eax
call dword ptr [01001158h]
test byte ptr [ebp-18h], 00000001h
je 00007F49D932E798h
movzx eax, word ptr [ebp-14h]
jmp 00007F49D932E795h
push 0000000Ah
pop eax
push eax
push esi
push 00000000h
push 00000000h
call dword ptr [01001154h]
push eax
call 00007F49D932E6CAh
push eax
call dword ptr [01001104h]
int3
push ebx
mov ebx, dword ptr [esp+08h]
cmp bl, byte ptr [esp+0Ch]
jne 00007F49D932E7ADh
push ebx
call dword ptr [010010ACh]
test eax, eax
je 00007F49D932E79Eh
xor eax, eax
cmp bx, word ptr [esp+0Ch]
setne al
jmp 00007F49D932E799h
xor eax, eax
jmp 00007F49D932E795h
xor eax, eax
inc eax
pop ebx
retn 0008h
push esi
mov esi, dword ptr [esp+08h]
jmp 00007F49D932E7AEh
push dword ptr [esp+0Ch]
xor eax, eax
mov ax, word ptr [esi]
push eax
call 00007F49D932E752h
test eax, eax
je 00007F49D932E7A6h
push esi
call dword ptr [01001188h]
mov esi, eax
cmp byte ptr [esi], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8b7c	0x8c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4e1b6d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1210	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x210	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x86e6	0x8800	8a4459ae5b95cb6f870b0c31a5a33080	False	0.5955595128676471	data	6.573403007243956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa000	0x1be4	0x400	730893b14fc930a187215e7fb53bc0a5	False	0.3173828125	data	4.184278831627629	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc000	0x4e1c000	0x4e1b800	62bf8555694490d467005a5f7d5c57f3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xc6d0	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0xf4ec	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3709677419354839
RT_ICON	0xf7d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6081081081081081
RT_DIALOG	0xf8fc	0x2cc	data	English	United States	0.4553072625698324
RT_DIALOG	0xfbc8	0x18a	data	English	United States	0.6040609137055838
RT_DIALOG	0xfd54	0x140	data	English	United States	0.565625
RT_DIALOG	0xfe94	0x196	data	English	United States	0.5960591133004927
RT_DIALOG	0x1002c	0x10e	data	English	United States	0.6111111111111112
RT_DIALOG	0x1013c	0xfa	data	English	United States	0.652
RT_STRING	0x10238	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x102c4	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x107e4	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x10db0	0x4b0	data	English	United States	0.385
RT_STRING	0x11260	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x116ac	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x11a7c	0x4e14768	Microsoft Cabinet archive data, Windows 2000/XP setup, 81872744 bytes, 1 file, at 0x2c +A "OlympusViewer-package.zip", ID 2533, number 1, 2589 datablocks, 0x1503 compression	English	United States	1.000265121459961
RT_RCDATA	0x4e261e4	0x4	data	English	United States	3.0
RT_RCDATA	0x4e261e8	0x24	data	English	United States	0.6666666666666666
RT_RCDATA	0x4e2620c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x4e26214	0x1062	data	English	United States	0.40915593705293274
RT_RCDATA	0x4e27278	0x4	data	English	United States	3.0
RT_RCDATA	0x4e2727c	0x4	data	English	United States	3.0
RT_RCDATA	0x4e27280	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x4e27288	0x4	data	English	United States	3.0
RT_RCDATA	0x4e2728c	0x1c	data	English	United States	1.2142857142857142
RT_RCDATA	0x4e272a8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x4e272b0	0x22	data	English	United States	1.0
RT_VERSION	0x4e272d4	0x400	data	English	United States	0.412109375

Imports

DLL	Import
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA
KERNEL32.dll	LocalFree, LocalAlloc, GetLastError, GetCurrentProcess, GetModuleFileNameA, lstrlenA, GetSystemDirectoryA, RemoveDirectoryA, FindClose, FindNextFileA, DeleteFileA, SetFileAttributesA, lstrcmpA, FindFirstFileA, lstrcatA, lstrcpyA, _lclose, _llseek, _lopen, WritePrivateProfileStringA, GetWindowsDirectoryA, CreateDirectoryA, GetFileAttributesA, ExpandEnvironmentStringsA, IsDBCSLeadByte, GetShortPathNameA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcmpiA, GetProcAddress, GlobalUnlock, GlobalLock, GlobalAlloc, FreeResource, CloseHandle, LoadResource, SizeofResource, FindResourceA, ReadFile, WriteFile, SetFilePointer, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, SetCurrentDirectoryA, GetTempFileNameA, ExitProcess, CreateFileA, LoadLibraryExA, lstrcpynA, GetVolumeInformationA, FormatMessageA, GetCurrentDirectoryA, GetVersionExA, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetTempPathA, GetSystemInfo, CreateMutexA, SetEvent, CreateEventA, CreateThread, ResetEvent, TerminateThread, GetDriveTypeA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, LockResource, LoadLibraryA, GetDiskFreeSpaceA, MulDiv, EnumResourceLanguagesA, FreeLibrary, GlobalFree
GDI32.dll	GetDeviceCaps
USER32.dll	ExitWindowsEx, wsprintfA, CharNextA, CharUpperA, CharPrevA, SetWindowLongA, GetWindowLongA, CallWindowProcA, DispatchMessageA, MsgWaitForMultipleObjects, PeekMessageA, SendMessageA, SetWindowPos, ReleaseDC, GetDC, GetWindowRect, SendDlgItemMessageA, GetDlgItem, SetForegroundWindow, SetWindowTextA, MessageBoxA, DialogBoxIndirectParamA, ShowWindow, EnableWindow, GetDlgItemTextA, EndDialog, GetDesktopWindow, MessageBeep, SetDlgItemTextA, LoadStringA, GetSystemMetrics
COMCTL32.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	09:50:04
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OlympusViewer-win2-4-1.exe"
Imagebase:	0x1000000
File size:	81'938'432 bytes
MD5 hash:	19EC441C0BFA8E22AAE49ACEFE0ED8A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OlympusViewer-win2-4-1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: OlympusViewer-win2-4-1.exePID: 7004, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
OlympusViewer-win2-4-1.exe