Edit tour

Windows Analysis Report
Gcerti Quote.exe

Overview

General Information

Sample name:	Gcerti Quote.exe
Analysis ID:	1428412
MD5:	9a6474186b145552217cf4d421309733
SHA1:	b21733889432abe65233736ce0e0289f8f3bddc4
SHA256:	3815bc3a78dc96a0af4aca4446b3afa741d3910530ae69b06895b0e499d49aa6
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Gcerti Quote.exe (PID: 968 cmdline: "C:\Users\user\Desktop\Gcerti Quote.exe" MD5: 9A6474186B145552217CF4D421309733)

Gcerti Quote.exe (PID: 7140 cmdline: "C:\Users\user\Desktop\Gcerti Quote.exe" MD5: 9A6474186B145552217CF4D421309733)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.italiacanda-it.com", "Username": "snpss@italiacanda-it.com", "Password": "dsrociz1               "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Gcerti Quote.exe PID: 968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Gcerti Quote.exe PID: 968	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Gcerti Quote.exe PID: 968	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Gcerti Quote.exe PID: 7140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Gcerti Quote.exe PID: 7140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Gcerti Quote.exe.37d7690.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Gcerti Quote.exe.37d7690.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Gcerti Quote.exe.37d7690.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3175b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31877:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31953:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a79:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.Gcerti Quote.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Gcerti Quote.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Gcerti Quote.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33879:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Gcerti Quote.exe.379cc70.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Gcerti Quote.exe.379cc70.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Gcerti Quote.exe.379cc70.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3175b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31877:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31953:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a79:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Gcerti Quote.exe.37d7690.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Gcerti Quote.exe.37d7690.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Gcerti Quote.exe.37d7690.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Gcerti Quote.exe.37d7690.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd09:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd7b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de05:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de97:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df01:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df73:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e009:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33879:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e099:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Gcerti Quote.exe.379cc70.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Gcerti Quote.exe.379cc70.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Gcerti Quote.exe.379cc70.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Gcerti Quote.exe.379cc70.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334e9:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df09:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8729:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3355b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df7b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa879b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335e5:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e005:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8825:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33677:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e097:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e1:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e101:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8921:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33753:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e173:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8993:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337e9:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e209:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a29:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 208.91.198.143, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Gcerti Quote.exe, Initiated: true, ProcessId: 7140, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.italiacanda-it.com", "Username": "snpss@italiacanda-it.com", "Password": "dsrociz1 "}

Multi AV Scanner detection for submitted file

Source: Gcerti Quote.exe

ReversingLabs: Detection: 65%

Machine Learning detection for sample

Source: Gcerti Quote.exe

Joe Sandbox ML: detected

Source: Gcerti Quote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.9:49707 version: TLS 1.2

Source: Gcerti Quote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Code function: 4x nop then jmp 05798C07h

0_2_05798D0D

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.225:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.198.143:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.224:587
Source: global traffic	TCP traffic: 192.168.2.9:49708 -> 208.91.199.225:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Gcerti Quote.exe, 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.italiacanda-it.com
Source: Gcerti Quote.exe, 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.9:49707 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, K6raBsUk6.cs	.Net Code: _1kx
Source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, K6raBsUk6.cs	.Net Code: _1kx

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Gcerti Quote.exe.37d7690.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Gcerti Quote.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Gcerti Quote.exe.379cc70.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: Gcerti Quote.exe, ExceptionMessage.cs	Large array initialization: : array initializer size 616592
Source: 0.2.Gcerti Quote.exe.258a3e4.0.raw.unpack, .cs	Large array initialization: : array initializer size 13798

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_00D0E240	0_2_00D0E240
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_0579A8D8	0_2_0579A8D8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05798AA0	0_2_05798AA0
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05794360	0_2_05794360
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05794BD0	0_2_05794BD0
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05798A90	0_2_05798A90
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_015A8D88	2_2_015A8D88
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_015AD6F7	2_2_015AD6F7
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_015A8C30	2_2_015A8C30
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_015AB8B8	2_2_015AB8B8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018CE1C1	2_2_018CE1C1
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018C4A98	2_2_018C4A98
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018CAA1B	2_2_018CAA1B
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018C3E80	2_2_018C3E80
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018C41C8	2_2_018C41C8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018C0D77	2_2_018C0D77
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD65E8	2_2_06DD65E8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD55A8	2_2_06DD55A8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD7D78	2_2_06DD7D78
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DDB220	2_2_06DDB220
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD3060	2_2_06DD3060
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DDC170	2_2_06DDC170
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD7698	2_2_06DD7698
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD5CDB	2_2_06DD5CDB
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD05A8	2_2_06DD05A8
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DDE388	2_2_06DDE388
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD2370	2_2_06DD2370
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_06DD0007	2_2_06DD0007

Source: Gcerti Quote.exe, 00000000.00000002.1345046966.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1350157359.00000000050C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed1d0086e-f958-473c-b56d-1a9de9dc0359.exe4 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1350519021.00000000059B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1345999029.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed1d0086e-f958-473c-b56d-1a9de9dc0359.exe4 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000000.00000002.1345999029.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed1d0086e-f958-473c-b56d-1a9de9dc0359.exe4 vs Gcerti Quote.exe
Source: Gcerti Quote.exe, 00000002.00000002.2574622576.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Gcerti Quote.exe
Source: Gcerti Quote.exe	Binary or memory string: OriginalFilenameNsUw.exe4 vs Gcerti Quote.exe

Source: Gcerti Quote.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Gcerti Quote.exe.37d7690.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Gcerti Quote.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Gcerti Quote.exe.379cc70.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Gcerti Quote.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, c2bZQnG.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, Q1L0K.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, uo1UBaEHa.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, pdY2feOEB7Q4P75scM.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, pdY2feOEB7Q4P75scM.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, biCNQP8BONLoNEeqIF.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/5

Source: C:\Users\user\Desktop\Gcerti Quote.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gcerti Quote.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Mutant created: \Sessions\1\BaseNamedObjects\ahhuFzThKm

Source: Gcerti Quote.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Gcerti Quote.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Gcerti Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Gcerti Quote.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Gcerti Quote.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Gcerti Quote.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Gcerti Quote.exe

File read: C:\Users\user\Desktop\Gcerti Quote.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Gcerti Quote.exe "C:\Users\user\Desktop\Gcerti Quote.exe"
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process created: C:\Users\user\Desktop\Gcerti Quote.exe "C:\Users\user\Desktop\Gcerti Quote.exe"
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process created: C:\Users\user\Desktop\Gcerti Quote.exe "C:\Users\user\Desktop\Gcerti Quote.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Gcerti Quote.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Gcerti Quote.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, biCNQP8BONLoNEeqIF.cs	.Net Code: Lh2YaPILsp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, biCNQP8BONLoNEeqIF.cs	.Net Code: Lh2YaPILsp System.Reflection.Assembly.Load(byte[])
Source: 0.2.Gcerti Quote.exe.258a3e4.0.raw.unpack, LoginForm.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_00D06230 push esp; ret	0_2_00D06239
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_057904E6 push esi; ret	0_2_057904E7
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05798700 push ebp; iretd	0_2_05798725
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05798681 push ebp; iretd	0_2_057986A5
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_05795192 push E8FFFFFFh; iretd	0_2_0579519D
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 0_2_057903D2 push FFFFFFC4h; iretd	0_2_057903D4
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Code function: 2_2_018C0CB5 push edi; ret	2_2_018C0CC2

Source: Gcerti Quote.exe

Static PE information: section name: .text entropy: 7.927894078342841

Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, a29hdazao4dduN4f76.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'v1jA7IHm5Y', 'EmWApkPJBZ', 'yGQAGVrX0G', 't77AitcT1N', 'fV5AxoNb3D', 'y1rAAchnQE', 'Ij1AVOQyAP'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, qr6IqWHA39delcefpUo.cs	High entropy of concatenated method names: 'SEWAfEnm3A', 'OodAPo9E16', 'bjHAafZq4S', 'Uo8AClEps4', 'NpNA6mhtbR', 'X9hAdlWDjQ', 'Mq3AMwZT8T', 'KS9ARY2BBg', 'LwnALT2CuZ', 'BhoAjF5nky'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, PTTuyVMcmfFe0NCfK2.cs	High entropy of concatenated method names: 'MxBxtTZEHm', 'L3axmSc1kv', 'GvDxbx32dN', 'Pc1xyk5VYc', 'ffExvyT8TO', 'vLgxKM1d5k', 'rZBxq1qL9K', 'DOvx1ZaxLE', 'xeyxhh0KX9', 'dQLxEobWZm'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, cJHxb8HlRmHiGWECoTQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1OVO4JXK9', 'm6bVuGlZUU', 'pvpVBYCdIf', 'O9SV21sw1g', 'VVtVHPhJ00', 'i9vVZLMxp0', 'V37VgEac8G'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, a3Mh7yCaXvKwHiXv4S.cs	High entropy of concatenated method names: 'Dispose', 'tCnonLZsEa', 'bDv5FiFcwH', 'FlUQQ8xS0W', 'uedo9LfDWE', 'rMkozjhXD0', 'ProcessDialogKey', 'PRv5l2iBQj', 'fVk5odW5fu', 'ymy55fVNQv'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, UXCjChnYhaI7UNr4qS.cs	High entropy of concatenated method names: 'WKr7RJIfpe', 'TO17LFh0WW', 'GqV7kwBA4U', 'Gip7F9ApvX', 'tkW7e9VGxx', 'OFR78mE8aI', 'jCW73SgYQh', 'HaF7srenMa', 'qUm74w5TQP', 'Sdr7IogTwK'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, biCNQP8BONLoNEeqIF.cs	High entropy of concatenated method names: 'Q97D0mDPAi', 'gmwDtlk7Bp', 'm77DmZkOnX', 'UlkDboGfvZ', 'zERDytFrP0', 'oPADvjUNwu', 'Ge8DKYnNeK', 'DqFDqoVqm2', 'nnmD1LChCn', 'WcvDhtPFXp'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, pyiYrm0BKK73XikD28.cs	High entropy of concatenated method names: 'Xnhy670egr', 'GCgyMehNHE', 'i8NbXc6AgE', 'M2Nbe4NacV', 'UiZb88NbDl', 'LeCbSFGLDO', 'LjWb3ViKTd', 'kJubsgJ2ba', 'VSPbwVDvEn', 'DLnb4DpKl2'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, gFdexHFaaD4cEJcs8p.cs	High entropy of concatenated method names: 'JMVAwqE8i3T539TSGhR', 'HWsK2fE1CLtDyJop4j4', 'gAmvxFZkx7', 'aGkvAFQqAA', 'flsvV30S6n', 'XIyla6E0PBjqgjjmiG8', 'KdTYtAElD6Y6hXYEDYM'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, pdY2feOEB7Q4P75scM.cs	High entropy of concatenated method names: 'BfLmOZHLem', 'h2KmuKgsuc', 'MaWmBxcXjN', 'NJCm2ZU90m', 'CnmmHUOcJU', 'dGMmZSn0pE', 'Opnmgas0MR', 'aSimcReBLs', 'rhlmnia7tb', 'Yhmm9NB974'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, wJq0MfDIUfaouA28xv.cs	High entropy of concatenated method names: 'ToString', 'umHGIpWM0m', 'ceFGFtd7On', 'cCOGX9iqfL', 'li8Ge5sc7v', 'dDjG8sqZJV', 'SIZGSjLmRe', 'o1EG3YljPl', 'g65GseR9Ks', 'kKBGw3JdjV'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, Ixoro1td292Qgwk5VC.cs	High entropy of concatenated method names: 'qerv0YKErY', 'c4Xvm0dKTZ', 'f1yvyAXq40', 'mVlvKLN5kA', 'twPvqj7kwK', 'ASbyHyNPqQ', 'Rs4yZLBTkt', 'HmpygKoetV', 'GtZyckAROu', 'c0WynmGJRT'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, znf9XtUuUtKixFr9mg.cs	High entropy of concatenated method names: 'QNAaZE9Hr', 'dwfCKvjO5', 'I40du2VIf', 'stEMyrxfk', 'g1WLAmbvQ', 'jkwjMJGdu', 'H8osRTXDo3IBiKAxyi', 'B5ed36u6DgXo7FU9oF', 'HvdxvjEdD', 'J9hVenFWl'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, nnuegImrahOMABdQ4W.cs	High entropy of concatenated method names: 'pBpp4ZSrKT', 'vvxpTWtWFv', 'LFSpOZs0ED', 'pxkpuUhJfX', 'FdSpFlWhsn', 'UD8pXUm2m9', 'H94peaye9L', 'guhp8fDTML', 'nABpSWehc0', 'hVbp3T3oH5'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, uTAC5xb39sKkx4FDuH.cs	High entropy of concatenated method names: 'K6uAoDLUCL', 'q4oADeLhFw', 'owmAYW7Drv', 'YV8AtUaetQ', 'AObAme2vCT', 'SipAyiXRuo', 'OACAvfsJH1', 'UnpxgyKgQi', 'OlixcsaR3D', 'AHdxnkxYpG'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, RMYX84IMaUr9MYjOPo.cs	High entropy of concatenated method names: 'MnQicRkKWc', 'Lndi9Ba55J', 'vSMxlKJ5PD', 'DYxxokhR8b', 'noCiI4CPLd', 'msIiTfngLd', 'InYiUpSaUq', 'zU9iOeCNyi', 'xtciu7KSZJ', 'tNRiBasn7u'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, hdFvDjkss96iwQgJW4.cs	High entropy of concatenated method names: 'HjaKf7YF6V', 'V1nKPcdeaw', 'iKvKaia1p9', 'gIiKCCEfES', 'hVoK6Os80v', 'BXxKdfKkDv', 'XTXKMCfFYy', 'ynhKRcn9FX', 'qcOKLXOLfh', 'LZaKjcxF7p'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, PRSON4XLlc79GlsfC0.cs	High entropy of concatenated method names: 'lbLKtbfZfS', 'KVFKbMoKqH', 'A1WKvMusgu', 'qvnv9TfyTE', 'jivvzY9Vpr', 'oyIKlmN9Xu', 'C6NKoh4tBB', 'Q6OK5iJDSn', 'yUYKD4QRTb', 'ODbKYRYUnp'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, o8P50JT6AyrEU9YL5X.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'o6w5ntI4p3', 'DZp59QFAlo', 'Yee5zJs56m', 'o7CDlYuGmZ', 'XsXDo1nyME', 'NhYD5JJ91J', 'TRoDDm0wro', 'I3m5r5PPH57y5Vnkpyj'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, xX3kTQ6DmFsDnV1E8k.cs	High entropy of concatenated method names: 'zZwbCIboQV', 'VfMbdNfVE3', 'pAvbRIEFd8', 'mcjbLNYqhv', 'X1cbpg1ad1', 'gZ0bGjgAO1', 'WhWbiOtBWs', 'H1vbxFi4BN', 'CFnbAgBNBW', 'tDQbVB3YTy'
Source: 0.2.Gcerti Quote.exe.59b0000.8.raw.unpack, TIEOMsKaTE6wXAYRRl.cs	High entropy of concatenated method names: 'pKNoKZop2a', 'faOoqS2RRv', 'i2dohLEbYy', 'dAEoE6ZTKC', 'EANoptIfwk', 'bVvoGRQV4X', 'KNl6qYOV0KeWdvOOsA', 'df9KhvyG4gp4qjZHuD', 'hq3ooKamPE', 'Q4boD8r7j6'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, a29hdazao4dduN4f76.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'v1jA7IHm5Y', 'EmWApkPJBZ', 'yGQAGVrX0G', 't77AitcT1N', 'fV5AxoNb3D', 'y1rAAchnQE', 'Ij1AVOQyAP'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, qr6IqWHA39delcefpUo.cs	High entropy of concatenated method names: 'SEWAfEnm3A', 'OodAPo9E16', 'bjHAafZq4S', 'Uo8AClEps4', 'NpNA6mhtbR', 'X9hAdlWDjQ', 'Mq3AMwZT8T', 'KS9ARY2BBg', 'LwnALT2CuZ', 'BhoAjF5nky'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, PTTuyVMcmfFe0NCfK2.cs	High entropy of concatenated method names: 'MxBxtTZEHm', 'L3axmSc1kv', 'GvDxbx32dN', 'Pc1xyk5VYc', 'ffExvyT8TO', 'vLgxKM1d5k', 'rZBxq1qL9K', 'DOvx1ZaxLE', 'xeyxhh0KX9', 'dQLxEobWZm'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, cJHxb8HlRmHiGWECoTQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'T1OVO4JXK9', 'm6bVuGlZUU', 'pvpVBYCdIf', 'O9SV21sw1g', 'VVtVHPhJ00', 'i9vVZLMxp0', 'V37VgEac8G'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, a3Mh7yCaXvKwHiXv4S.cs	High entropy of concatenated method names: 'Dispose', 'tCnonLZsEa', 'bDv5FiFcwH', 'FlUQQ8xS0W', 'uedo9LfDWE', 'rMkozjhXD0', 'ProcessDialogKey', 'PRv5l2iBQj', 'fVk5odW5fu', 'ymy55fVNQv'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, UXCjChnYhaI7UNr4qS.cs	High entropy of concatenated method names: 'WKr7RJIfpe', 'TO17LFh0WW', 'GqV7kwBA4U', 'Gip7F9ApvX', 'tkW7e9VGxx', 'OFR78mE8aI', 'jCW73SgYQh', 'HaF7srenMa', 'qUm74w5TQP', 'Sdr7IogTwK'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, biCNQP8BONLoNEeqIF.cs	High entropy of concatenated method names: 'Q97D0mDPAi', 'gmwDtlk7Bp', 'm77DmZkOnX', 'UlkDboGfvZ', 'zERDytFrP0', 'oPADvjUNwu', 'Ge8DKYnNeK', 'DqFDqoVqm2', 'nnmD1LChCn', 'WcvDhtPFXp'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, pyiYrm0BKK73XikD28.cs	High entropy of concatenated method names: 'Xnhy670egr', 'GCgyMehNHE', 'i8NbXc6AgE', 'M2Nbe4NacV', 'UiZb88NbDl', 'LeCbSFGLDO', 'LjWb3ViKTd', 'kJubsgJ2ba', 'VSPbwVDvEn', 'DLnb4DpKl2'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, gFdexHFaaD4cEJcs8p.cs	High entropy of concatenated method names: 'JMVAwqE8i3T539TSGhR', 'HWsK2fE1CLtDyJop4j4', 'gAmvxFZkx7', 'aGkvAFQqAA', 'flsvV30S6n', 'XIyla6E0PBjqgjjmiG8', 'KdTYtAElD6Y6hXYEDYM'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, pdY2feOEB7Q4P75scM.cs	High entropy of concatenated method names: 'BfLmOZHLem', 'h2KmuKgsuc', 'MaWmBxcXjN', 'NJCm2ZU90m', 'CnmmHUOcJU', 'dGMmZSn0pE', 'Opnmgas0MR', 'aSimcReBLs', 'rhlmnia7tb', 'Yhmm9NB974'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, wJq0MfDIUfaouA28xv.cs	High entropy of concatenated method names: 'ToString', 'umHGIpWM0m', 'ceFGFtd7On', 'cCOGX9iqfL', 'li8Ge5sc7v', 'dDjG8sqZJV', 'SIZGSjLmRe', 'o1EG3YljPl', 'g65GseR9Ks', 'kKBGw3JdjV'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, Ixoro1td292Qgwk5VC.cs	High entropy of concatenated method names: 'qerv0YKErY', 'c4Xvm0dKTZ', 'f1yvyAXq40', 'mVlvKLN5kA', 'twPvqj7kwK', 'ASbyHyNPqQ', 'Rs4yZLBTkt', 'HmpygKoetV', 'GtZyckAROu', 'c0WynmGJRT'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, znf9XtUuUtKixFr9mg.cs	High entropy of concatenated method names: 'QNAaZE9Hr', 'dwfCKvjO5', 'I40du2VIf', 'stEMyrxfk', 'g1WLAmbvQ', 'jkwjMJGdu', 'H8osRTXDo3IBiKAxyi', 'B5ed36u6DgXo7FU9oF', 'HvdxvjEdD', 'J9hVenFWl'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, nnuegImrahOMABdQ4W.cs	High entropy of concatenated method names: 'pBpp4ZSrKT', 'vvxpTWtWFv', 'LFSpOZs0ED', 'pxkpuUhJfX', 'FdSpFlWhsn', 'UD8pXUm2m9', 'H94peaye9L', 'guhp8fDTML', 'nABpSWehc0', 'hVbp3T3oH5'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, uTAC5xb39sKkx4FDuH.cs	High entropy of concatenated method names: 'K6uAoDLUCL', 'q4oADeLhFw', 'owmAYW7Drv', 'YV8AtUaetQ', 'AObAme2vCT', 'SipAyiXRuo', 'OACAvfsJH1', 'UnpxgyKgQi', 'OlixcsaR3D', 'AHdxnkxYpG'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, RMYX84IMaUr9MYjOPo.cs	High entropy of concatenated method names: 'MnQicRkKWc', 'Lndi9Ba55J', 'vSMxlKJ5PD', 'DYxxokhR8b', 'noCiI4CPLd', 'msIiTfngLd', 'InYiUpSaUq', 'zU9iOeCNyi', 'xtciu7KSZJ', 'tNRiBasn7u'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, hdFvDjkss96iwQgJW4.cs	High entropy of concatenated method names: 'HjaKf7YF6V', 'V1nKPcdeaw', 'iKvKaia1p9', 'gIiKCCEfES', 'hVoK6Os80v', 'BXxKdfKkDv', 'XTXKMCfFYy', 'ynhKRcn9FX', 'qcOKLXOLfh', 'LZaKjcxF7p'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, PRSON4XLlc79GlsfC0.cs	High entropy of concatenated method names: 'lbLKtbfZfS', 'KVFKbMoKqH', 'A1WKvMusgu', 'qvnv9TfyTE', 'jivvzY9Vpr', 'oyIKlmN9Xu', 'C6NKoh4tBB', 'Q6OK5iJDSn', 'yUYKD4QRTb', 'ODbKYRYUnp'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, o8P50JT6AyrEU9YL5X.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'o6w5ntI4p3', 'DZp59QFAlo', 'Yee5zJs56m', 'o7CDlYuGmZ', 'XsXDo1nyME', 'NhYD5JJ91J', 'TRoDDm0wro', 'I3m5r5PPH57y5Vnkpyj'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, xX3kTQ6DmFsDnV1E8k.cs	High entropy of concatenated method names: 'zZwbCIboQV', 'VfMbdNfVE3', 'pAvbRIEFd8', 'mcjbLNYqhv', 'X1cbpg1ad1', 'gZ0bGjgAO1', 'WhWbiOtBWs', 'H1vbxFi4BN', 'CFnbAgBNBW', 'tDQbVB3YTy'
Source: 0.2.Gcerti Quote.exe.38c8340.2.raw.unpack, TIEOMsKaTE6wXAYRRl.cs	High entropy of concatenated method names: 'pKNoKZop2a', 'faOoqS2RRv', 'i2dohLEbYy', 'dAEoE6ZTKC', 'EANoptIfwk', 'bVvoGRQV4X', 'KNl6qYOV0KeWdvOOsA', 'df9KhvyG4gp4qjZHuD', 'hq3ooKamPE', 'Q4boD8r7j6'

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Gcerti Quote.exe PID: 968, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Gcerti Quote.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 24B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 5A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 6A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 6C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 7C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 18C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 3250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Memory allocated: 31A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Window / User API: threadDelayed 1311			Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Window / User API: threadDelayed 8550			Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 3304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 6388	Thread sleep count: 1311 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99865s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 6388	Thread sleep count: 8550 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99308s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -99031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97470s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96790s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -96031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -95047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -94937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -94719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -94594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe TID: 7084	Thread sleep time: -94469s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Gcerti Quote.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Gcerti Quote.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99865	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99308	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99170	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 99031	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98812	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97470	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97344	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96905	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96790	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96468	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95922	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95703	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95374	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 95047	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 94719	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 94594	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Thread delayed: delay time: 94469	Jump to behavior

Source: Gcerti Quote.exe, 00000002.00000002.2574684975.0000000001456000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll||

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Memory written: C:\Users\user\Desktop\Gcerti Quote.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Process created: C:\Users\user\Desktop\Gcerti Quote.exe "C:\Users\user\Desktop\Gcerti Quote.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Users\user\Desktop\Gcerti Quote.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Users\user\Desktop\Gcerti Quote.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Gcerti Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 7140, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Gcerti Quote.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Gcerti Quote.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Gcerti Quote.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Gcerti Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 7140, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Gcerti Quote.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.37d7690.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Gcerti Quote.exe.379cc70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Gcerti Quote.exe PID: 7140, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Gcerti Quote.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.LokiBot
Gcerti Quote.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	false	high
api.ipify.org	104.26.12.205	true	false	high
smtp.italiacanda-it.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	Gcerti Quote.exe, 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Gcerti Quote.exe, 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://smtp.italiacanda-it.com	Gcerti Quote.exe, 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://api.ipify.org/t	Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	false	high
http://us2.smtp.mailhostbox.com	Gcerti Quote.exe, 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Gcerti Quote.exe, 00000002.00000002.2577396201.0000000003251000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
208.91.199.225	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.223	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
208.91.199.224	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428412
Start date and time:	2024-04-18 22:35:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gcerti Quote.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 84 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Gcerti Quote.exe

Simulations

Behavior and APIs

Time	Type	Description
22:36:02	API Interceptor	22937x Sleep call for process: Gcerti Quote.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse
	rks18.doc	Get hash	malicious	AgentTesla	Browse
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse
	J2TDUpZm2s.exe	Get hash	malicious	AgentTesla	Browse
	J1odVFynAz.exe	Get hash	malicious	AgentTesla	Browse
	Doc via Dhl.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse
104.26.12.205	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
208.91.199.225	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse
	rks18.doc	Get hash	malicious	AgentTesla	Browse
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse
	J2TDUpZm2s.exe	Get hash	malicious	AgentTesla	Browse
	J1odVFynAz.exe	Get hash	malicious	AgentTesla	Browse
	Doc via Dhl.exe	Get hash	malicious	AgentTesla	Browse
	Quote.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	rks18.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	J2TDUpZm2s.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	J1odVFynAz.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Doc via Dhl.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Quote.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
api.ipify.org	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	SHIPPING DOCUMENTS_PDF..vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Payment Advice.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Scan-IMG PO Order CW289170-A CW201.bat.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TransactionSummary_910020049836765_110424045239.xlsx	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PRODUCT LIST_002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F723838674.vbs	Get hash	malicious	Remcos	Browse	116.206.104.215
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	162.215.248.214
	Bill-Transcript_6ZB6-IJYD3B-SEH0.html	Get hash	malicious	Unknown	Browse	45.113.122.212
	rks18.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	116.206.104.215
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
CLOUDFLARENETUS	wFtZih4nN9.elf	Get hash	malicious	Mirai	Browse	104.28.24.146
	https://nwcchicago-my.sharepoint.com/:b:/p/jpsanavaitis/EZA36vHeUQxCnJ96O418g94BWiWpCx4SyNTLHION5X1T7g?e=N00DO7	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	https://dinamicconsultores.app.questorpublico.com.br/	Get hash	malicious	HTMLPhisher	Browse	104.21.235.213
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	F723838674.vbs	Get hash	malicious	Unknown	Browse	104.21.84.67
	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
PUBLIC-DOMAIN-REGISTRYUS	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F723838674.vbs	Get hash	malicious	Remcos	Browse	116.206.104.215
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	162.215.248.214
	Bill-Transcript_6ZB6-IJYD3B-SEH0.html	Get hash	malicious	Unknown	Browse	45.113.122.212
	rks18.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	116.206.104.215
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
PUBLIC-DOMAIN-REGISTRYUS	Syknivkloo.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F723838674.vbs	Get hash	malicious	Remcos	Browse	116.206.104.215
	CTM REQUEST BIRTHSHIP.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PURCHASE ORDER -HDPESD.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	order 4500381478001.exe	Get hash	malicious	AgentTesla	Browse	162.215.248.214
	Bill-Transcript_6ZB6-IJYD3B-SEH0.html	Get hash	malicious	Unknown	Browse	45.113.122.212
	rks18.doc	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	PayFmc6FL4.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	116.206.104.215
	DHL 0028374.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	hesaphareketi-01.pdf.SCR.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Request for Proposal Quote_2414976#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	104.26.12.205
	Signed Proforma Invoice 3645479_pdf.vbs	Get hash	malicious	FormBook	Browse	104.26.12.205
	F723838674.vbs	Get hash	malicious	Remcos	Browse	104.26.12.205
	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	SHIPPING DOCUMENTS_PDF..vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	DHL Receipt_pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Remittance slip.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\Gcerti Quote.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRaKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPHKMRatHo6hAH4
MD5:	97AD91F1C1F572C945DA12233082171D
SHA1:	D5E33DDAB37E32E416FC40419FB26B3C0563519D
SHA-256:	3F64591E0447E6F5034BC69A8A8D4C7ED36DAC5FE1E408401AE1B98F0D915F7E
SHA-512:	8FAEED342DADC17571F711DDC1BE67C79A51CA5BD56B5DA13E472ED45FC4EC6F1DC704BA92E81E97F5ECFD73F3D88F9B9CD9AE4EADDF993BFF826627215FBBCE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fc

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.918086947891207
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Gcerti Quote.exe
File size:	700'928 bytes
MD5:	9a6474186b145552217cf4d421309733
SHA1:	b21733889432abe65233736ce0e0289f8f3bddc4
SHA256:	3815bc3a78dc96a0af4aca4446b3afa741d3910530ae69b06895b0e499d49aa6
SHA512:	33f247c4ef21221d983927b7f2f54a63d51d23840bfb4edfb9aac32f8a2b6856566c78c00e3ce147e574b1b61526f16c2c7f818f4a291d006183be6e73b7b416
SSDEEP:	12288:urfrr2rrDirIlL3zxlDB3gHSmlNyqrCysnM8f/zR0NIV8ngQItKxKQCHrdWnuS:5lL3zxlD5aTl0VpM4/F0NA8ngQPird8X
TLSH:	C8E4120C9BEC8E08C95D477CF593984447B2E717E243EF2B6DD460E91EB6BC88680697
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	9931c5b98687b385

Static PE Info

General

Entrypoint:	0x4ab6ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661F0FD8 [Tue Apr 16 23:55:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab680	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xac000	0x1600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa96d4	0xa9800	ef9d8f712ece18ded85feb06be479352	False	0.9435538232853983	data	7.927894078342841	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xac000	0x1600	0x1600	5cf77b12f7274d3dd8a187ae0bd0929f	False	0.7345525568181818	data	6.524734925945253	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x200	58a8b0674ea75aa500eda598cc07472d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xac0c8	0xf5d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9125349605898805
RT_GROUP_ICON	0xad038	0x14	data	1.05
RT_VERSION	0xad05c	0x3c0	data	0.4510416666666667

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 22:36:04.150291920 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.150327921 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.150501966 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.159868002 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.159881115 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.382164001 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.382352114 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.385936022 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.385945082 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.386308908 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.426199913 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.436577082 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.484122038 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.689331055 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.689398050 CEST	443	49707	104.26.12.205	192.168.2.9
Apr 18, 2024 22:36:04.689573050 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:04.698801041 CEST	49707	443	192.168.2.9	104.26.12.205
Apr 18, 2024 22:36:05.451648951 CEST	49708	587	192.168.2.9	208.91.198.143
Apr 18, 2024 22:36:06.457361937 CEST	49708	587	192.168.2.9	208.91.198.143
Apr 18, 2024 22:36:08.457372904 CEST	49708	587	192.168.2.9	208.91.198.143
Apr 18, 2024 22:36:12.460035086 CEST	49708	587	192.168.2.9	208.91.198.143
Apr 18, 2024 22:36:20.457425117 CEST	49708	587	192.168.2.9	208.91.198.143
Apr 18, 2024 22:36:26.473980904 CEST	49708	587	192.168.2.9	208.91.199.223
Apr 18, 2024 22:36:27.488600016 CEST	49708	587	192.168.2.9	208.91.199.223
Apr 18, 2024 22:36:29.488640070 CEST	49708	587	192.168.2.9	208.91.199.223
Apr 18, 2024 22:36:33.504281044 CEST	49708	587	192.168.2.9	208.91.199.223
Apr 18, 2024 22:36:41.504239082 CEST	49708	587	192.168.2.9	208.91.199.223
Apr 18, 2024 22:36:47.504698992 CEST	49708	587	192.168.2.9	208.91.199.224
Apr 18, 2024 22:36:48.519892931 CEST	49708	587	192.168.2.9	208.91.199.224
Apr 18, 2024 22:36:50.519994974 CEST	49708	587	192.168.2.9	208.91.199.224
Apr 18, 2024 22:36:54.520066977 CEST	49708	587	192.168.2.9	208.91.199.224
Apr 18, 2024 22:37:02.519840956 CEST	49708	587	192.168.2.9	208.91.199.224
Apr 18, 2024 22:37:08.520081997 CEST	49708	587	192.168.2.9	208.91.199.225
Apr 18, 2024 22:37:09.519836903 CEST	49708	587	192.168.2.9	208.91.199.225
Apr 18, 2024 22:37:11.519932985 CEST	49708	587	192.168.2.9	208.91.199.225
Apr 18, 2024 22:37:15.519984007 CEST	49708	587	192.168.2.9	208.91.199.225
Apr 18, 2024 22:37:23.519828081 CEST	49708	587	192.168.2.9	208.91.199.225

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 22:36:04.034859896 CEST	58184	53	192.168.2.9	1.1.1.1
Apr 18, 2024 22:36:04.139656067 CEST	53	58184	1.1.1.1	192.168.2.9
Apr 18, 2024 22:36:05.207449913 CEST	62321	53	192.168.2.9	1.1.1.1
Apr 18, 2024 22:36:05.449570894 CEST	53	62321	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 22:36:04.034859896 CEST	192.168.2.9	1.1.1.1	0xc029	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:05.207449913 CEST	192.168.2.9	1.1.1.1	0x3dba	Standard query (0)	smtp.italiacanda-it.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 22:36:04.139656067 CEST	1.1.1.1	192.168.2.9	0xc029	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:04.139656067 CEST	1.1.1.1	192.168.2.9	0xc029	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:04.139656067 CEST	1.1.1.1	192.168.2.9	0xc029	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:05.449570894 CEST	1.1.1.1	192.168.2.9	0x3dba	No error (0)	smtp.italiacanda-it.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 22:36:05.449570894 CEST	1.1.1.1	192.168.2.9	0x3dba	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:05.449570894 CEST	1.1.1.1	192.168.2.9	0x3dba	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:05.449570894 CEST	1.1.1.1	192.168.2.9	0x3dba	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 18, 2024 22:36:05.449570894 CEST	1.1.1.1	192.168.2.9	0x3dba	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	104.26.12.205	443	7140	C:\Users\user\Desktop\Gcerti Quote.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 20:36:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-18 20:36:04 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 20:36:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 876771e89dd578d1-ATL
2024-04-18 20:36:04 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Target ID:	0
Start time:	22:36:01
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Gcerti Quote.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Gcerti Quote.exe"
Imagebase:	0x190000
File size:	700'928 bytes
MD5 hash:	9A6474186B145552217CF4D421309733
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1346501403.000000000379C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:36:02
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\Gcerti Quote.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Gcerti Quote.exe"
Imagebase:	0xe90000
File size:	700'928 bytes
MD5 hash:	9A6474186B145552217CF4D421309733
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2574408572.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2577396201.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2577396201.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	8.5%
Total number of Nodes:	213
Total number of Limit Nodes:	20

Executed Functions

Function 0579A8D8 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bebb0add44ffb49bcaa731dd613712f871a4408ad6c741dce54c2fef6da5c2
Instruction ID: 10249a8d159d5d7f05d670910588fe8bf3eb460762a464a97906cf33bf72b45b
Opcode Fuzzy Hash: 64bebb0add44ffb49bcaa731dd613712f871a4408ad6c741dce54c2fef6da5c2
Instruction Fuzzy Hash: 77E1D9707027048FEF29DB65E954BAEB7F7AF89600F148469D1469B390DF34E802CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05798AA0 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df51a3eee3174ef3e2f09367308567ff54e12baddfbfc033510a45f4560acb9
Instruction ID: 7c6eb144fe0a446e7f01c947f1ee5ea20dbddd945cd39df6ceb2d1820417ffad
Opcode Fuzzy Hash: 5df51a3eee3174ef3e2f09367308567ff54e12baddfbfc033510a45f4560acb9
Instruction Fuzzy Hash: B0812870D05628CBEB68CF66D944BEDBBB6BF8A300F0481EAD00DA6254DB705AC5DF51

Uniqueness

Uniqueness Score: -1.00%

Function 05798D0D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3dc6303a2e7c1793e3e225568a8480e7f2e777da3116a5431b6750279e3afb
Instruction ID: 09a7840ef406faccd6c0203d3cb3a0fc27a5e63e2092b8f2405580ade47f4dfd
Opcode Fuzzy Hash: 9e3dc6303a2e7c1793e3e225568a8480e7f2e777da3116a5431b6750279e3afb
Instruction Fuzzy Hash: 5DD01234E0E244CFDF49DF64A5485F47AB9AB0B340F0420E9591A97646D22485419A39

Uniqueness

Uniqueness Score: -1.00%

Function 05796F64 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 057971A6

Strings

SLes, xrefs: 05796FAB
SLes, xrefs: 05796FDA

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: CreateProcess
String ID: SLes$SLes
API String ID: 963392458-3257090266
Opcode ID: 8b52cef2aca47d761b7cd992c8dc80f395c1b39e76c722179752c3c8a7f80efa
Instruction ID: d4acb122f1aab392fe676a2ebdb9c0fc4d43edc1d9a51402609c4a14ec96b677
Opcode Fuzzy Hash: 8b52cef2aca47d761b7cd992c8dc80f395c1b39e76c722179752c3c8a7f80efa
Instruction Fuzzy Hash: 97A17C71D107198FEF28CF68D841BEDBBB2FB49300F1481A9E819A7240DB759985DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05796F70 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 057971A6

Strings

SLes, xrefs: 05796FAB
SLes, xrefs: 05796FDA

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: CreateProcess
String ID: SLes$SLes
API String ID: 963392458-3257090266
Opcode ID: b38b3c962714d588ee96f16c05b606ae592caed339132dab861c532ba23244d3
Instruction ID: dd606467336dc68152fb9722be1b5919a6b3f3cd4cf1aaf2cbe0ba26b1c6dc7d
Opcode Fuzzy Hash: b38b3c962714d588ee96f16c05b606ae592caed339132dab861c532ba23244d3
Instruction Fuzzy Hash: 29914C71D107198FEF18CF68D841BEDBBB2FB45300F1481A9E819A7240DB759985DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0489C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D05D99

Strings

SLes, xrefs: 00D05D1C

Memory Dump Source

Source File: 00000000.00000002.1345686426.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Gcerti Quote.jbxd

Similarity

API ID: Create
String ID: SLes
API String ID: 2289755597-1358607504
Opcode ID: 0f86c7fe7918eb4ebc4e68e1f253ceddb5f6cc7fbfc565d3a5e508cf6aff295a
Instruction ID: 99adacc228114a98749005c9873be1b99b017794469ec11e12be765336604186
Opcode Fuzzy Hash: 0f86c7fe7918eb4ebc4e68e1f253ceddb5f6cc7fbfc565d3a5e508cf6aff295a
Instruction Fuzzy Hash: B641D270C00B19DFEB25CFA9C8447CEBBB5BF49704F20816AE448AB255DB756945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D05CDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D05D99

Strings

SLes, xrefs: 00D05D1C

Memory Dump Source

Source File: 00000000.00000002.1345686426.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Gcerti Quote.jbxd

Similarity

API ID: Create
String ID: SLes
API String ID: 2289755597-1358607504
Opcode ID: 80ca5da93e8fa960080b3c7037671d4a71dcf1a1f9f958b239fd5ade3c2ba8d4
Instruction ID: 3babcc73e3721dc22aaf355f5b28040d1a15c59470f6c01da018fdd114626992
Opcode Fuzzy Hash: 80ca5da93e8fa960080b3c7037671d4a71dcf1a1f9f958b239fd5ade3c2ba8d4
Instruction Fuzzy Hash: 3841EF70C00B19CFEB25CFA9C8447CEBBB2BF49304F24806AD458AB295DB756945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796CE1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05796D78

Strings

SLes, xrefs: 05796D07

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: SLes
API String ID: 3559483778-1358607504
Opcode ID: 15a89894b40977f4aec82844a0c97cb3c4b710e11c64cf7004d784d915a61bc3
Instruction ID: 78ffab6e0fd3b2d969c784bfaeca005960183a7eb87522f102f3f30ff46d0ee5
Opcode Fuzzy Hash: 15a89894b40977f4aec82844a0c97cb3c4b710e11c64cf7004d784d915a61bc3
Instruction Fuzzy Hash: 5F2155B19003599FDF04CFA9D8847EEBBF1FF49310F10852AE929A7240C7799940DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796CE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05796D78

Strings

SLes, xrefs: 05796D07

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: SLes
API String ID: 3559483778-1358607504
Opcode ID: e9ec5ed962aef45926758042e8ee1952e26cfd973f367ce8ed474b68205c4c23
Instruction ID: 3ed22a3437840bcba27efdd421c232f2c08b6761fc6387a1a1439fb33a5b4505
Opcode Fuzzy Hash: e9ec5ed962aef45926758042e8ee1952e26cfd973f367ce8ed474b68205c4c23
Instruction Fuzzy Hash: 732169719003599FDF00CFAAC884BDEBBF5FF48310F14842AE919A7240C7789940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796CE7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05796D78

Strings

SLes, xrefs: 05796D07

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: SLes
API String ID: 3559483778-1358607504
Opcode ID: 75441918d1da2fdb11649e616819d189bc0def5e630902c82cda6e0249085e1e
Instruction ID: 642b926a34cd1def18003bbbeb3ebdba223bcc9f99e595eacde9cb75818f304b
Opcode Fuzzy Hash: 75441918d1da2fdb11649e616819d189bc0def5e630902c82cda6e0249085e1e
Instruction Fuzzy Hash: E62125B69003599FDF00CFA9D9857EEBBF1FF48310F14842AE929A7240D7789954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05796E58

Strings

SLes, xrefs: 05796DF7

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MemoryProcessRead
String ID: SLes
API String ID: 1726664587-1358607504
Opcode ID: 2f96162d76202ecc515123b102bd3ec6227087360b7df580b0157b1763028cd5
Instruction ID: f35e4b647329f25465ecef5cfd98600affa8428fe741b81843310f37150ab1f6
Opcode Fuzzy Hash: 2f96162d76202ecc515123b102bd3ec6227087360b7df580b0157b1763028cd5
Instruction Fuzzy Hash: C92125758002599FDF10CFAAD8807EEBBB5FF48310F14842EE969A7240C7799501DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796DD8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 05796E58

Strings

SLes, xrefs: 05796DF7

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MemoryProcessRead
String ID: SLes
API String ID: 1726664587-1358607504
Opcode ID: e5e122963e988bf92a6e9174d6796c1c22b486be93e2dcc5192203b12cb9be9b
Instruction ID: 5bc9bded76dd92e38e5abc728bc9184976ccc8bb4a5d9d797011b6776caf4322
Opcode Fuzzy Hash: e5e122963e988bf92a6e9174d6796c1c22b486be93e2dcc5192203b12cb9be9b
Instruction Fuzzy Hash: F82125B18003499FDF10CFAAD880BEEBBF5FF48310F54842AE519A7240C7799940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796B50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05796BCE

Strings

SLes, xrefs: 05796B6C

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ContextThreadWow64
String ID: SLes
API String ID: 983334009-1358607504
Opcode ID: 5bfc37ee5ffaabfa9a6f5745e9355a9db57014f2f147ce2402877c91160abe1b
Instruction ID: 61650b59ec44e151d6c1c3cee4dccbfa75c9f491289b63ce31522fc9a3bd475a
Opcode Fuzzy Hash: 5bfc37ee5ffaabfa9a6f5745e9355a9db57014f2f147ce2402877c91160abe1b
Instruction Fuzzy Hash: C8214771D043098FDB14CFAAC4857EEBBF4EF88310F24842AD559A7240D778A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796C21 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05796C96

Strings

SLes, xrefs: 05796C3F

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: AllocVirtual
String ID: SLes
API String ID: 4275171209-1358607504
Opcode ID: e35bfb2c9a4b8d9769a21afc917b44ab7ded0b66714bdba4532f347cb8189002
Instruction ID: 02b305f85c489c25272d0b98bff1cc72fbe199ffbadf6c7fc98b10139f4ef777
Opcode Fuzzy Hash: e35bfb2c9a4b8d9769a21afc917b44ab7ded0b66714bdba4532f347cb8189002
Instruction Fuzzy Hash: 0E1167728003098FDF10CFAAD844BEEBBF5EB49310F14882AE519A7250C775A940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796C28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05796C96

Strings

SLes, xrefs: 05796C3F

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: AllocVirtual
String ID: SLes
API String ID: 4275171209-1358607504
Opcode ID: 141303a6acdb4522cd2db8386f6a2e0612083f386c001cf081b1a67c47444701
Instruction ID: dc61a1febe48f4fc51ca7932c39eef556acd552f007a67112a290186ef1b7695
Opcode Fuzzy Hash: 141303a6acdb4522cd2db8386f6a2e0612083f386c001cf081b1a67c47444701
Instruction Fuzzy Hash: 0E1137728003499FDF10DFAAD844BDEBBF5EF49310F248829E519A7250C775A540CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796A98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 05796B02

Strings

SLes, xrefs: 05796AB7

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ResumeThread
String ID: SLes
API String ID: 947044025-1358607504
Opcode ID: 7d2917fe6aa21289514231626bd4c987d0ea9420d3688d6071c1520bc038de0a
Instruction ID: 61d1d72edf81d2a6e0b21db544cb73154673020873db7cab5146eb8dceeb9c74
Opcode Fuzzy Hash: 7d2917fe6aa21289514231626bd4c987d0ea9420d3688d6071c1520bc038de0a
Instruction Fuzzy Hash: 571149B1D042498BDB14DFAAD4447EEBBF5EB48220F248529D469A7380CB759940CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0579B869 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 0579B8C8

Strings

SLes, xrefs: 0579B88A

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: SLes
API String ID: 2591292051-1358607504
Opcode ID: 24b7a41d424600a14c5e242ce9db253693cf97ed4983299bc8131ec4fe12baa8
Instruction ID: bc8aa125a5bb18a93a8ed7cc75f0a05cfbb30afe898582c1eff8f2c42b7feedc
Opcode Fuzzy Hash: 24b7a41d424600a14c5e242ce9db253693cf97ed4983299bc8131ec4fe12baa8
Instruction Fuzzy Hash: 8B1136B58047498FDB10CF99D445BEEBBF4EF88320F21846AD458A7740C379A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05796AA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 05796B02

Strings

SLes, xrefs: 05796AB7

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ResumeThread
String ID: SLes
API String ID: 947044025-1358607504
Opcode ID: 0336ffcfa7336527f8434c582c77ca91e68aa30e09cb7e4f14bc0b18329e2a9f
Instruction ID: 33149b40d52723acab52b0c97219ca8995fb871f21d6f45157754b31cf65c737
Opcode Fuzzy Hash: 0336ffcfa7336527f8434c582c77ca91e68aa30e09cb7e4f14bc0b18329e2a9f
Instruction Fuzzy Hash: D91166B1D003498FDB10DFAAD4447EEFBF4EF88320F24842AD419A7240C779A940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05796AA2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 05796B02

Strings

SLes, xrefs: 05796AB7

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ResumeThread
String ID: SLes
API String ID: 947044025-1358607504
Opcode ID: 2cfe195c0e82f3c07a4f08a5b6f3ce739c57d86ca2db720175c9df755e56a8b7
Instruction ID: 5cfc49712f9663358813eda68dff234221099348bbddc8126b8c9304983de85d
Opcode Fuzzy Hash: 2cfe195c0e82f3c07a4f08a5b6f3ce739c57d86ca2db720175c9df755e56a8b7
Instruction Fuzzy Hash: 001133B1D003498FDB24DFAAD4447EEFBF5AF88320F24842AD419A7240C779A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05797E7C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05799C3D

Strings

SLes, xrefs: 05799BFA

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MessagePost
String ID: SLes
API String ID: 410705778-1358607504
Opcode ID: 54a9fa3430c8ca6263ba7487f1ff596d116f54b44d211bdeb16fb8e7cb89266c
Instruction ID: 15b00c6d8d2525891f9571b33015457629cbbab05faa6f1696d9ce409bf48ca8
Opcode Fuzzy Hash: 54a9fa3430c8ca6263ba7487f1ff596d116f54b44d211bdeb16fb8e7cb89266c
Instruction Fuzzy Hash: FB1133B5804308DFEB10CF9AD845BDEBBF8EB48310F20841AE518A3300C375A940CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0579B870 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 0579B8C8

Strings

SLes, xrefs: 0579B88A

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: SLes
API String ID: 2591292051-1358607504
Opcode ID: b595d93c037ecc989557da4dbfe628dacee496cd743402e4d8097a833efce6f2
Instruction ID: 1fe15fa681bba278b607321cc03a1c2b07703d1cbc1be2a5d41fa6a918cfb7de
Opcode Fuzzy Hash: b595d93c037ecc989557da4dbfe628dacee496cd743402e4d8097a833efce6f2
Instruction Fuzzy Hash: 2C1133B58043498FDB10CF9AD445BDEBBF4EB48320F20846AD568A7740D378A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05799BD8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 05799C3D

Strings

SLes, xrefs: 05799BFA

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID: MessagePost
String ID: SLes
API String ID: 410705778-1358607504
Opcode ID: e694a620da512dd392941fb576f74a7e45474174357abc16b98d51415fb1f076
Instruction ID: 5e2dc6b9149155aa1200784dd0559b6d9ae24e4e06b6071bf3bbfc455daf8bdc
Opcode Fuzzy Hash: e694a620da512dd392941fb576f74a7e45474174357abc16b98d51415fb1f076
Instruction Fuzzy Hash: BF1122B58007499FDB10CF99D985BEEBBF8FB48310F20881AE558A3600C378A540CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0091D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1345480812.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6238fe8b6828ceea13f6c90831db0cf44ada045e6c4206ccd7825e8161c082d1
Instruction ID: 0d94842e6cc816fc35a46d003ddc5cdf84f15b0af498575d96ebf21232e829c2
Opcode Fuzzy Hash: 6238fe8b6828ceea13f6c90831db0cf44ada045e6c4206ccd7825e8161c082d1
Instruction Fuzzy Hash: 3F210775704348DFDB05DF10D5C0B65BBA5FB84318F24C96DD81A4B282C33AD887CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0091D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1345480812.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ecacbc414d22aef6202187077ce60907c2b4648c2b07c20487017d8214e61a
Instruction ID: 3608912ae8ced5eaee9988fd6094b1987ffc45413178ae6ae1e9cf20df9c6897
Opcode Fuzzy Hash: 67ecacbc414d22aef6202187077ce60907c2b4648c2b07c20487017d8214e61a
Instruction Fuzzy Hash: 58210771608348EFDB08DF10D9C0B56BB65FB84314F24C56DD8094B296C33AD886CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0091D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1345480812.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: df5034cb245abda29bf93d1da23f68fe7fb0bca83fe7397abf88ed66bc073226
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: BA119D75604284DFCB06CF14D5C4B55BFB1FB84318F28C6AAD8494B696C33AD88ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05794360 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b8c37249d63e741f47b7051e822bc5a632ce0b46f061b3b4954847d7392467
Instruction ID: e0667b1d856ea2afa11c1fbbd12c9ca625fd00d2ea6b4b2dee2dc5f321c4ee9a
Opcode Fuzzy Hash: 38b8c37249d63e741f47b7051e822bc5a632ce0b46f061b3b4954847d7392467
Instruction Fuzzy Hash: DEE10A74E002198FDF18DF99D580AAEFBB2BF89305F248169E415AB356D730AD42DF60

Uniqueness

Uniqueness Score: -1.00%

Function 05794BD0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3001224732ef6de1ade8d8a697b7d32269a9b69878a207f2d14bb879d53c2d3
Instruction ID: e812b4e2355016a5446c5d3e4f8e874fbd5fda101ceb25f6e66a5846b2bc1107
Opcode Fuzzy Hash: f3001224732ef6de1ade8d8a697b7d32269a9b69878a207f2d14bb879d53c2d3
Instruction Fuzzy Hash: ECE10974E002198FDF18DFA8D580AAEFBB2BF89305F248169E415AB355D730AD42DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E240 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1345686426.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a081e3afc8b53ad4b0cc84f8d1cc6e5b11afb7e72f281fcc01f738436e2adb
Instruction ID: 55494c86f5a3415c37eae64a51d046ae69074174e2d1a29159c1cdcba22102b2
Opcode Fuzzy Hash: 30a081e3afc8b53ad4b0cc84f8d1cc6e5b11afb7e72f281fcc01f738436e2adb
Instruction Fuzzy Hash: AED11731D2071A8ADB11EB64D854ADDB3B5FFD5340F10C79AE0093B225EB74AAC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05798A90 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1350465703.0000000005790000.00000040.00000800.00020000.00000000.sdmp, Offset: 05790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5790000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb36261b58e61448d1b0e8fc88dc368614bdadab79514dfa27c8dca58206d593
Instruction ID: cd7e2ae0dd333df9a90667ded197579b1de488cafe1878ecb18793ba5dc44503
Opcode Fuzzy Hash: fb36261b58e61448d1b0e8fc88dc368614bdadab79514dfa27c8dca58206d593
Instruction Fuzzy Hash: A731BB71D096688BEF28CF6BDC053DAFAB7AFCA310F04C1EA841CA6255DB7405858F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Gcerti Quote.exePID: 7140, Parent PID: 968COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	169
Total number of Limit Nodes:	17

Executed Functions

Function 06DD55A8 Relevance: 1.8, Strings: 1, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06DD5C0E

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: db8ce362d3d01be755f40b2c2fcff76d8edac37b1ab3f9b624ba564e126228fe
Instruction ID: 0c9a0eba2b42f79aaab0e569a9564ce718bab77fd71166b64dc62a6ab3539a7a
Opcode Fuzzy Hash: db8ce362d3d01be755f40b2c2fcff76d8edac37b1ab3f9b624ba564e126228fe
Instruction Fuzzy Hash: 1622B175F002159FDF64EBA8E5806AEBBB2EF85310F24856AD416EB384DB35DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06DD2370 Relevance: 1.0, Instructions: 1006COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7e7e51c0a4ac99fb068cdcfd609e68a737999b1f5fd4be22a6eef164c93265
Instruction ID: fe696b3dd6a119cda79a1e3930eb41e0367baa93980b703368d7ec04ce106f95
Opcode Fuzzy Hash: eb7e7e51c0a4ac99fb068cdcfd609e68a737999b1f5fd4be22a6eef164c93265
Instruction Fuzzy Hash: EE926834E002048FDB64EF68C588A6DBBF2EF49315F5588AAD509EB361DB35ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06DD65E8 Relevance: .8, Instructions: 816COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bb3fb198dd5e3ef10c8c857da0307aab697b07c718025669a59d989aba9ace
Instruction ID: 19fa51f6c74d802ac8be32aa0a4bd5fbcb821e3e55e834eccada04e877cae8f0
Opcode Fuzzy Hash: 94bb3fb198dd5e3ef10c8c857da0307aab697b07c718025669a59d989aba9ace
Instruction Fuzzy Hash: 7B628C34B002459FDB54EB68D994AADB7F2EF88354F148469E40AEB390DB35ED42CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06DDC170 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d6b94aa4528004362e581c607b33f7c8e7fd5d13dce581549944ff3f83144e
Instruction ID: 18878b43673b0710b5502ae987d11a127739ed1628ddeb392964f60a0cbdb9a9
Opcode Fuzzy Hash: 60d6b94aa4528004362e581c607b33f7c8e7fd5d13dce581549944ff3f83144e
Instruction Fuzzy Hash: 9F328134B102059FDF54EB68E894BAEB7BAFB88310F148929D509E7351DB35EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DDB220 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa0011902fa512a50128675278fd8c3aa82f5f7ef486e676b4b4cbcfa028781
Instruction ID: 4b17c835a11bf050b0517981e6e7d772003380812976ac31ecd04f62c44e8b31
Opcode Fuzzy Hash: 0fa0011902fa512a50128675278fd8c3aa82f5f7ef486e676b4b4cbcfa028781
Instruction Fuzzy Hash: B622A4B0F002099BEF60EB5DD4907ADB7B2FB89318F658527D445EB391CA35DC818B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3060 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d168dbaef9bd2792120012a1d22471f918d750151c1bceaccf7d7c5967bb881b
Instruction ID: a185dd4ca119b54fa2a22950457a74b80fd1050960ca4f40357b0a06ba1dab60
Opcode Fuzzy Hash: d168dbaef9bd2792120012a1d22471f918d750151c1bceaccf7d7c5967bb881b
Instruction Fuzzy Hash: 57323E30E10719CBDB15EF69D8945ADB7B2FFC9300F51C6AAD409AB250EB30AD85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7D78 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10dafb3c5b2cebd75bf5eb800b1d4903c5c1122f9c1c85fb319256d6c2dc90f
Instruction ID: 74a741b4add39084d3ef3e6c422793994665fde28a78e624ad0b4c0d83488b9d
Opcode Fuzzy Hash: e10dafb3c5b2cebd75bf5eb800b1d4903c5c1122f9c1c85fb319256d6c2dc90f
Instruction Fuzzy Hash: 82028A30B002059FDB55EB69E894BAEB7B2FF88310F148569D805EB394DB75ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015A2B3A Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015A2BC6
GetCurrentThread.KERNEL32 ref: 015A2C03
GetCurrentProcess.KERNEL32 ref: 015A2C40
GetCurrentThreadId.KERNEL32 ref: 015A2C99

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b2e3b6e0bd17fe5349a9b1beac3e7e2c634838ada861270d2b86789a10a35301
Instruction ID: 6da3a22fc2daed16388a68a3250e9f842409392ada82885a3db38ec27ae6917b
Opcode Fuzzy Hash: b2e3b6e0bd17fe5349a9b1beac3e7e2c634838ada861270d2b86789a10a35301
Instruction Fuzzy Hash: C25155B09003498FEB14CFAAD948B9EBBF1FB48314F20845EE418AB290D7755944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 015A2B48 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015A2BC6
GetCurrentThread.KERNEL32 ref: 015A2C03
GetCurrentProcess.KERNEL32 ref: 015A2C40
GetCurrentThreadId.KERNEL32 ref: 015A2C99

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 99a627700abff86c66bdbe0de88df722a1b7f83ec5c442ddd168b5022a8218a6
Instruction ID: 7ae228ee649858402d36ac952a2901b445f04e4f524c6e4a51298045bc04e402
Opcode Fuzzy Hash: 99a627700abff86c66bdbe0de88df722a1b7f83ec5c442ddd168b5022a8218a6
Instruction Fuzzy Hash: D75154B09007498FEB18CFAAD948B9EBBF1BB48314F20845DE419AB390D7749944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 015AB1D0 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015AB436

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4b24db8ceb73b79a1546e262fcaa841100f39aa062ed2eb9124902b558383aaa
Instruction ID: 8f31afbaa4e4207bc8451eabb31775a832366a6053dbbbc9498d950c1318f067
Opcode Fuzzy Hash: 4b24db8ceb73b79a1546e262fcaa841100f39aa062ed2eb9124902b558383aaa
Instruction Fuzzy Hash: 938135B0A00B058FEB24DF6AD04475EBBF1FF88210F508A2ED48ADBA40D775E945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 015AD350 Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f249c43b6854681e7820bb428367f81e2b294afdbf2d9edcdfa04c2be67211
Instruction ID: 140261309d25b5ca61bcccbb54958e2d8e840feb930481c6770845ff1d80f458
Opcode Fuzzy Hash: 01f249c43b6854681e7820bb428367f81e2b294afdbf2d9edcdfa04c2be67211
Instruction Fuzzy Hash: 6651FFB1D00349AFDF15CFA9C984ADEBFB2BF48310F54816AE908AB620D3719855CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015AD3B0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 015AD4C2

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1415cb0459ed265956868c8518ed8e90ebf2595e037873873ec2ad2076290546
Instruction ID: 357d9c4e80be33e8cbfbd7c09f6a8ca5ca63fb9a98b625801fa691ea57d18c04
Opcode Fuzzy Hash: 1415cb0459ed265956868c8518ed8e90ebf2595e037873873ec2ad2076290546
Instruction Fuzzy Hash: A741B2B1D003099FEB14DF9AD984ADEBFB5BF48310F64812AE819AB250D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015AA8AC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 015AFBB1

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c8aef0a87028634972f7db17da198e8193003e91e15b4e160b64c56ce4bc9abf
Instruction ID: 8dcc1e5c1870a073bfe28543a7e17caa6734ea54ee820850a8e052baf0f82d87
Opcode Fuzzy Hash: c8aef0a87028634972f7db17da198e8193003e91e15b4e160b64c56ce4bc9abf
Instruction Fuzzy Hash: 1C4117B4900309DFDB14CF99C488AAEBBF5FB88314F24C859E519AB321D774A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 015A2D88 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015A2E17

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e89cad4627f7b47073b36bb03393e014e80136b3158dab335dcdee5619da5a9d
Instruction ID: 50fbd846f1e12bab9711f3643acede62a4b735cdea28b052f05071ca15752646
Opcode Fuzzy Hash: e89cad4627f7b47073b36bb03393e014e80136b3158dab335dcdee5619da5a9d
Instruction Fuzzy Hash: 3021D2B5D003099FDB10CFAAD585AEEBBF4FB48320F14846AE914A7350D378A954CF61

Uniqueness

Uniqueness Score: -1.00%

Function 015A2D90 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015A2E17

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e064e4b440a52b6d32b6aedbdf434c83f5905efc322d7a09da2bb1f2750b3872
Instruction ID: 880d2f9a2765ed4b99a175a0157fb2a8b94bb8e85783ee3febf09a3d7f0791f3
Opcode Fuzzy Hash: e064e4b440a52b6d32b6aedbdf434c83f5905efc322d7a09da2bb1f2750b3872
Instruction Fuzzy Hash: 5521E4B59003099FDB10CF9AD584ADEBBF4FB48320F14841AE914A7350D374A950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 018CEB40 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 018CEBAF

Memory Dump Source

Source File: 00000002.00000002.2576852846.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_18c0000_Gcerti Quote.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 942bbd53b45792da82258bbeebaf06e9af9141f3540cfbd7dffc2e29c60540b9
Instruction ID: 244ed7d0fdf2a51d34538fd96fcd272b4bb56c6c2a3137447ac079e518a0d5b2
Opcode Fuzzy Hash: 942bbd53b45792da82258bbeebaf06e9af9141f3540cfbd7dffc2e29c60540b9
Instruction Fuzzy Hash: BB1103B2C006599FDB10CF9AC544BDEFBB4AF48320F15816AE918B7240D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015AA5E8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015AB4B1,00000800,00000000,00000000), ref: 015AB6A2

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0c4c6b071098bae9c64fc3ab9e77eac989dd12b170efacd4be8038a9a9bb5156
Instruction ID: 13d5d557a2ff279c57c2930cac917872c3b1ca82a9b4ad697e3b09fe716be462
Opcode Fuzzy Hash: 0c4c6b071098bae9c64fc3ab9e77eac989dd12b170efacd4be8038a9a9bb5156
Instruction Fuzzy Hash: E81114B69003099FDB10CF9AD844ADEFBF4FB58310F14842EE919AB200C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 015AB632 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,015AB4B1,00000800,00000000,00000000), ref: 015AB6A2

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a31e74a94bc7cdd8edb9c09f25de90b00db387d1213cd424c1bd39e2b9632617
Instruction ID: e8ebd38b3107c96f3af604c4004acaed14ba1e208d7243b9c2e98366a69d4b63
Opcode Fuzzy Hash: a31e74a94bc7cdd8edb9c09f25de90b00db387d1213cd424c1bd39e2b9632617
Instruction Fuzzy Hash: 5521F2B68003098FDB20CF9AD444AEEFBF4BB88320F10842ED419A7600C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 018CEB48 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 018CEBAF

Memory Dump Source

Source File: 00000002.00000002.2576852846.00000000018C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 018C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_18c0000_Gcerti Quote.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a6febd69d09f2388e5f6cfa71b8bb693bff7c7a0bd5e7e3bb65321ed5447af7f
Instruction ID: 0c03afdaf33763041f0395548531f7ff6e50ff2dfb48b0e46d3c6fd8cbf327db
Opcode Fuzzy Hash: a6febd69d09f2388e5f6cfa71b8bb693bff7c7a0bd5e7e3bb65321ed5447af7f
Instruction Fuzzy Hash: CE11E4B1C006599BDB10CF9AD544BDEFBF4AF48320F15816AD918B7240D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 015AB3D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015AB436

Memory Dump Source

Source File: 00000002.00000002.2575510541.00000000015A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_15a0000_Gcerti Quote.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bc7c3247efb47c150dac2f5ded66c71c66a2facc07fb7ed19f2fa763fd824a51
Instruction ID: 7b134ba851c01a411d4691bb62c3ab1c3fd23b25b120df06496291b7dd833bf6
Opcode Fuzzy Hash: bc7c3247efb47c150dac2f5ded66c71c66a2facc07fb7ed19f2fa763fd824a51
Instruction Fuzzy Hash: 02110CB6C002498FDB20CF9AD444A9EFBF5AF88220F14842AD928B7200D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DDCF28 Relevance: .8, Instructions: 805COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecdafa927286c73cbca9120d2eb8f38070ebe782620d6940b64580c71ebe41b
Instruction ID: 71ebc07046afe2fde9db1a991c93e559c70aa5536cbdc3e0814ee439d63df086
Opcode Fuzzy Hash: 9ecdafa927286c73cbca9120d2eb8f38070ebe782620d6940b64580c71ebe41b
Instruction Fuzzy Hash: 49624770B0030ACFDB55EB68E990A5DB7E6FF88350B208A68D0059F355DB35ED86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDB648 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace8028c6f6faa846f2583125b987d95912caa3eb6ea82c4bf630bf02f71b2a5
Instruction ID: e6faaec26e52262816adf12dfff9d9234f2956c5f5bfe05176b59bb06d537bcf
Opcode Fuzzy Hash: ace8028c6f6faa846f2583125b987d95912caa3eb6ea82c4bf630bf02f71b2a5
Instruction Fuzzy Hash: 04027DB0E002099FDBA4EB68D4807ADB7B2FB49318F16852BD445EB381DB75EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDACC8 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc537445c16834a9092ed284759e66cecbb9683b1cf41f5dd4e9ed158b77f6c
Instruction ID: b4a02025350fa0085226bb5fba8c47b1a43de39c9b900941a1f407a5af2e79c5
Opcode Fuzzy Hash: dbc537445c16834a9092ed284759e66cecbb9683b1cf41f5dd4e9ed158b77f6c
Instruction Fuzzy Hash: 03E16C70F102098FDB65EBA8D4846AEB7B6FF88310F24852AD805EB344DB75DD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9148 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57a5a9228c4d22d61aba2c98fc4d6c02208f36f61845a7cc18dffd6f82ddcc8
Instruction ID: 21e71e4795406d75365ecb022a2ea63a6134aaaae0d746d8b253a5c59a73f771
Opcode Fuzzy Hash: a57a5a9228c4d22d61aba2c98fc4d6c02208f36f61845a7cc18dffd6f82ddcc8
Instruction Fuzzy Hash: C9913E31B102098BDB54DB69D860BAEB7B6FFC8300F5485A9D809EB384EB759D418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD61E8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7c65ac4b7fac33b90e253e2df348e23ba738056697aed47900d4fbfb376806
Instruction ID: 89f1ce8926d836aad16c42112ef3e23b2a280b3e3d8ade4a096d6764e70807e5
Opcode Fuzzy Hash: 5d7c65ac4b7fac33b90e253e2df348e23ba738056697aed47900d4fbfb376806
Instruction Fuzzy Hash: B261C471F001114BDF61AB7EC99466EBAE7AFD4620F194039D80AEB364DEB5DC0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 06DD42A0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2167ea1333640dfc7ec50e1461d6b33688520e3b1a3369f0c603239ef9b7807a
Instruction ID: 2445ae17673240e31fc78715608182043da2d28f58f742add2a9c06d7d63cd8d
Opcode Fuzzy Hash: 2167ea1333640dfc7ec50e1461d6b33688520e3b1a3369f0c603239ef9b7807a
Instruction Fuzzy Hash: 2F816030B002098BDF55DFA9D4A47AEB7F2AF89300F108569D40AEB394EB75DC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD45C0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a44b8283f1a6989195eaba15e62b3a161954ac1b3293491e363818e455130f
Instruction ID: 905cc86a6c426aba20965332ead4c2401bca1b60fc4112030098a09278a13435
Opcode Fuzzy Hash: 23a44b8283f1a6989195eaba15e62b3a161954ac1b3293491e363818e455130f
Instruction Fuzzy Hash: 92913E30E002199FDF60DF68C890B9DBBB1FF89310F208599D549AB295DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD45D8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4e8dfa5ca531cdfc3edbe4b3b573ca3359a883f99773035d9fd54521f5898b
Instruction ID: a298f1d32de665ba3a944ff4218bff634828b2ddfb06440bb368e27dd7e7ffb4
Opcode Fuzzy Hash: 5c4e8dfa5ca531cdfc3edbe4b3b573ca3359a883f99773035d9fd54521f5898b
Instruction Fuzzy Hash: 7E913C30E106199BDF60DF68C890BDDB7B1FF89310F208699D549BB284DB71AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDEAE8 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df4aedf9861bc55b666311628599090b077351d890ac0a6f2266e27e222ebdd
Instruction ID: aec29447bbd71dbeb4200cc10bb007d59060837e9d0312f705dc1a9e876d6f7b
Opcode Fuzzy Hash: 3df4aedf9861bc55b666311628599090b077351d890ac0a6f2266e27e222ebdd
Instruction Fuzzy Hash: 73713B70B006099FDB54EBA9D980AADBBF6FF88310F148429D415EB255DB30ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDEAF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fe4714bec2e9a273bee0a4c89a80758fc5ed62a1fd244db4b411db4d4bd341
Instruction ID: 346191917a722334e51cc7790b8cbdfc14fcb9e16eeda6e33873651864e0cb14
Opcode Fuzzy Hash: b8fe4714bec2e9a273bee0a4c89a80758fc5ed62a1fd244db4b411db4d4bd341
Instruction Fuzzy Hash: 89712A70B002099FDB54EBA9D980AADBBF6FF88310F248429D415EB354DB34ED46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD4B70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb451a63e2246ad433ae45095d48be7a38e2addead6747496eb60fa2adfa039
Instruction ID: 04e8ffeda3578623021a1369170f1ee5c0ee7926abe904a5e3bba2dc2eb27b5c
Opcode Fuzzy Hash: 3bb451a63e2246ad433ae45095d48be7a38e2addead6747496eb60fa2adfa039
Instruction Fuzzy Hash: B3616E30B002099FEB54AFA9C8147AEBBF6FFC8310F208429D506EB394DB758D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDFC61 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5333ad20844562db7727aaf59acecafbb41eb817c7dc932f3b2905ce4651b6
Instruction ID: 2c060d41e081b7b423578b50901ceff78ee0cb382926a4f327c49e798357767b
Opcode Fuzzy Hash: cd5333ad20844562db7727aaf59acecafbb41eb817c7dc932f3b2905ce4651b6
Instruction Fuzzy Hash: 6D51C036E00205DFDB64BFB8E4986ADB7B2EB88311F10886AE507DB350DB359D55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06DDFA11 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb39f825a21ac7cf7c147faa9d5a33e5f1cf7d904b0b4cbafa8f140c2b148495
Instruction ID: 66e157221c20a4d39508bb7ee4984a02ee3853baffdbee494655755cc003671d
Opcode Fuzzy Hash: eb39f825a21ac7cf7c147faa9d5a33e5f1cf7d904b0b4cbafa8f140c2b148495
Instruction Fuzzy Hash: F0518570B103049BEF64A76CE898B6F266EE78D750F20842AE50BC73D5C979CC4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9137 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a5222c2875b0cd4c3aaee709d9e61130582dd63f581d8afbc809fb29580649
Instruction ID: 977729b2b532f81e870c053967311f17045c11d4113306884d2c2a0bced49f04
Opcode Fuzzy Hash: a1a5222c2875b0cd4c3aaee709d9e61130582dd63f581d8afbc809fb29580649
Instruction Fuzzy Hash: 8A516F30B002059FDB54EB68E8A0B6E77F6FBC8300F548469D809EB394EF769C418B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDFA20 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdec2d8aa6fc1e4601f8ac3fabced1a7473dbc41cd6061d10809446995c7ce26
Instruction ID: 4104fe477f91abcb1ef52fe998f1fde0eacb94c4557c50daad2b3fedeab45213
Opcode Fuzzy Hash: cdec2d8aa6fc1e4601f8ac3fabced1a7473dbc41cd6061d10809446995c7ce26
Instruction Fuzzy Hash: 5E516674B103149BEF64A76CE898B2F266EE78D750F20842AE50BD73D4C979CC4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 06DD5418 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4f916484ed079e4f324784117d8bba52945fdb3410a748c72b013ccf6c11bd
Instruction ID: 83c3386b4e556c18216dc02e142e31db8fa368651459287fd1abbdabe95a170e
Opcode Fuzzy Hash: 1e4f916484ed079e4f324784117d8bba52945fdb3410a748c72b013ccf6c11bd
Instruction Fuzzy Hash: 03416F72E006098FDF71DF99E880ABFB7B2FB88310F10492AE156D7650D730E9558B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DDDA9D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d731a8b4d8278f9192304f875f64c4b625fe7afda86655dc66393e78d93032a
Instruction ID: bb72471d149bae5c32de468b75c6afda6797af268e25156f33502f0e4dd8ac01
Opcode Fuzzy Hash: 6d731a8b4d8278f9192304f875f64c4b625fe7afda86655dc66393e78d93032a
Instruction Fuzzy Hash: E7416E30E003099FDF64EFA9D8946AEBBB6BF85244F118529E805EB240DB71D946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD4B60 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abace0cbd837bfacbabf0ecb67fe55302296fddb039aa7bc288c3b4eaca8bed
Instruction ID: a8d337beaec386285f3d0778aadaa9c4334f3f920217e306e7c981788938332f
Opcode Fuzzy Hash: 2abace0cbd837bfacbabf0ecb67fe55302296fddb039aa7bc288c3b4eaca8bed
Instruction Fuzzy Hash: 98418074B002099FEB549FA9C814BAEBBF6FFC8710F208529D505EB394DB759C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD21E5 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f66d61d08842eeb083c32100aa4099857079d4460535bbbe96d54c9b485bb69
Instruction ID: e481857333d9070a09578b4e53724354518ed8de872912326e70c6f13c8069ed
Opcode Fuzzy Hash: 1f66d61d08842eeb083c32100aa4099857079d4460535bbbe96d54c9b485bb69
Instruction Fuzzy Hash: F0312131B102028FCB68AB78D45866E7BE3AB89304B14886CE502DB350DF36CE06CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06DD21F8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754a77f107492ac0863c9287f371addb6ea718b267ba899865f70b9b6fd2db98
Instruction ID: 05745713cfaac9abeba7670235618502324b053c3d00295249d6f6de24ca1d55
Opcode Fuzzy Hash: 754a77f107492ac0863c9287f371addb6ea718b267ba899865f70b9b6fd2db98
Instruction Fuzzy Hash: B231D030B102068FDB65AB78D45866E7BA6BBC9314B14886CE406DB394DF35DE06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DDD950 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caff7e2ed8f4056c279198862a6442831a1284d1a1d873a3b24571ea08fcd010
Instruction ID: 0802ddb822899869b60e2218c0d47bd396d8517b0dd3b6a00e4d90119489e595
Opcode Fuzzy Hash: caff7e2ed8f4056c279198862a6442831a1284d1a1d873a3b24571ea08fcd010
Instruction Fuzzy Hash: 94318470E107099BDF25DF69D890A9EB7B6FF85340F108529E805EB200EB71E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06DD20A8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28244933a049d837a392a3b306e8d36a58087d927425222b4ec8980ebff33c2
Instruction ID: f2a8a3b8fe86d059658211f58b45cb102ff594930ce64e4c9821e30b3e6fbe2d
Opcode Fuzzy Hash: d28244933a049d837a392a3b306e8d36a58087d927425222b4ec8980ebff33c2
Instruction Fuzzy Hash: 96318D30E102059BCB59DF69D89469EBBF2FF89300F50C529EA06EB750DB31AE42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD20B8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455c7e370ea77a0c7315417502eacc3ade37d124bf14f8b0167c6d453252293f
Instruction ID: 2991deb36c08c3c1ac713023c3b9fb60bb0612a3710ee7978cd197bdc13f48c7
Opcode Fuzzy Hash: 455c7e370ea77a0c7315417502eacc3ade37d124bf14f8b0167c6d453252293f
Instruction Fuzzy Hash: 1A316C30E106059BCB59DF69D89469EB7B2FF89300F50C529EA06EB750EB71AE42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3AA0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321916350ff6444333743ebbf4aba7720f443efa87b0722be11dd99114ec0402
Instruction ID: 34811a78843ec9021886cc6768945a8cd673938a329ae5388cfd68c2db13314d
Opcode Fuzzy Hash: 321916350ff6444333743ebbf4aba7720f443efa87b0722be11dd99114ec0402
Instruction Fuzzy Hash: 99216D71F006059FDB50DF7DE880AAEBBF5EB88750F128026E905EB380E734D9418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3AB0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8708eedd1d1cf3cd00b16e750a9b363a655ea2af0d2df66eb83809041ed97fb
Instruction ID: cdc33f816fbbf27318551a354edbc9910010fb0068d830911fe148f7f858d35b
Opcode Fuzzy Hash: e8708eedd1d1cf3cd00b16e750a9b363a655ea2af0d2df66eb83809041ed97fb
Instruction Fuzzy Hash: 8F216975F006159FDB50DF6DE880AAEBBF1EB88750F15806AE905E7380E734DC008BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0182D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2576166764.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_182d000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520384230427c336e1bf50fe23fc0b9b6960537a2a9c541efdf9d9bea757fe81
Instruction ID: 66b815ffd96a6ce12d3c270cfe815639c27d1f3d9ab02379084eb3494b132acb
Opcode Fuzzy Hash: 520384230427c336e1bf50fe23fc0b9b6960537a2a9c541efdf9d9bea757fe81
Instruction Fuzzy Hash: 61213771504344DFDB12DF54D9C0B26BFA5FB84318F24C66DD8098B2A2C33AD987CA62

Uniqueness

Uniqueness Score: -1.00%

Function 06DD6D10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc6006426d7c1e42866e9c9f1e0422f820dba814a4f2d01b43c9723f6be42de
Instruction ID: 26a5346932f0a9a7be47549782331d7ba7965d1268dd45a5a1926b7d839e14ab
Opcode Fuzzy Hash: 1fc6006426d7c1e42866e9c9f1e0422f820dba814a4f2d01b43c9723f6be42de
Instruction Fuzzy Hash: 52217231B101199BDF44EB6DF8546ADB7B6EBC4350F248469D405EB390DB36ED418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3BC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bbdddafce214114f66b5939861ced0bfa5a156f9c4d59aee60edd49a14dc2c
Instruction ID: 24ef1f8668228f6d9bb15b8880453f4a58b69fe44487209934414cda048e0914
Opcode Fuzzy Hash: c1bbdddafce214114f66b5939861ced0bfa5a156f9c4d59aee60edd49a14dc2c
Instruction Fuzzy Hash: 99117C32B101288BCB55AA6CD8546AE76B6ABC9351B05853AD806E7390EF25DC028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DD4200 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7baafde4f6013fb678e15b98690870aabc037d454599af93cf9b063c97d457f8
Instruction ID: bd02eeb8702750dff4bea9a9d7a7750572b3630cb6f8fd070d81ea16c222bb2e
Opcode Fuzzy Hash: 7baafde4f6013fb678e15b98690870aabc037d454599af93cf9b063c97d457f8
Instruction Fuzzy Hash: 4F01D831B045100BDB7197BDA85471BBBDADBCA724F10843EE50ACB392EE75DC024391

Uniqueness

Uniqueness Score: -1.00%

Function 06DDA300 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5194e89fd7fa04f627b4417bf0bc4ea4071f593bb3a1922d45debdd4ff30c21
Instruction ID: c2f6bc8b88105f5daba0068ac7fe5644fce7801d8a11ae2ffb5a7f63e9bc906f
Opcode Fuzzy Hash: c5194e89fd7fa04f627b4417bf0bc4ea4071f593bb3a1922d45debdd4ff30c21
Instruction Fuzzy Hash: 2101D471B142100FD751A7BCE854B1FB7EAEB8A720F14C82DE50ACB351EA65EC0183E6

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3BB0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee04294d720f4574db10c6d4dfdebf3a4c8156a9c74b84e2c826f93a001a517
Instruction ID: 7e8b10b4c96e79e11d1af45c833cffd797a26cf856e220abea0aeac386e8b8aa
Opcode Fuzzy Hash: aee04294d720f4574db10c6d4dfdebf3a4c8156a9c74b84e2c826f93a001a517
Instruction Fuzzy Hash: 6701D476F104284BCF98966CDC246BB32EAEBC5360F02413AD406E7280EE65CC0147E2

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3878 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b3921f13367c4a9a0f68b85f7e12a116651f70f6ee0fc77af3ddc5e7cd0a38
Instruction ID: 15e7376c60098c522a4e7d6d155de0c500a457318609310ad4a4da03a791b02e
Opcode Fuzzy Hash: d6b3921f13367c4a9a0f68b85f7e12a116651f70f6ee0fc77af3ddc5e7cd0a38
Instruction Fuzzy Hash: E521C2B5D01259AFDB10DF9AD884ACEFBB4FB49310F50812AE918A7340D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DDED69 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67e09a132eaa288cc47decd37f38692f0d3259ca9a075046869ad920386097a
Instruction ID: e74ca7f466c94608330503897d7c4c2a51bbd03856f5dc8d0259c6488fff1824
Opcode Fuzzy Hash: b67e09a132eaa288cc47decd37f38692f0d3259ca9a075046869ad920386097a
Instruction Fuzzy Hash: 0E01D435B041600BCB66AB7CA854B2B6BD6DBCAB20F14842AE10ACB385DE34DC0683D1

Uniqueness

Uniqueness Score: -1.00%

Function 0182D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2576166764.000000000182D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0182D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_182d000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: af14f1678b0fbc71bcbef7e20f8463bc72e040478339172d77816f90d8f6f4e4
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 2611BB75504280CFCB12CF54D5C0B15FFA1FB84314F28C6AAD8498B6A6C33AD48ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3880 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229612fa53040ce30c166054343a9d03e21da839740691bad662d1817cba04a2
Instruction ID: 1103a340d29bec7b57ae2b56f6a5e11c105e9fbda6ac6af273d13807b0045d12
Opcode Fuzzy Hash: 229612fa53040ce30c166054343a9d03e21da839740691bad662d1817cba04a2
Instruction Fuzzy Hash: 0711D0B5D01259AFDB00DF9AD884ACEFBB4FB49320F10812AE918B7340D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06DD4210 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7c70230adebfc0ea87594c1cf729a6c36a15b70763774b20ca034d9afd34f7
Instruction ID: 109317b7612d37dc5b97713707a8c58b4e29df08f6d99fcd5ed336bcae182c8d
Opcode Fuzzy Hash: ad7c70230adebfc0ea87594c1cf729a6c36a15b70763774b20ca034d9afd34f7
Instruction Fuzzy Hash: 11016D31B001100BDB64AAADA49472BBBDAEBC9724F10883DE50AC7395EE75DC024395

Uniqueness

Uniqueness Score: -1.00%

Function 06DDED78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372d15be01800898432ba05db320e33320eb6f5bdab108d1e624d2fbfa78281c
Instruction ID: 0d0dd9b34b4161ef6442147734b9a7e03d1188949e52a8d1683b5033dfb3a036
Opcode Fuzzy Hash: 372d15be01800898432ba05db320e33320eb6f5bdab108d1e624d2fbfa78281c
Instruction Fuzzy Hash: 5E01A435B101100BDB65AA6DA85472F67DADBC9720F10883DE50ECB345EE25EC0243D1

Uniqueness

Uniqueness Score: -1.00%

Function 06DDA310 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e318b22b75cf730f64f0f5e6934659501686305d61bdc99758fb62170215bf
Instruction ID: 47beaff3c0d5db7c7d13eaf3313f86c9dad8479318e2b83efed739aa3b63347a
Opcode Fuzzy Hash: 34e318b22b75cf730f64f0f5e6934659501686305d61bdc99758fb62170215bf
Instruction Fuzzy Hash: 35018C70B101104BDB61ABACE454B2EB3E7EB89720F54C83DE60AC7351EA26EC0283C5

Uniqueness

Uniqueness Score: -1.00%

Function 06DD6469 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2584342374.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_Gcerti Quote.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba58a940c26efcc6d8a359d03a06a3bfb6d862986f28ec0e59c6b1f3095c8d3d
Instruction ID: 97585b5b4114f977537b83e637ddedd1371bf5e294a44f3e0ea29b12fbfa09d3
Opcode Fuzzy Hash: ba58a940c26efcc6d8a359d03a06a3bfb6d862986f28ec0e59c6b1f3095c8d3d
Instruction Fuzzy Hash: BDE0DF70E192486BDF60EBB0DD1575E7BAED746228F2088A6E804C7242E132DE4083D2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gcerti Quote.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gcerti Quote.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Gcerti Quote.exe

Function 05796F64 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 250
processCOMMON

Function 05796F70 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Function 00D0489C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 00D05CDC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95
COMMON

Function 05796CE1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
injectionCOMMON

Function 05796CE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Function 05796CE7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
injectionCOMMON

Function 05796DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Function 05796DD8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Function 05796B50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Function 05796C21 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMON

Function 05796C28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
memoryCOMMON

Function 05796A98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
threadCOMMON

Function 0579B869 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Function 05796AA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre