Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Analysis ID:	1431467
MD5:	0cddb3e724f9bb0314bf8c50db240cf0
SHA1:	8018274d23411ab33bf16168036de21e2790aa0b
SHA256:	3ebacca195af8a57792fa7fa13c371bc68078d8c33f0d16220c6b65df1271d3e
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe" MD5: 0CDDB3E724F9BB0314BF8C50DB240CF0)

SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe (PID: 6464 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe" MD5: 0CDDB3E724F9BB0314BF8C50DB240CF0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.orako.co.ke", "Username": "infooo@orako.co.ke", "Password": "zVY1H)4,AgHi"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1236849879.0000000005C30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1233750900.0000000004089000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2479468346.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6464	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334a1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33513:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3359d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3362f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33699:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3370b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337a1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33831:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316a1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31713:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3179d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3182f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31899:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3190b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319a1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a31:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334a1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dec1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa86e1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33513:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df33:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8753:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3359d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfbd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa87dd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3362f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e04f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa886f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33699:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0b9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa88d9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3370b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e12b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa894b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337a1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1c1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa89e1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xaf6c1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xea0e1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x124901:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xaf733:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xea153:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x124973:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xaf7bd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xea1dd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1249fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xaf84f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xea26f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x124a8f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xaf8b9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xea2d9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x124af9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xaf92b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xea34b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x124b6b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xaf9c1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xea3e1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x124c01:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x12b8e1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x166301:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a0b21:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12b953:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x166373:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a0b93:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12b9dd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1663fd:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a0c1d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12ba6f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16648f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a0caf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12bad9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1664f9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a0d19:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12bb4b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16656b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a0d8b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12bbe1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x166601:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a0e21:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 34.195.165.88, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, Initiated: true, ProcessId: 6464, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49703

Snort Signatures

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.7 - Destination IP: 34.195.165.88

Timestamp:	04/25/24-08:25:09.444640
SID:	2839723
Source Port:	49703
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.7 - Destination IP: 34.195.165.88

Timestamp:	04/25/24-08:25:09.444640
SID:	2030171
Source Port:	49703
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.orako.co.ke", "Username": "infooo@orako.co.ke", "Password": "zVY1H)4,AgHi"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	ReversingLabs: Detection: 13%
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Virustotal: Detection: 26%			Perma Link

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Code function: 4x nop then jmp 0751F0ACh

0_2_0751EB56

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49703 -> 34.195.165.88:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.7:49703 -> 34.195.165.88:587

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 34.195.165.88:587

Source: Joe Sandbox View

ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: global traffic

TCP traffic: 192.168.2.7:49703 -> 34.195.165.88:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.orako.co.ke

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.orako.co.ke
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://orako.co.ke
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, 7KG.cs

.Net Code: aGi4VV2gZU

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_013EE3B4	0_2_013EE3B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_075108B0	0_2_075108B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751C791	0_2_0751C791
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751C7A0	0_2_0751C7A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751A592	0_2_0751A592
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751A5A0	0_2_0751A5A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07512150	0_2_07512150
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07512141	0_2_07512141
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751A168	0_2_0751A168
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07512117	0_2_07512117
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751BDF0	0_2_0751BDF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751CBD8	0_2_0751CBD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07513810	0_2_07513810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07513800	0_2_07513800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_0751089F	0_2_0751089F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07700040	0_2_07700040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_07700007	0_2_07700007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_01029378	3_2_01029378
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_01029BF8	3_2_01029BF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_01024A98	3_2_01024A98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_01023E80	3_2_01023E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_0102CE90	3_2_0102CE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_010241C8	3_2_010241C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F1DCF0	3_2_05F1DCF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F1BCD0	3_2_05F1BCD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F13F28	3_2_05F13F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F12EF0	3_2_05F12EF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F156B8	3_2_05F156B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F10040	3_2_05F10040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F18B78	3_2_05F18B78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F19AC0	3_2_05F19AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F14FD8	3_2_05F14FD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_05F13628	3_2_05F13628
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 3_2_01029BF2	3_2_01029BF2

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename80beecf9-d8bb-408c-a8dd-0d1f316d4d09.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1230844044.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1238231858.0000000009DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1232058646.000000000330F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename80beecf9-d8bb-408c-a8dd-0d1f316d4d09.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename80beecf9-d8bb-408c-a8dd-0d1f316d4d09.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2475121065.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Binary or memory string: OriginalFilenamewst.exe" vs SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, 1UT6pzc0M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, DnQOD3M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, 01seU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, iUDwvr7Gz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, XUu2qKyuF6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, aZathEIgR.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, dORaYORm5fJGaQ8iyt.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Mutant created: NULL

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	ReversingLabs: Detection: 13%
Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Virustotal: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, SpreadsheetName.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, dORaYORm5fJGaQ8iyt.cs	.Net Code: CB7hSpfH9l System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, dORaYORm5fJGaQ8iyt.cs	.Net Code: CB7hSpfH9l System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, dORaYORm5fJGaQ8iyt.cs	.Net Code: CB7hSpfH9l System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_05608E78 push eax; mov dword ptr [esp], ecx		0_2_05608E7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Code function: 0_2_05609951 push eax; ret		0_2_05609983

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Static PE information: section name: .text entropy: 7.967039469679906

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, y55w4XYrT05NJ8fEt8.cs	High entropy of concatenated method names: 'RL8dO2KAsa', 'hqjdYrSvnu', 'fGKdlANn9Q', 'tC0dcki6fh', 'zvHdIBvs2j', 'OmQdaceDfq', 'nW2dfkyTCM', 'uEVdpZYsqT', 'sFTdylimSh', 'LOXdRv8Tak'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, liy52BcVgrK9D3eV2g.cs	High entropy of concatenated method names: 'Mu9SpT8Tl', 'nskZuXp78', 'g5KvGtMOF', 'tZwxbhy1i', 'jIwuqqSM0', 'guV7aL1uB', 'gOdjroqGqSc8vI08ey', 'kr58qEDYQfLhiPv1ZP', 'XmYdLggqO', 'I0EQTTT6j'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, NqRetdwKyEQANgksvaT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VDeQWeo6YI', 'VDbQGAQb2C', 'OFpQDJcCm2', 'NjcQkCGH5Y', 'PkVQ03vo4P', 'VVVQwfreE7', 'eGAQo4laaL'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, v3p5tPww9U711rXVmOR.cs	High entropy of concatenated method names: 'ToString', 'U0vQefYDLX', 'QGaQh4OOkG', 'dH3QmihnYZ', 'b42QOtZZXv', 'u2gQY45ZQ3', 'nndQlG3FA2', 'rP6QckeSuc', 'oYcVmF9uO9EpDONMlCN', 'RfZVls9W2trhJ9yZERD'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, ucmfMisTFcsKjD2M54.cs	High entropy of concatenated method names: 'Dispose', 'hF24EddVEj', 'clVKss0oRi', 'KjoJJcs83Y', 'ihv48S7Hqp', 'Hij4zkZMmU', 'ProcessDialogKey', 'C5TKXwU8oA', 'qOOK4ZfogR', 'mFdKKvsF8F'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	High entropy of concatenated method names: 'UxYYWjZRIp', 't7nYGmOXsj', 'XJ3YD8MxWs', 'fc9YkvyZxd', 'k6HY0LnP2p', 'hgPYw2vyau', 'cNXYoSABXM', 'IsbYBncv6G', 'biKYECKVTu', 'zlmY8yuFhY'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, WqdwxofqOpLZq10lrf.cs	High entropy of concatenated method names: 'nYAi4tXolT', 'lXfiehmp5L', 'ak8ihkkZ61', 'VM2iOpbJjb', 'JRxiYv0crR', 'IqHiceYVJ2', 'so9iIYSutY', 'CdDdoDeXME', 'GhhdBjYqcm', 'UiYdEQEqLy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, dORaYORm5fJGaQ8iyt.cs	High entropy of concatenated method names: 'FvMemUbnfe', 'Wd9eONEj2M', 'Aa3eYTBdpC', 'HJyeldAeIZ', 'NDZecdWFVQ', 'vT7eIufrsE', 'SQkeaHC47N', 'glgefPsb5a', 'iXaepWK2th', 'Ygfeyb4tRG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, M0EuCRCCG3XyHGWKdZ.cs	High entropy of concatenated method names: 'D23a3JtAAR', 'sOcaL4Arlo', 'ytZaSxNUp8', 'u7naZd0N7w', 'FJIa2n7Fq7', 'pnTavQh62l', 'JNtaxerryV', 'UtBa1duKSG', 'eVjau8FKDI', 'Lgta7aGFUH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, zcrvAxZuxmnBJA23bK.cs	High entropy of concatenated method names: 'etiFBdPOr0', 'g5IF8eibvv', 'l3xdXeA7Df', 'IuXd4lwSVO', 'kASFAMhnPN', 'ubGFnkk47v', 'AdJFjtOg3d', 'b8ZFWTh1oO', 'dqdFG6mytc', 'zdTFD9NMnb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, JpbNvUPlp312cYnUNG.cs	High entropy of concatenated method names: 'b275HO8k2N', 'lf55nRJKJt', 'lpY5Wb61H9', 'u1Y5Gkeq7p', 'kdC5sXBDvU', 'O3X5rxlTVU', 'nCO5PYjO6X', 'Rjl5MiXZBJ', 'I2u5TMaRww', 'oTw5gQA7ZM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, CGpJ6owtIVw5ePQCG6T.cs	High entropy of concatenated method names: 't4Ti3qSMNa', 'j18iL199El', 'vM8iSkMy4I', 'NgwiZ7eC2Q', 'NwGi2kPKlL', 'luRivThSdp', 'HWhixbvVvc', 's2Di1SfAqd', 'x0tiuNr187', 'aaJi75reEU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, wFx1lvEKdkq6Xo2d2e.cs	High entropy of concatenated method names: 'D5q4aNqNZf', 'CUK4figavu', 'FIk4yFurs7', 'ET14RpDSCw', 'hIB45n5QE2', 'L8h4bVQY5y', 'v42I1dtCmvJJ5VXLfi', 'vPFYhTsBGcFfSASE8j', 'oK144fZE9y', 'Oo04eibZID'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, k8hVAwlW9m71gDlmPe.cs	High entropy of concatenated method names: 'lJ6aOJivFq', 'yK4al1jkBD', 'oHraIKQtFE', 'KrXI8c1TvD', 'unvIzid621', 'Eh7aX6fP0C', 'C44a4QonJG', 'eQPaKAmf8i', 'y7oaeVaYpA', 'LkaahLjSEG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, YF266j00O1igmilr8K.cs	High entropy of concatenated method names: 'wXRC1T244F', 'XWECuMZULj', 'xHjCUY8xKB', 'd1YCsMejOs', 'MBlCPq40QD', 'VolCM3SpTJ', 'V0oCgfNCbS', 'lIdCtnBZ82', 'en8CH7BnNI', 'TErCAFU2hn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, OhFXwUIhh9W5wbocTw.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'SmNKE66Bdr', 'wqcK8R9hNm', 'V5gKzORk0r', 'EOCeXISrJC', 'M49e4G8JQZ', 'H72eKGNT7W', 'p0NeefX7bC', 'JTGWUZISbS8LojYioXF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, xyCo7ZMN4Vd6lXUDIO.cs	High entropy of concatenated method names: 'uv8ImLtXYx', 'K54IYBqEEb', 'ytHIcJLWWF', 'MkyIa5Fdx4', 'zwwIf1XNUv', 'cZQc0MxVES', 'nPdcwJ5UBd', 'Abuco3HPI5', 'D0VcBo9KT3', 'H96cESLMBm'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, KRc7epz1PCU6q1v26X.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MwZiCrBY0G', 'QYIi58Ko8j', 'aTSibLRNgZ', 'upliFcHlO2', 'fNaid4T4bI', 'a4jiiYZ4LI', 'm1BiQewPK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, M9vABfOXDxbor8pHPm.cs	High entropy of concatenated method names: 'ToString', 'aWbbA5QReq', 'LAIbsL5Qa2', 'mGjbrG5MHr', 'krRbPjWRNk', 'y66bMnbPx3', 'hstbTRPcUi', 'kFVbgEbFXr', 'dKobtMRFBX', 'quEb9HMXWA'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, WlSBKFHkk2rC9q8gdm.cs	High entropy of concatenated method names: 'l6AdUVZ4lR', 'HWfdsN6iy6', 'BZZdrDdZMc', 'UWwdPAaStG', 'R6udWHVTsd', 'bGZdM97mMq', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, rDYk704Y4EKOqrDw6I.cs	High entropy of concatenated method names: 'FJdlZpw9gJ', 'LALlvCRsV4', 'zUBl1Tl7Wm', 'DJFluX5Fti', 'vyrl51491V', 'oIllbHwRx0', 'DPulFrNEoK', 'dRnldP8w0q', 'x7wli9TT9y', 'pDxlQJQpW1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, y55w4XYrT05NJ8fEt8.cs	High entropy of concatenated method names: 'RL8dO2KAsa', 'hqjdYrSvnu', 'fGKdlANn9Q', 'tC0dcki6fh', 'zvHdIBvs2j', 'OmQdaceDfq', 'nW2dfkyTCM', 'uEVdpZYsqT', 'sFTdylimSh', 'LOXdRv8Tak'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, liy52BcVgrK9D3eV2g.cs	High entropy of concatenated method names: 'Mu9SpT8Tl', 'nskZuXp78', 'g5KvGtMOF', 'tZwxbhy1i', 'jIwuqqSM0', 'guV7aL1uB', 'gOdjroqGqSc8vI08ey', 'kr58qEDYQfLhiPv1ZP', 'XmYdLggqO', 'I0EQTTT6j'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, NqRetdwKyEQANgksvaT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VDeQWeo6YI', 'VDbQGAQb2C', 'OFpQDJcCm2', 'NjcQkCGH5Y', 'PkVQ03vo4P', 'VVVQwfreE7', 'eGAQo4laaL'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, v3p5tPww9U711rXVmOR.cs	High entropy of concatenated method names: 'ToString', 'U0vQefYDLX', 'QGaQh4OOkG', 'dH3QmihnYZ', 'b42QOtZZXv', 'u2gQY45ZQ3', 'nndQlG3FA2', 'rP6QckeSuc', 'oYcVmF9uO9EpDONMlCN', 'RfZVls9W2trhJ9yZERD'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, ucmfMisTFcsKjD2M54.cs	High entropy of concatenated method names: 'Dispose', 'hF24EddVEj', 'clVKss0oRi', 'KjoJJcs83Y', 'ihv48S7Hqp', 'Hij4zkZMmU', 'ProcessDialogKey', 'C5TKXwU8oA', 'qOOK4ZfogR', 'mFdKKvsF8F'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	High entropy of concatenated method names: 'UxYYWjZRIp', 't7nYGmOXsj', 'XJ3YD8MxWs', 'fc9YkvyZxd', 'k6HY0LnP2p', 'hgPYw2vyau', 'cNXYoSABXM', 'IsbYBncv6G', 'biKYECKVTu', 'zlmY8yuFhY'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, WqdwxofqOpLZq10lrf.cs	High entropy of concatenated method names: 'nYAi4tXolT', 'lXfiehmp5L', 'ak8ihkkZ61', 'VM2iOpbJjb', 'JRxiYv0crR', 'IqHiceYVJ2', 'so9iIYSutY', 'CdDdoDeXME', 'GhhdBjYqcm', 'UiYdEQEqLy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, dORaYORm5fJGaQ8iyt.cs	High entropy of concatenated method names: 'FvMemUbnfe', 'Wd9eONEj2M', 'Aa3eYTBdpC', 'HJyeldAeIZ', 'NDZecdWFVQ', 'vT7eIufrsE', 'SQkeaHC47N', 'glgefPsb5a', 'iXaepWK2th', 'Ygfeyb4tRG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, M0EuCRCCG3XyHGWKdZ.cs	High entropy of concatenated method names: 'D23a3JtAAR', 'sOcaL4Arlo', 'ytZaSxNUp8', 'u7naZd0N7w', 'FJIa2n7Fq7', 'pnTavQh62l', 'JNtaxerryV', 'UtBa1duKSG', 'eVjau8FKDI', 'Lgta7aGFUH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, zcrvAxZuxmnBJA23bK.cs	High entropy of concatenated method names: 'etiFBdPOr0', 'g5IF8eibvv', 'l3xdXeA7Df', 'IuXd4lwSVO', 'kASFAMhnPN', 'ubGFnkk47v', 'AdJFjtOg3d', 'b8ZFWTh1oO', 'dqdFG6mytc', 'zdTFD9NMnb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, JpbNvUPlp312cYnUNG.cs	High entropy of concatenated method names: 'b275HO8k2N', 'lf55nRJKJt', 'lpY5Wb61H9', 'u1Y5Gkeq7p', 'kdC5sXBDvU', 'O3X5rxlTVU', 'nCO5PYjO6X', 'Rjl5MiXZBJ', 'I2u5TMaRww', 'oTw5gQA7ZM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, CGpJ6owtIVw5ePQCG6T.cs	High entropy of concatenated method names: 't4Ti3qSMNa', 'j18iL199El', 'vM8iSkMy4I', 'NgwiZ7eC2Q', 'NwGi2kPKlL', 'luRivThSdp', 'HWhixbvVvc', 's2Di1SfAqd', 'x0tiuNr187', 'aaJi75reEU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, wFx1lvEKdkq6Xo2d2e.cs	High entropy of concatenated method names: 'D5q4aNqNZf', 'CUK4figavu', 'FIk4yFurs7', 'ET14RpDSCw', 'hIB45n5QE2', 'L8h4bVQY5y', 'v42I1dtCmvJJ5VXLfi', 'vPFYhTsBGcFfSASE8j', 'oK144fZE9y', 'Oo04eibZID'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, k8hVAwlW9m71gDlmPe.cs	High entropy of concatenated method names: 'lJ6aOJivFq', 'yK4al1jkBD', 'oHraIKQtFE', 'KrXI8c1TvD', 'unvIzid621', 'Eh7aX6fP0C', 'C44a4QonJG', 'eQPaKAmf8i', 'y7oaeVaYpA', 'LkaahLjSEG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, YF266j00O1igmilr8K.cs	High entropy of concatenated method names: 'wXRC1T244F', 'XWECuMZULj', 'xHjCUY8xKB', 'd1YCsMejOs', 'MBlCPq40QD', 'VolCM3SpTJ', 'V0oCgfNCbS', 'lIdCtnBZ82', 'en8CH7BnNI', 'TErCAFU2hn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, OhFXwUIhh9W5wbocTw.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'SmNKE66Bdr', 'wqcK8R9hNm', 'V5gKzORk0r', 'EOCeXISrJC', 'M49e4G8JQZ', 'H72eKGNT7W', 'p0NeefX7bC', 'JTGWUZISbS8LojYioXF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, xyCo7ZMN4Vd6lXUDIO.cs	High entropy of concatenated method names: 'uv8ImLtXYx', 'K54IYBqEEb', 'ytHIcJLWWF', 'MkyIa5Fdx4', 'zwwIf1XNUv', 'cZQc0MxVES', 'nPdcwJ5UBd', 'Abuco3HPI5', 'D0VcBo9KT3', 'H96cESLMBm'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, KRc7epz1PCU6q1v26X.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MwZiCrBY0G', 'QYIi58Ko8j', 'aTSibLRNgZ', 'upliFcHlO2', 'fNaid4T4bI', 'a4jiiYZ4LI', 'm1BiQewPK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, M9vABfOXDxbor8pHPm.cs	High entropy of concatenated method names: 'ToString', 'aWbbA5QReq', 'LAIbsL5Qa2', 'mGjbrG5MHr', 'krRbPjWRNk', 'y66bMnbPx3', 'hstbTRPcUi', 'kFVbgEbFXr', 'dKobtMRFBX', 'quEb9HMXWA'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, WlSBKFHkk2rC9q8gdm.cs	High entropy of concatenated method names: 'l6AdUVZ4lR', 'HWfdsN6iy6', 'BZZdrDdZMc', 'UWwdPAaStG', 'R6udWHVTsd', 'bGZdM97mMq', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.9db0000.8.raw.unpack, rDYk704Y4EKOqrDw6I.cs	High entropy of concatenated method names: 'FJdlZpw9gJ', 'LALlvCRsV4', 'zUBl1Tl7Wm', 'DJFluX5Fti', 'vyrl51491V', 'oIllbHwRx0', 'DPulFrNEoK', 'dRnldP8w0q', 'x7wli9TT9y', 'pDxlQJQpW1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, y55w4XYrT05NJ8fEt8.cs	High entropy of concatenated method names: 'RL8dO2KAsa', 'hqjdYrSvnu', 'fGKdlANn9Q', 'tC0dcki6fh', 'zvHdIBvs2j', 'OmQdaceDfq', 'nW2dfkyTCM', 'uEVdpZYsqT', 'sFTdylimSh', 'LOXdRv8Tak'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, liy52BcVgrK9D3eV2g.cs	High entropy of concatenated method names: 'Mu9SpT8Tl', 'nskZuXp78', 'g5KvGtMOF', 'tZwxbhy1i', 'jIwuqqSM0', 'guV7aL1uB', 'gOdjroqGqSc8vI08ey', 'kr58qEDYQfLhiPv1ZP', 'XmYdLggqO', 'I0EQTTT6j'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, NqRetdwKyEQANgksvaT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'VDeQWeo6YI', 'VDbQGAQb2C', 'OFpQDJcCm2', 'NjcQkCGH5Y', 'PkVQ03vo4P', 'VVVQwfreE7', 'eGAQo4laaL'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, v3p5tPww9U711rXVmOR.cs	High entropy of concatenated method names: 'ToString', 'U0vQefYDLX', 'QGaQh4OOkG', 'dH3QmihnYZ', 'b42QOtZZXv', 'u2gQY45ZQ3', 'nndQlG3FA2', 'rP6QckeSuc', 'oYcVmF9uO9EpDONMlCN', 'RfZVls9W2trhJ9yZERD'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, ucmfMisTFcsKjD2M54.cs	High entropy of concatenated method names: 'Dispose', 'hF24EddVEj', 'clVKss0oRi', 'KjoJJcs83Y', 'ihv48S7Hqp', 'Hij4zkZMmU', 'ProcessDialogKey', 'C5TKXwU8oA', 'qOOK4ZfogR', 'mFdKKvsF8F'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, IDRN8MVUIJrA0SyCMB.cs	High entropy of concatenated method names: 'UxYYWjZRIp', 't7nYGmOXsj', 'XJ3YD8MxWs', 'fc9YkvyZxd', 'k6HY0LnP2p', 'hgPYw2vyau', 'cNXYoSABXM', 'IsbYBncv6G', 'biKYECKVTu', 'zlmY8yuFhY'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, WqdwxofqOpLZq10lrf.cs	High entropy of concatenated method names: 'nYAi4tXolT', 'lXfiehmp5L', 'ak8ihkkZ61', 'VM2iOpbJjb', 'JRxiYv0crR', 'IqHiceYVJ2', 'so9iIYSutY', 'CdDdoDeXME', 'GhhdBjYqcm', 'UiYdEQEqLy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, dORaYORm5fJGaQ8iyt.cs	High entropy of concatenated method names: 'FvMemUbnfe', 'Wd9eONEj2M', 'Aa3eYTBdpC', 'HJyeldAeIZ', 'NDZecdWFVQ', 'vT7eIufrsE', 'SQkeaHC47N', 'glgefPsb5a', 'iXaepWK2th', 'Ygfeyb4tRG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, M0EuCRCCG3XyHGWKdZ.cs	High entropy of concatenated method names: 'D23a3JtAAR', 'sOcaL4Arlo', 'ytZaSxNUp8', 'u7naZd0N7w', 'FJIa2n7Fq7', 'pnTavQh62l', 'JNtaxerryV', 'UtBa1duKSG', 'eVjau8FKDI', 'Lgta7aGFUH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, zcrvAxZuxmnBJA23bK.cs	High entropy of concatenated method names: 'etiFBdPOr0', 'g5IF8eibvv', 'l3xdXeA7Df', 'IuXd4lwSVO', 'kASFAMhnPN', 'ubGFnkk47v', 'AdJFjtOg3d', 'b8ZFWTh1oO', 'dqdFG6mytc', 'zdTFD9NMnb'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, JpbNvUPlp312cYnUNG.cs	High entropy of concatenated method names: 'b275HO8k2N', 'lf55nRJKJt', 'lpY5Wb61H9', 'u1Y5Gkeq7p', 'kdC5sXBDvU', 'O3X5rxlTVU', 'nCO5PYjO6X', 'Rjl5MiXZBJ', 'I2u5TMaRww', 'oTw5gQA7ZM'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, CGpJ6owtIVw5ePQCG6T.cs	High entropy of concatenated method names: 't4Ti3qSMNa', 'j18iL199El', 'vM8iSkMy4I', 'NgwiZ7eC2Q', 'NwGi2kPKlL', 'luRivThSdp', 'HWhixbvVvc', 's2Di1SfAqd', 'x0tiuNr187', 'aaJi75reEU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, wFx1lvEKdkq6Xo2d2e.cs	High entropy of concatenated method names: 'D5q4aNqNZf', 'CUK4figavu', 'FIk4yFurs7', 'ET14RpDSCw', 'hIB45n5QE2', 'L8h4bVQY5y', 'v42I1dtCmvJJ5VXLfi', 'vPFYhTsBGcFfSASE8j', 'oK144fZE9y', 'Oo04eibZID'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, k8hVAwlW9m71gDlmPe.cs	High entropy of concatenated method names: 'lJ6aOJivFq', 'yK4al1jkBD', 'oHraIKQtFE', 'KrXI8c1TvD', 'unvIzid621', 'Eh7aX6fP0C', 'C44a4QonJG', 'eQPaKAmf8i', 'y7oaeVaYpA', 'LkaahLjSEG'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, YF266j00O1igmilr8K.cs	High entropy of concatenated method names: 'wXRC1T244F', 'XWECuMZULj', 'xHjCUY8xKB', 'd1YCsMejOs', 'MBlCPq40QD', 'VolCM3SpTJ', 'V0oCgfNCbS', 'lIdCtnBZ82', 'en8CH7BnNI', 'TErCAFU2hn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, OhFXwUIhh9W5wbocTw.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'SmNKE66Bdr', 'wqcK8R9hNm', 'V5gKzORk0r', 'EOCeXISrJC', 'M49e4G8JQZ', 'H72eKGNT7W', 'p0NeefX7bC', 'JTGWUZISbS8LojYioXF'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, xyCo7ZMN4Vd6lXUDIO.cs	High entropy of concatenated method names: 'uv8ImLtXYx', 'K54IYBqEEb', 'ytHIcJLWWF', 'MkyIa5Fdx4', 'zwwIf1XNUv', 'cZQc0MxVES', 'nPdcwJ5UBd', 'Abuco3HPI5', 'D0VcBo9KT3', 'H96cESLMBm'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, KRc7epz1PCU6q1v26X.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'MwZiCrBY0G', 'QYIi58Ko8j', 'aTSibLRNgZ', 'upliFcHlO2', 'fNaid4T4bI', 'a4jiiYZ4LI', 'm1BiQewPK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, M9vABfOXDxbor8pHPm.cs	High entropy of concatenated method names: 'ToString', 'aWbbA5QReq', 'LAIbsL5Qa2', 'mGjbrG5MHr', 'krRbPjWRNk', 'y66bMnbPx3', 'hstbTRPcUi', 'kFVbgEbFXr', 'dKobtMRFBX', 'quEb9HMXWA'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, WlSBKFHkk2rC9q8gdm.cs	High entropy of concatenated method names: 'l6AdUVZ4lR', 'HWfdsN6iy6', 'BZZdrDdZMc', 'UWwdPAaStG', 'R6udWHVTsd', 'bGZdM97mMq', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, rDYk704Y4EKOqrDw6I.cs	High entropy of concatenated method names: 'FJdlZpw9gJ', 'LALlvCRsV4', 'zUBl1Tl7Wm', 'DJFluX5Fti', 'vyrl51491V', 'oIllbHwRx0', 'DPulFrNEoK', 'dRnldP8w0q', 'x7wli9TT9y', 'pDxlQJQpW1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack, V4uC3Iifq56IKQcfry.cs	High entropy of concatenated method names: 'JcqLcnHE8kRk7VHJhl', 'baAwnpSkPWAs4YMGxr', 'wTgrto4LNQ', 'imnL6GCB6AIFRqkhxN', 'RgtTUJcyZL', 'dHYrbjNADO', 'xiCr8b7Qs6', 'PT2rZj37UR', 'P1WruDgOtu', 'd71eKLY6YVFQv'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack, vpednoN8EZgsJ4TDwx.cs	High entropy of concatenated method names: 'SvRTLtpnA', 'uJwWpedno', 'REZpgsJ4T', 'uwxys3A5Q', 'Tl3iTkB7U', 'EqRFtDP16', 'TW5lfqidm', 'wSKAUGlNW', 'LkrevaXpK', 'cwu0Op5AT'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 13E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 7370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 8910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 9910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 9E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: AE30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: BE30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Window / User API: threadDelayed 3307

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 6908	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 6908	Thread sleep count: 3307 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99434s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -98094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe TID: 5196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99434	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99202	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98431	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2476005214.0000000000C48000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6464, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1236849879.0000000005C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1233750900.0000000004089000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6464, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 3.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4d762d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4cfa0b0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4c7de90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe PID: 6464, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.4089970.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.5c30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1236849879.0000000005C30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1233750900.0000000004089000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	13%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	26%	Virustotal		Browse
SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
orako.co.ke	1%	Virustotal		Browse
mail.orako.co.ke	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail.orako.co.ke	0%	Avira URL Cloud	safe
http://orako.co.ke	0%	Avira URL Cloud	safe
http://mail.orako.co.ke	1%	Virustotal		Browse
http://orako.co.ke	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
orako.co.ke	34.195.165.88	true	true	1%, Virustotal, Browse	unknown
mail.orako.co.ke	unknown	unknown	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.orako.co.ke	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://orako.co.ke	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe, 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.195.165.88	orako.co.ke	United States		14618	AMAZON-AESUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431467
Start date and time:	2024-04-25 08:24:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 89 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:25:04	API Interceptor	19x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.195.165.88	msaeteGWA0.exe	Get hash	malicious	AgentTesla	Browse
	Dec-Mar24 SOA PAYMENT.bat	Get hash	malicious	Unknown	Browse
	Purchase Order.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://app.milanote.com/1RZbnl1zfBXuaf?p=r2B66sphbV4	Get hash	malicious	Unknown	Browse	44.209.253.226
	http://decktop.us/gORiyf	Get hash	malicious	HTMLPhisher	Browse	3.216.69.202
	https://shining-melodic-magnesium.glitch.me/rvicendDev.html	Get hash	malicious	Unknown	Browse	44.214.198.122
	http://confirmartucuentamsnaquimx.hstn.me/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	HTMLPhisher	Browse	3.91.136.197
	http://electricalsworksflorida.com/j6u	Get hash	malicious	HTMLPhisher	Browse	52.72.49.79
	https://gamma.app/docs/Shared-Document-9j9g6z8iqo1w0uu	Get hash	malicious	HTMLPhisher	Browse	44.217.183.210
	https://in.xero.com/VmFUGq2DR0w0RroiyvWAWXw083jyp1tZyI3WNgUe?utm_source=invoiceEmailViewInvoiceButtonSecondary&utm_campaign=invoicesEmailStandardV2	Get hash	malicious	Unknown	Browse	52.200.154.95
	https://runrun.it/share/form/0SRuaDvcQOCgwT9F	Get hash	malicious	HTMLPhisher	Browse	34.196.171.164
	https://app.frame.io/presentations/da0e116a-d15f-430f-8c37-0aa7d783720f?component_clicked=digest_call_to_action&email_id=8abc710c-c18f-47f5-a884-e927cb8dcfaa&email_type=pending-reviewer-invite	Get hash	malicious	HTMLPhisher	Browse	18.235.222.209
	https://btcpike.top	Get hash	malicious	Unknown	Browse	3.225.233.10

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.941846608125575
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
File size:	720'896 bytes
MD5:	0cddb3e724f9bb0314bf8c50db240cf0
SHA1:	8018274d23411ab33bf16168036de21e2790aa0b
SHA256:	3ebacca195af8a57792fa7fa13c371bc68078d8c33f0d16220c6b65df1271d3e
SHA512:	e3a5d004c7f55ee037ff375d235e6cb1d69b5b6733b253068ac2486d7c5c66352d842dd730f2b5ff80bd1e533c2eb6e8e7ffa87b9d65c1367d3e965618fde0a7
SSDEEP:	12288:7WYIPXjxannnHg2cOriFgRtHKOtnk9ViDE48k91yOcYG3aHcyvNm:7WYIPFannnHg2JPtKOai0GZlGqHcyvk
TLSH:	DEE4231223DD835BEE9D47B408B94180977A9E27AC61F34DAE8070EC4B1BBC51766B73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)f..............0...... ........... ........@.. .......................@............`................................

File Icon


Icon Hash:	c14e4c4c4c4c4f41

Static PE Info

General

Entrypoint:	0x4af5ea
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6629D7D7 [Thu Apr 25 04:11:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor eax, 35455354h
xor dword ptr [edi+eax*2], esi
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx+4Ah], dl
push ebx
cmp byte ptr [eax+edi+34h], al
inc ebx
inc ebx
xor al, 37h
xor eax, 00000035h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xaf598	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x1008	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xad610	0xad800	296b0d0dceed446095095e5ba8349ba8	False	0.9531995789805475	data	7.967039469679906	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x1008	0x1800	c6124af9cedb0416bd1621da29575d13	False	0.5413411458333334	data	5.082622182520175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x800	16f6e49a2d60ceca0c947c0e7bd23915	False	0.01611328125	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb00c8	0xc08	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9308441558441558
RT_GROUP_ICON	0xb0ce0	0x14	data	1.05
RT_VERSION	0xb0d04	0x300	MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"	0.4427083333333333

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-08:25:09.444640	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49703	587	192.168.2.7	34.195.165.88
04/25/24-08:25:09.444640	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49703	587	192.168.2.7	34.195.165.88

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 08:25:08.004762888 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:08.127593040 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:08.127759933 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:08.655249119 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:08.655975103 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:08.779047966 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:08.780311108 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:08.904372931 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:08.908298969 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.046411991 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.046777010 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.170039892 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.170322895 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.320750952 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.321007013 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.443864107 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.443969011 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.444639921 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.444639921 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.444694996 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.444694996 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:25:09.567881107 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.567900896 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.589384079 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:25:09.635912895 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:26:47.621303082 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:26:47.787044048 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:26:47.945379019 CEST	587	49703	34.195.165.88	192.168.2.7
Apr 25, 2024 08:26:47.945522070 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:26:47.945626020 CEST	49703	587	192.168.2.7	34.195.165.88
Apr 25, 2024 08:26:48.068459988 CEST	587	49703	34.195.165.88	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 08:25:07.602786064 CEST	54384	53	192.168.2.7	1.1.1.1
Apr 25, 2024 08:25:07.996891022 CEST	53	54384	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 08:25:07.602786064 CEST	192.168.2.7	1.1.1.1	0xce65	Standard query (0)	mail.orako.co.ke	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 08:25:07.996891022 CEST	1.1.1.1	192.168.2.7	0xce65	No error (0)	mail.orako.co.ke	orako.co.ke		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 08:25:07.996891022 CEST	1.1.1.1	192.168.2.7	0xce65	No error (0)	orako.co.ke		34.195.165.88	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 25, 2024 08:25:08.655249119 CEST	587	49703	34.195.165.88	192.168.2.7	220-ccaws1.coatedcloud.com ESMTP Exim 4.96.2 #2 Thu, 25 Apr 2024 06:25:08 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Apr 25, 2024 08:25:08.655975103 CEST	49703	587	192.168.2.7	34.195.165.88	EHLO 675052
Apr 25, 2024 08:25:08.779047966 CEST	587	49703	34.195.165.88	192.168.2.7	250-ccaws1.coatedcloud.com Hello 675052 [185.152.66.230] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Apr 25, 2024 08:25:08.780311108 CEST	49703	587	192.168.2.7	34.195.165.88	AUTH login aW5mb29vQG9yYWtvLmNvLmtl
Apr 25, 2024 08:25:08.904372931 CEST	587	49703	34.195.165.88	192.168.2.7	334 UGFzc3dvcmQ6
Apr 25, 2024 08:25:09.046411991 CEST	587	49703	34.195.165.88	192.168.2.7	235 Authentication succeeded
Apr 25, 2024 08:25:09.046777010 CEST	49703	587	192.168.2.7	34.195.165.88	MAIL FROM:<infooo@orako.co.ke>
Apr 25, 2024 08:25:09.170039892 CEST	587	49703	34.195.165.88	192.168.2.7	250 OK
Apr 25, 2024 08:25:09.170322895 CEST	49703	587	192.168.2.7	34.195.165.88	RCPT TO:<me@orako.co.ke>
Apr 25, 2024 08:25:09.320750952 CEST	587	49703	34.195.165.88	192.168.2.7	250 Accepted
Apr 25, 2024 08:25:09.321007013 CEST	49703	587	192.168.2.7	34.195.165.88	DATA
Apr 25, 2024 08:25:09.443969011 CEST	587	49703	34.195.165.88	192.168.2.7	354 Enter message, ending with "." on a line by itself
Apr 25, 2024 08:25:09.444694996 CEST	49703	587	192.168.2.7	34.195.165.88	.
Apr 25, 2024 08:25:09.589384079 CEST	587	49703	34.195.165.88	192.168.2.7	250 OK id=1rzsTE-00791q-1u
Apr 25, 2024 08:26:47.621303082 CEST	49703	587	192.168.2.7	34.195.165.88	QUIT
Apr 25, 2024 08:26:47.945379019 CEST	587	49703	34.195.165.88	192.168.2.7	221 ccaws1.coatedcloud.com closing connection

Target ID:	0
Start time:	08:25:03
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"
Imagebase:	0xc20000
File size:	720'896 bytes
MD5 hash:	0CDDB3E724F9BB0314BF8C50DB240CF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1236849879.0000000005C30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1233750900.0000000004089000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1233750900.0000000004A77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:25:04
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe"
Imagebase:	0x650000
File size:	720'896 bytes
MD5 hash:	0CDDB3E724F9BB0314BF8C50DB240CF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2474501053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2479468346.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2479468346.0000000002B16000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.2479468346.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	192
Total number of Limit Nodes:	10

Executed Functions

Function 07700040 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237630934.0000000007700000.00000040.00000800.00020000.00000000.sdmp, Offset: 07700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7700000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461ecf5b2d10cf629e56479d36a3796887c42f9f4cfc5d66338b8fbdb02ff0d7
Instruction ID: 5282ce904a09144f469cc7e9be2d091af4c80aea2f7ae979b77697ac1c923e47
Opcode Fuzzy Hash: 461ecf5b2d10cf629e56479d36a3796887c42f9f4cfc5d66338b8fbdb02ff0d7
Instruction Fuzzy Hash: FD32ABB0B01206CFDB19DBA9C554BAEB7F6AF89654F144869E506DB3E0CB30DD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0751089F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925020b1ce1638d18269f0485aa7111cbd999576b7c7df2887c516af69ac23af
Instruction ID: f3c7cd16c5a2a02a3dd6ceda23960fb6befb6bce4c4d5112c35a182adba8c7f0
Opcode Fuzzy Hash: 925020b1ce1638d18269f0485aa7111cbd999576b7c7df2887c516af69ac23af
Instruction Fuzzy Hash: E05159B0E1520A9FEB04CFA6D4555EEFBF2FF89201F14942AE405A7394D7349A42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 075108B0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1684708535862441539c7acc241f388e698079e75c3eccb111d8d0cf77fc2571
Instruction ID: 9778b70a8329832e2de6829b16ac43f84812ef80402326af8f948edaefc04f66
Opcode Fuzzy Hash: 1684708535862441539c7acc241f388e698079e75c3eccb111d8d0cf77fc2571
Instruction Fuzzy Hash: 405168B0E1520A9FEB04CFA6D4515EEFBF2FF89301F14942AE409A3394D7349A418F94

Uniqueness

Uniqueness Score: -1.00%

Function 013ED7F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013ED876
GetCurrentThread.KERNEL32 ref: 013ED8B3
GetCurrentProcess.KERNEL32 ref: 013ED8F0
GetCurrentThreadId.KERNEL32 ref: 013ED949

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d57cd483100ef8a684b5524e0fd3a3f7e808e2a1a5cebb15f5629fcd76f3cf64
Instruction ID: 80d65d956c8688789298f880117ce8db9458328920df3b2c7c27640d8fa39d1a
Opcode Fuzzy Hash: d57cd483100ef8a684b5524e0fd3a3f7e808e2a1a5cebb15f5629fcd76f3cf64
Instruction Fuzzy Hash: CB5145B0D003098FDB14DFAAD548BAEBBF1EB88314F24845DE419A7390DB74A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0751C610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 0751C67A

Strings

U, xrefs: 0751C610

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID: U
API String ID: 947044025-3372436214
Opcode ID: 5b564b65b0c492a19b595e1aab6d80c3f8992a9cd198bfa7b351136b7e8e7119
Instruction ID: 47d6437814284e3c87254691dffee6909080d3aa7c43141986cd41e3210c3c6d
Opcode Fuzzy Hash: 5b564b65b0c492a19b595e1aab6d80c3f8992a9cd198bfa7b351136b7e8e7119
Instruction Fuzzy Hash: 941146B1D003498FDB20DFAAD8457DFFBF5AB88320F14881AD419A7640CA79A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0751D356 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0751D58E

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f4602788328841c4efafc3ca9487852eb735f1d94ee7fb69529e2da4417243fc
Instruction ID: e8fbbf4ac7df4a339e4fd99445eb5e65b820f27c475ef8ed083bd69072e10f2f
Opcode Fuzzy Hash: f4602788328841c4efafc3ca9487852eb735f1d94ee7fb69529e2da4417243fc
Instruction Fuzzy Hash: 8B9150B1E00759DFEB24DF68C840BDDBBB2BF44315F0485AAD809A7280DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0751D358 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0751D58E

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bb2d712d7fde294fc37c9a05aae91df8b12d3007ccfaeffb1d43c108a1f51f33
Instruction ID: 1cb739dae8fe56c6cc6d2a72018f93cc59b944414c482c3432ba2a113b972c4e
Opcode Fuzzy Hash: bb2d712d7fde294fc37c9a05aae91df8b12d3007ccfaeffb1d43c108a1f51f33
Instruction Fuzzy Hash: BE9150B1E00759CFEB24DF68C840BDDBBB2BF44315F0485AAD809A7280D7759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 013EB55F Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013EB7C6

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 04d4e78b20974271bb5e45a4a2417b9ab2623b59c6285ad8eea3c4f35c319eae
Instruction ID: a4d2e9c60a2e9926e06faf2b30d3a6b86987d51cee5c5cc0805977b9d7eb29a6
Opcode Fuzzy Hash: 04d4e78b20974271bb5e45a4a2417b9ab2623b59c6285ad8eea3c4f35c319eae
Instruction Fuzzy Hash: A5815770A00B158FDB25DF29D55875ABBF1FF88214F00892ED08ADBA94D734E90ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 013E590C Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013E59C9

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 272e193a7ee0fed4b78519dedd54185a5c814d48e86a32e102f576b588b4ebd3
Instruction ID: 112bbfe3dc7176fa72419c3751ee22248c42e25117c5faa08bfc5bf953c5ba53
Opcode Fuzzy Hash: 272e193a7ee0fed4b78519dedd54185a5c814d48e86a32e102f576b588b4ebd3
Instruction Fuzzy Hash: B841E475C00729CBEB25DFA9C88479DBBF5BF49308F20815AD408AB291DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013E44E4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 013E59C9

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a6057f854737d77e43d1f58e3b6e8ce40ea529abe82729ca4a5096ecef5ef07a
Instruction ID: 1c2af9819af6d59541840ad3ed45999116fb433b9ed32c1efe85761a3c216d96
Opcode Fuzzy Hash: a6057f854737d77e43d1f58e3b6e8ce40ea529abe82729ca4a5096ecef5ef07a
Instruction Fuzzy Hash: 5041F475C0072DCBEB24DFA9C84879DBBF5BF49308F20806AD509AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013E5A84 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab483d5d26cb4c56b83dcd0d3e339e8080dfe1e0cac5a711988e57fa0a0b21a
Instruction ID: cb5b2630cacf58248471d020d3f3821f6f22d53253029dc0b0ab3c567f0c712a
Opcode Fuzzy Hash: 0ab483d5d26cb4c56b83dcd0d3e339e8080dfe1e0cac5a711988e57fa0a0b21a
Instruction Fuzzy Hash: F531DF75C04769CFEB22CFA8C8487DDBBF0AF46328F104289D405AB291C7755946CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0751D0C9 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0751D160

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 529178cd406810ccf387bfe6dada3565a3efd1c9c367c72a2ed3cff876676c96
Instruction ID: 6c6d2e592f65e55524e2b170e2a9fd9a0a30f95e18c5619f4286d1810c08f0cf
Opcode Fuzzy Hash: 529178cd406810ccf387bfe6dada3565a3efd1c9c367c72a2ed3cff876676c96
Instruction Fuzzy Hash: 362126B5D003199FDB10DFA9D881BEEBBF5FF48310F50842AE919A7240CB799944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0751D1B8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0751D240

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b6c23067e1b684d10a4438e6af2f693352fb785278649f120267d6936edd9b96
Instruction ID: 925f8cf8374773f2099a584f70c0209ba1242883fc2d13fb718341621e2303ac
Opcode Fuzzy Hash: b6c23067e1b684d10a4438e6af2f693352fb785278649f120267d6936edd9b96
Instruction Fuzzy Hash: 3F2139B1D003499FDB10DFAAD841BEEBBF5FF48310F50842AE929A7240CB359940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0751D0D0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0751D160

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2e11ef8d6e9d0469f75dd1f2b88eea986ea58e4c8db3b4a8321b683a0b1c6bf7
Instruction ID: 561f4966d5987f028593ccd1307cb51c9a4477859b3b5c270f7d45247ac251b5
Opcode Fuzzy Hash: 2e11ef8d6e9d0469f75dd1f2b88eea986ea58e4c8db3b4a8321b683a0b1c6bf7
Instruction Fuzzy Hash: B12124B5D003099FDB10DFAAC881BDEBBF5FF48310F50882AE919A7240C7799944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0751C6C6 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0751C746

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 78eceed863eb1c69a197bdd30ae6082c1c2a485b3fac184a42423de36cdbdf91
Instruction ID: c93e12d82cf9f0c5536f84a80f13a052fb1adba5ed84430c10fb5d4a422699d0
Opcode Fuzzy Hash: 78eceed863eb1c69a197bdd30ae6082c1c2a485b3fac184a42423de36cdbdf91
Instruction Fuzzy Hash: A82157B1D003098FDB10DFAAC481BEEBBF4EB48320F50842ED419A7240CB79A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0751C6C8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0751C746

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 745829fa49415cf3ca15414756140e22135f4414cb9497812f0145926d16ba64
Instruction ID: a67d51fa917e950aabff8349986cbce8d852244638dfc4392c52685e05bcecdd
Opcode Fuzzy Hash: 745829fa49415cf3ca15414756140e22135f4414cb9497812f0145926d16ba64
Instruction Fuzzy Hash: 502137B1D003098FDB10DFAAC4857EEBBF4AB48310F54842ED559A7240CB799945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0751D1C0 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0751D240

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3c627addfb9bd31005e96c23acaad88dc001dd0f74fbeef03f01616bd3687b6c
Instruction ID: 51bffc72fc220f8060769c281dc9c23e93c041df7320bd4a37ada8423ed54c12
Opcode Fuzzy Hash: 3c627addfb9bd31005e96c23acaad88dc001dd0f74fbeef03f01616bd3687b6c
Instruction Fuzzy Hash: 63212AB1D003499FDB10DF9AC841BDEBBF5FF48310F50842AE919A7240C7359901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 013EDA40 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013EDAC7

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6fe70dd480fc6f92aa3670ceed01586724ab1205fdb1e26397f742d3af7e29ad
Instruction ID: 24daea6bf54038335cf7857122aa162bd3373d6acd230af5672419123c2bcc69
Opcode Fuzzy Hash: 6fe70dd480fc6f92aa3670ceed01586724ab1205fdb1e26397f742d3af7e29ad
Instruction Fuzzy Hash: 4021E4B5D003089FDB10CF9AD884ADEBBF5EB48320F14841AE914A3350C375A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0751D009 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0751D07E

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb70049c536e54f5706249b95a42ac4c2eb734b84269a1b2d84069b419bf8a1f
Instruction ID: 143316149d0ff882b4010ba334dd6a78bf944483a0accf220b10dcdda8da2f85
Opcode Fuzzy Hash: bb70049c536e54f5706249b95a42ac4c2eb734b84269a1b2d84069b419bf8a1f
Instruction Fuzzy Hash: 3E114771D003099FDB24DFA9D845BDFBBF5AB48320F10881AE959A7250C7769941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013EAFB0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013EB841,00000800,00000000,00000000), ref: 013EBA52

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 50f0f692c14168c7c7ccf55f5c1098501bb5d08152916756703b1a60a40bc34f
Instruction ID: be8699fd1c88f9f9de535f66247133730b8583d7f1e8c1a391dacfbeaa911d5b
Opcode Fuzzy Hash: 50f0f692c14168c7c7ccf55f5c1098501bb5d08152916756703b1a60a40bc34f
Instruction Fuzzy Hash: 611114B6C003098FDB21DF9AD448B9EFBF4EB48315F10842EE919A7240C775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0751D010 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0751D07E

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c61ba8649807449765ce019defc642e713c303996ab12e41b048a3993efc7cea
Instruction ID: b41b940f65e630de01078701b7c0a0e4301e0aad86e09f5797c58caf5b0fff8a
Opcode Fuzzy Hash: c61ba8649807449765ce019defc642e713c303996ab12e41b048a3993efc7cea
Instruction Fuzzy Hash: 04112971D003499FDB24DFAAC845BDEBBF5EB48310F148419E519A7250C7759541CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07701920 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 07701980

Memory Dump Source

Source File: 00000000.00000002.1237630934.0000000007700000.00000040.00000800.00020000.00000000.sdmp, Offset: 07700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7700000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b514ff96a7a0168369b5678b1197fa5e644e2674fb81efe8be6e28ea913cb87a
Instruction ID: 798a5b7bda64d87792a6ae51971e7431444d4071bab704e898f3fff197f57ab0
Opcode Fuzzy Hash: b514ff96a7a0168369b5678b1197fa5e644e2674fb81efe8be6e28ea913cb87a
Instruction Fuzzy Hash: DC1128B5800349DFDB20DF99D445BEEFBF8EB48320F10841AD958A7640D739A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013EB9E1 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013EB841,00000800,00000000,00000000), ref: 013EBA52

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8537c510ed706172afbe71703ec18212e963c1d82c4609f1afb09bd1d1c1becf
Instruction ID: 38cbdc39f2b3ab7ddb386cb8d695fe501db9062f3eecb7482b4cce1d8d8559a9
Opcode Fuzzy Hash: 8537c510ed706172afbe71703ec18212e963c1d82c4609f1afb09bd1d1c1becf
Instruction Fuzzy Hash: BD1112B6D003098FDB21CF9AD948BDEFBF4AB48311F10842AD929A7240C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0751C618 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0751C67A

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c54e4e60f56278920421ad01fac01bdc01c94e534a7122f5a4c67bc33dc5be83
Instruction ID: 1ac2454db3b8c9b03dd47123b7dd0393682fce03d0365852e7ee77608a4e99c5
Opcode Fuzzy Hash: c54e4e60f56278920421ad01fac01bdc01c94e534a7122f5a4c67bc33dc5be83
Instruction Fuzzy Hash: 271136B1D003498FDB24DFAAC4457DEFBF5EB88320F24881AD519A7240CB79A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 013EB760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 013EB7C6

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 04aeffe56560dc75801f25e3d526ebfbc7d52b416651d76ddb3d5869c3daca86
Instruction ID: b7eb0fbe4bb56e658985bbce52545f78e8fcd45fcc4f36ef69c2a6b617431b89
Opcode Fuzzy Hash: 04aeffe56560dc75801f25e3d526ebfbc7d52b416651d76ddb3d5869c3daca86
Instruction Fuzzy Hash: AE110FB5C003498FDB21DF9AD444A9EFBF8AF88324F14842AD829A7640C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0751F58A Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0751F5ED

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6f1375d18ea207b29b2058235f73150e0cc6af8ce143fd52c478a4a5ee9cdb8f
Instruction ID: 0ea47ef2a36e2857bfc3cec2574c0f7077addd61f7b45f9e2c4868fca254c47f
Opcode Fuzzy Hash: 6f1375d18ea207b29b2058235f73150e0cc6af8ce143fd52c478a4a5ee9cdb8f
Instruction Fuzzy Hash: 4A11C2B58003499FDB20DF9AD885BDEFBF8EB48321F20841AE558A7250C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0751B480 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0751F5ED

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 484ca113225a82c2c9033b08f117a2b713fea10dc307714011b084fbf04cb798
Instruction ID: c186407121e2164fdc45fd21acdbff383133e595a257d2838e22013aa5a363ad
Opcode Fuzzy Hash: 484ca113225a82c2c9033b08f117a2b713fea10dc307714011b084fbf04cb798
Instruction Fuzzy Hash: 9811F5B58003499FDB20DF9AD445BDEBBF8FB48311F10841AE518A7240D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07701928 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 07701980

Memory Dump Source

Source File: 00000000.00000002.1237630934.0000000007700000.00000040.00000800.00020000.00000000.sdmp, Offset: 07700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7700000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e66861d4d2d8e550fc260bd1f7f179f614839db59317633728d3abffc664a5da
Instruction ID: f9304768be5504ec94167fe5df61d6b1788faf4662c9aefdc655e3bce2e7c690
Opcode Fuzzy Hash: e66861d4d2d8e550fc260bd1f7f179f614839db59317633728d3abffc664a5da
Instruction Fuzzy Hash: B21103B5C00349CFDB20DF9AD445BEEBBF5EB48320F10842AD958A7280D739A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0138D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231092854.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169292de771745a2a93932beeece45b7b89958995b1c033a0dbf595ca223e54f
Instruction ID: 79a8842ac5535912cfc1ee0bbe80720db2ff3c6ee8f456e84acad4228da83312
Opcode Fuzzy Hash: 169292de771745a2a93932beeece45b7b89958995b1c033a0dbf595ca223e54f
Instruction Fuzzy Hash: 8A21F171504344DFDB15EF58D9C0B26BF65FB88328F20C56AE8090B696C336D456CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0139D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231213548.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531e243938def26a75b8463c4f71c92add79d19da51062fd0ca9f1a9402ddecb
Instruction ID: 37bbcb0328b85de9911a783faf0769cce8fbbf3e3fddf1f3e0fe0d8c3b92f8c1
Opcode Fuzzy Hash: 531e243938def26a75b8463c4f71c92add79d19da51062fd0ca9f1a9402ddecb
Instruction Fuzzy Hash: B1210071604304DFDF15DF64D985B16BB65FB84358F20C56DD84A0B786C33AD807CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0139D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231213548.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212120664feff36d809ce77d7e5d1a4d9d2ab98c7643052e592a684d6f50449b
Instruction ID: 972bfb2161e5c09a6f1b0bd0264a35af2c85b25f30784234ffaace112eac373f
Opcode Fuzzy Hash: 212120664feff36d809ce77d7e5d1a4d9d2ab98c7643052e592a684d6f50449b
Instruction Fuzzy Hash: 47213771604304DFDF05DF94D9C1B15BB65FB84328F20C5ADD8894B382C336D406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0138D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231092854.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: aef4f7db8f10a8af0488ef5d460c9aff06b404cef8e4d0d3d50eb472cb30fec4
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: E111B176504280DFCB16DF54D5C4B16BF72FB84328F24C6AAD8490B697C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0139D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231213548.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: bdca8fe46417ae6d3719522ae5070a39c52a230b05126b8f9e64e7e3bed44b88
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 8B11BB75504280DFDB06CF58C6C0B15BBB2FB84328F24C6ADD8894B296C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0139D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231213548.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_139d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: a23813fd4fb6d078389d1385cc6edebde2e2f9ed8f5130a44aab984ae15cc8b7
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 67118B75504280DFDB16CF58D5C4B15BBA2FB84328F24C6AAD8494B796C33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0138D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231092854.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c586cd9131f51e1f7467bcc05df3dc2a603933431ce3a02c27bf0d06d1c8bc66
Instruction ID: 3fb38e625dd95ebd2965d551c6e57230a78e7c6dd3df4a616ae3b2bdf6e38bcd
Opcode Fuzzy Hash: c586cd9131f51e1f7467bcc05df3dc2a603933431ce3a02c27bf0d06d1c8bc66
Instruction Fuzzy Hash: 9D01F2310083849AE7207FA5CC84B66BF9CDF41229F18C52AFD090A2C2C2399845CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0138D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231092854.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_138d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3bc57e4c2a58420b635c4883dc82f32dd00c8e6410c7c74e3d168b22a66ef
Instruction ID: 5a41a60f65954849ac25093f9174dd7812b2c96bb7d0fda6189ae339bb4d2ce9
Opcode Fuzzy Hash: dde3bc57e4c2a58420b635c4883dc82f32dd00c8e6410c7c74e3d168b22a66ef
Instruction Fuzzy Hash: 96F062714053849EE710AF5ADC88B66FF98EB41635F18C55AFD084A2C6C279A844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07513810 Relevance: 5.3, Strings: 4, Instructions: 259COMMON

Download Yara Rule

Strings

]\`, xrefs: 07513A92
[V~*, xrefs: 07513975
[V~*, xrefs: 0751397C
T+-q, xrefs: 07513B4A

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$[V~*$]\`
API String ID: 0-1849991408
Opcode ID: bd77fc1c828b2ca541df2a042c270404c476bf9d963401ac8d8899a7a142c987
Instruction ID: 759f7d03d44154aa70399638719c9d17c521b8c7022e6ef48583a8d8362df304
Opcode Fuzzy Hash: bd77fc1c828b2ca541df2a042c270404c476bf9d963401ac8d8899a7a142c987
Instruction Fuzzy Hash: 08B1E8B0E1561ADBEB04CFAAD5909DEFBF2BF89300F14D52AD415BB258D73099028F54

Uniqueness

Uniqueness Score: -1.00%

Function 07513800 Relevance: 4.0, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

]\`, xrefs: 07513A92
[V~*, xrefs: 0751397C
T+-q, xrefs: 07513B4A

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: T+-q$[V~*$]\`
API String ID: 0-3978741314
Opcode ID: e6dcda236117bf31c17e1cae710eed151e29d0fe30bdac3ab17b7637c905b949
Instruction ID: f661a73032bcda449e1c5493118c04a47bb9036073acb5cc032aa21f7f6ce12b
Opcode Fuzzy Hash: e6dcda236117bf31c17e1cae710eed151e29d0fe30bdac3ab17b7637c905b949
Instruction Fuzzy Hash: 4EB109B0E1521ADBEB04CFAAD9908DEFBF2BF89300F14D52AD415BB259D73099028F54

Uniqueness

Uniqueness Score: -1.00%

Function 07700007 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237630934.0000000007700000.00000040.00000800.00020000.00000000.sdmp, Offset: 07700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7700000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe4b881f088c861c3a7510f07a9c6a9a712817fa07f0bbb8baaee4f13f72b01
Instruction ID: d1ad4c377cc3d98781d4f69a436a349c2688604f409ff250c825b8b7afb88a67
Opcode Fuzzy Hash: bfe4b881f088c861c3a7510f07a9c6a9a712817fa07f0bbb8baaee4f13f72b01
Instruction Fuzzy Hash: AEC1CBB1301342CFDB26DB75C460BAEB7F6AF8A654F14486ED046CB2D1DA34D902CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0751C7A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7311c424e14c5e21a374303f86fa93838bcd832fbc89acdfddd0980e8af234
Instruction ID: ba4c344af9099039baff495232f89b4a9e994be6d71f9d2405d25b62448334c0
Opcode Fuzzy Hash: 5f7311c424e14c5e21a374303f86fa93838bcd832fbc89acdfddd0980e8af234
Instruction Fuzzy Hash: F0E119B4E002198FDB14DFA8C580AAEFBB2FF89305F248169D454AB355DB35AD42CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0751A5A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814a430725dec2637cdce0be7891c1dfca36e3dce46f1fa9adf4f03c454cb6da
Instruction ID: 0be2c3327ef3eae9e184c09ea55ede54a97c510c41c31b5656766221da2373d8
Opcode Fuzzy Hash: 814a430725dec2637cdce0be7891c1dfca36e3dce46f1fa9adf4f03c454cb6da
Instruction Fuzzy Hash: 7FE1F7B4E012198FDB15DFA8C680AAEBBB2FF89305F24C169D454AB355D734AD42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0751A168 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb7daf4db6397ba4166d16e4c327db304f7553b763c82636f4c2754caa5ad6c
Instruction ID: 015bc0771eb2526a8050b03ffe7b4fecd36566a202c3c57554b9c7ce9478e984
Opcode Fuzzy Hash: acb7daf4db6397ba4166d16e4c327db304f7553b763c82636f4c2754caa5ad6c
Instruction Fuzzy Hash: 8DE107B4E012198FDB14CFA9C680AAEBBB2FF89305F24C169D454AB355D735AD42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0751BDF0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664d194dcfd208e93853e9a0b693f2edcb4928e200d619fff81580dacdf7bba9
Instruction ID: 972a839743a21c1a06b2e25b0e4aedd00181ffa2caceeaecf3de58dc3236e546
Opcode Fuzzy Hash: 664d194dcfd208e93853e9a0b693f2edcb4928e200d619fff81580dacdf7bba9
Instruction Fuzzy Hash: 4EE119B4E002198FDB14CFA9C580AAEFBB2FF89305F248169D454AB355D735AD42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0751CBD8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99b552c9ca8ee870e59cf674485f483c601301258aba47e64c5640b0533f3e1
Instruction ID: a2c310dc6efbc3a079be761671b02c2a52c9df301d11ce74ff1a7dee74665634
Opcode Fuzzy Hash: c99b552c9ca8ee870e59cf674485f483c601301258aba47e64c5640b0533f3e1
Instruction Fuzzy Hash: EEE11AB4E002198FDB14CFA9C580AAEFBB2FF89305F248169D454AB355D735AD42CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07512117 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d1c2df0871f0fb50352a1cde14f6d6728bad42846ceedcba55bbd4faca355c
Instruction ID: e288a5cef8671cc4e2246069039ed1abb039527251b49e1129e6539c5a0420f4
Opcode Fuzzy Hash: b1d1c2df0871f0fb50352a1cde14f6d6728bad42846ceedcba55bbd4faca355c
Instruction Fuzzy Hash: D2D11435C1075A8ACB11EF74D9906D9B7B1FF96300F20C79AD4493B250EB74AADACB81

Uniqueness

Uniqueness Score: -1.00%

Function 07512141 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353057dd6acdc58c4a8942090c963aa58c8fe1e20e66fc30a8d066efbf994fa4
Instruction ID: fa8003b86ee53984c9dacf67cd0de7ae0b9df42417a264d87fd6ded0302c72d6
Opcode Fuzzy Hash: 353057dd6acdc58c4a8942090c963aa58c8fe1e20e66fc30a8d066efbf994fa4
Instruction Fuzzy Hash: 45D12435C10B1A8ACB11EF74D9906D9B7B1FF96300F20879AD4493B250EB74AAD9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013EE3B4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231385747.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13e0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6d1bfe9e295f87ee71dc6e879027613798601253fb36fb53db7891f0295125
Instruction ID: 86a961248ecbcc2e92a111537cfc11d4113e661e99e41031584ad6cf4310dfa5
Opcode Fuzzy Hash: 9f6d1bfe9e295f87ee71dc6e879027613798601253fb36fb53db7891f0295125
Instruction Fuzzy Hash: 3FA15E32A0032A8FCF15DFA8C84859EBBF6FF84304B15457AE905AB295DB71E956CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07512150 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f05a319bd40b1a0cb2eaf5d24cc5ee2932fde8b9c0fca8d72e9a4d86c7abb1
Instruction ID: 7fc159abc32caae1b709854a3f9f91712bde513bb9f8633e6ab232115d8095d6
Opcode Fuzzy Hash: c4f05a319bd40b1a0cb2eaf5d24cc5ee2932fde8b9c0fca8d72e9a4d86c7abb1
Instruction Fuzzy Hash: EAD1F535C10B1A8ACB11EF74D990699F7B1FF96300F20C79AD4493B250EB74AAD9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0751C791 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ffcd8fd722e826d51054ade380a785a6dd9352a441a1b8a770b00a9c8d73c02
Instruction ID: 9f9880a49ac87bd3ec06e9a5d9561161b7408a4cb30f52e64c9c22d46c8508d2
Opcode Fuzzy Hash: 9ffcd8fd722e826d51054ade380a785a6dd9352a441a1b8a770b00a9c8d73c02
Instruction Fuzzy Hash: 76514BB1E002198FDB14CFA9C9806EEFBB2FF89211F24816AD458A7355D7359D42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0751A592 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa7ed72aeb0206c6ca4ae9c5fd0dfa82c88294a5ed42d78c1547b82c000dcb6
Instruction ID: b89c8b12a0a401c7dafcb33465367faa0e8f28f039c932dcc4171b852a465231
Opcode Fuzzy Hash: 5fa7ed72aeb0206c6ca4ae9c5fd0dfa82c88294a5ed42d78c1547b82c000dcb6
Instruction Fuzzy Hash: 825119B4E012198FDB15CFA9C9805AEBBF6BF89201F24C16AD458AB355D7349D42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0751EB56 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1237306867.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7510000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccb0e3ef1d2c725c5904b1d9c2ed6b251b7803f14a6e44ed8f58038acadd2ab
Instruction ID: d7ce860aeab7cde0af7e34fb7563a1564f1973340ec03764cd8bbaeadb202653
Opcode Fuzzy Hash: fccb0e3ef1d2c725c5904b1d9c2ed6b251b7803f14a6e44ed8f58038acadd2ab
Instruction Fuzzy Hash: 28E012B5909208CBDB008FA4E4560F8B7B8BB8B312F0064A5950EA3251D6308984AA50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exePID: 6464, Parent PID: 6292COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	5

Executed Functions

Function 01029BF8 Relevance: 2.8, Instructions: 2817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc353514527dc3afc545489d6a9f66cfbe443b19933b2b8d67e872d5d4cf9b6
Instruction ID: 25313b5136ecc305eb2c4277ba55446276cec30c8d8512b84d195649960773b9
Opcode Fuzzy Hash: 6bc353514527dc3afc545489d6a9f66cfbe443b19933b2b8d67e872d5d4cf9b6
Instruction Fuzzy Hash: FB530731D10B1A8ADB51EF68C8806A9F7B1FF99300F55D79AE45877121FB70AAC4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01029BF2 Relevance: 2.7, Instructions: 2716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca025624f575823bd9196f134350673929020ef038a3ed2bdf7b13ff55b7e5fc
Instruction ID: 6583c83a7b4c26db2d052d9bd18edb25f02b3308c1727f004f690219891e0188
Opcode Fuzzy Hash: ca025624f575823bd9196f134350673929020ef038a3ed2bdf7b13ff55b7e5fc
Instruction Fuzzy Hash: 5453F531D10B1A8ADB51EF68C8806A9F7B1FF99300F55D79AE45877121FB70AAC4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0102CE90 Relevance: 2.3, Instructions: 2298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3025836d3f8c7d23de61ed5e8358c2e7b28a182dd3050c11c9982976db5f5cc1
Instruction ID: 64c12e35fe6afec02faa26c04b0ec1e6b185a7504c811d63452cca5a8451151c
Opcode Fuzzy Hash: 3025836d3f8c7d23de61ed5e8358c2e7b28a182dd3050c11c9982976db5f5cc1
Instruction Fuzzy Hash: FC331D31D1071A8EDB11EF68C8906ADF7B1FF99300F55C79AE458A7211EB70AAC5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01023E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VGm, xrefs: 010240CB

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \VGm
API String ID: 0-1150679331
Opcode ID: 8dafac9fb13876eaf6cd15a6baaa8956c083778e22dac49f77d6e7f2856f5225
Instruction ID: d6cef3922249ec078abb9fe456297229f0376e6da513f4323d599a470c9f95ca
Opcode Fuzzy Hash: 8dafac9fb13876eaf6cd15a6baaa8956c083778e22dac49f77d6e7f2856f5225
Instruction Fuzzy Hash: EF915E70E003198FDB64CFA9D885BDDBBF2BF58314F248129E455EB254DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01029378 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7278c9c56e18b625636bb6d556ca7340d449bf67a6ada1367da5f9878f595a2d
Instruction ID: 6cc99f19e30b59012e584270de0bc3aab8c6198d617a5e0783c20caabbce4381
Opcode Fuzzy Hash: 7278c9c56e18b625636bb6d556ca7340d449bf67a6ada1367da5f9878f595a2d
Instruction Fuzzy Hash: D3326C34A002248FDB65DF68D584AAEBBF2FF88314F248569E949DB395DB70DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01024A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a60fdfe051db34f94c897710a3b1fe7a8ac87a00e547887d09e900cf122533
Instruction ID: 5aa276a08c20ed7dd103968d3bfd4a16dd8a26a84dbb21b49349e3cef0c46d8f
Opcode Fuzzy Hash: 02a60fdfe051db34f94c897710a3b1fe7a8ac87a00e547887d09e900cf122533
Instruction Fuzzy Hash: B9B17F70E003298FDB65DFADD8817DDBBF2AF48314F248129D855EB294EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01024810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VGm, xrefs: 0102487F
\VGm, xrefs: 010249D2

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \VGm$\VGm
API String ID: 0-2238751749
Opcode ID: 9718ae5c4bafdf667a9088134e24332b04ff6d48a1fc8d563b88c45c4f2c85a3
Instruction ID: 5883998d54db944a90b6cedfcc519fd0c033cd10134ef833a181aeda9c39c3a3
Opcode Fuzzy Hash: 9718ae5c4bafdf667a9088134e24332b04ff6d48a1fc8d563b88c45c4f2c85a3
Instruction Fuzzy Hash: 7B715B70E003599FDB24CFA9C8817DEBBF2BF88314F148129E455EB254EB749842CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01024804 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VGm, xrefs: 0102487F
\VGm, xrefs: 010249D2

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \VGm$\VGm
API String ID: 0-2238751749
Opcode ID: abc9e23c914da4b23e6fcfe49a84358ffec75d8801bf301ea573d24c83e87ea2
Instruction ID: ee313ab0b8064c6690d23248216e2f0589526605c39d68b654d7243b3bcd20fc
Opcode Fuzzy Hash: abc9e23c914da4b23e6fcfe49a84358ffec75d8801bf301ea573d24c83e87ea2
Instruction Fuzzy Hash: D07169B0E002598FDB64CFA9C885BDEBBF2BF48314F148129E455EB254EB749842CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01026ED7 Relevance: 2.6, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LRq, xrefs: 01026F93
LRq, xrefs: 01026F0E

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LRq$LRq
API String ID: 0-3710822783
Opcode ID: d3987b9624b6635f60831c996f10a2a3b75b2da64a20011dc9bf14ad21ec789c
Instruction ID: 9effd0b00c17216f551952a302556d0af1bcee0e8c320cd06d28ce4d222bbcc4
Opcode Fuzzy Hash: d3987b9624b6635f60831c996f10a2a3b75b2da64a20011dc9bf14ad21ec789c
Instruction Fuzzy Hash: DE51D330A002259FDB55DF79C4507AEBBF2EF95300F50846AE845EB281EB729C46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F1E188 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2484143128.0000000005F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f10000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8f1270aeb627b777e221090dc802e13e030596ba30f1f9c8f60952580925d0
Instruction ID: f5a681ffe477585afacd30c949d2c555372caa3b1e1bb708a0499e1abd6b95c1
Opcode Fuzzy Hash: dd8f1270aeb627b777e221090dc802e13e030596ba30f1f9c8f60952580925d0
Instruction Fuzzy Hash: F7411232D0478A8FCB14DFA9D8007EEBBF5AF89210F18856AD905E7241DB389845CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 05F1D330 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05F1E1DA), ref: 05F1E2C7

Memory Dump Source

Source File: 00000003.00000002.2484143128.0000000005F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f10000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e75ad3bb9634a9a344784ac42572c8bb333cff3dc00bb8507cec6860845aecc3
Instruction ID: b62cea340d64087f4e1abd8ee38e5f036d157d9c8ed03931dcb3ef28361e1d39
Opcode Fuzzy Hash: e75ad3bb9634a9a344784ac42572c8bb333cff3dc00bb8507cec6860845aecc3
Instruction Fuzzy Hash: C01114B1C006599BDB20DF9AC445BDEFBF8FB48320F14826AD918A7240D778A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01023E74 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\VGm, xrefs: 010240CB

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \VGm
API String ID: 0-1150679331
Opcode ID: d03104d90c064764e73b37335f78b2a245135b306a7162eb7548f9b27f9babdd
Instruction ID: bc68bc3b7a9551e3e45a08b0e40870c9a50d422ad6299a1b30eef13fc7d21b75
Opcode Fuzzy Hash: d03104d90c064764e73b37335f78b2a245135b306a7162eb7548f9b27f9babdd
Instruction Fuzzy Hash: 25A16D70E003199FDB60CFA8D885BDDBBF1BF58314F248169E495EB254DB749886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0102F3D5 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

PHq, xrefs: 0102F523

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 134d3b270feb8629d9aaa2a9a96f224f9c06b903374072300841879868d91544
Instruction ID: 228d13f5f3a60720c956d6d90efd65faae5cdda338e7bc17833760a11f1ef682
Opcode Fuzzy Hash: 134d3b270feb8629d9aaa2a9a96f224f9c06b903374072300841879868d91544
Instruction Fuzzy Hash: 883100307002269FDB29AF38D5547AE7BF2AF89250B2445AAD442EB346DE34DC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0102F3E8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHq, xrefs: 0102F523

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: PHq
API String ID: 0-3820536768
Opcode ID: 0d5e5bdd2b6c6eebe0fd60439f6b7e9c954cbbfb212e98617be16e19be6d8290
Instruction ID: 334ea95b2650b08c65a8278c5057409ce41db467f9b00e91f87926da109713f5
Opcode Fuzzy Hash: 0d5e5bdd2b6c6eebe0fd60439f6b7e9c954cbbfb212e98617be16e19be6d8290
Instruction Fuzzy Hash: 2931F030B002169FDB29AF39D55476E7BF2EF88680F2449A9D802EB355DE30DC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01026F78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRq, xrefs: 01026F93

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: ac4a7a3b84af9d211cdeaf436e87b25fe5f19790a045b9226b11ca3c24ad2d6a
Instruction ID: 4ff0f76525d41d392cef770a2acae8558e2635867aac86520949bc1c07014d4a
Opcode Fuzzy Hash: ac4a7a3b84af9d211cdeaf436e87b25fe5f19790a045b9226b11ca3c24ad2d6a
Instruction Fuzzy Hash: A8318E34E10228CBDF55CFA9C480B9EB7B1FF95300F50856AF901EB280EB75A945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01026B87 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

LRq, xrefs: 01026BD7

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: b554f41f708bf9d3c38b89b76dff438db1da40df6b92f9623097745687853241
Instruction ID: 6c8728039dcacc8eb4856ec4f1c5fd66aa7d1385fe6ffe68030968e620d3f02f
Opcode Fuzzy Hash: b554f41f708bf9d3c38b89b76dff438db1da40df6b92f9623097745687853241
Instruction Fuzzy Hash: 1721B1316093805FC3066B7998243AE7FB1EF8B600B0944DFD485CB2A3DA399846C796

Uniqueness

Uniqueness Score: -1.00%

Function 01027908 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bf35865855f3f272b6b0edd78fea0fd019e43e6715c1d2617c437a85d309d0
Instruction ID: 24ba6524364c9b8e3d5c20145accdf14d0ddee59fc22fb64bb55c87b2d03096c
Opcode Fuzzy Hash: f4bf35865855f3f272b6b0edd78fea0fd019e43e6715c1d2617c437a85d309d0
Instruction Fuzzy Hash: F9126C78B10211DBDF66BB38E44526D32A2FBD5301B604A29E505CF3A6CF75EC4B8B91

Uniqueness

Uniqueness Score: -1.00%

Function 01024A8C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5e17ce78fb98e5d244738dbc1b3a88bce6cc02333974146ef9999e0fd162e6
Instruction ID: b6aece1a24b9fb78b85f9b49c174e0e99a9f8ec52d7967df6bde7986f3015ebb
Opcode Fuzzy Hash: 8f5e17ce78fb98e5d244738dbc1b3a88bce6cc02333974146ef9999e0fd162e6
Instruction Fuzzy Hash: C7B16D70E002298FDB61DFACD8857DDBBF1AF48314F248169D859EB294EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01029364 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640a09e3178020c9ece8745ac2602556087c9b656b5f6f4b927f0a290a631e7f
Instruction ID: 34a293ea2c8449fe0e4503fb521a30db942923eab12ac7f6041e3d5971eef048
Opcode Fuzzy Hash: 640a09e3178020c9ece8745ac2602556087c9b656b5f6f4b927f0a290a631e7f
Instruction Fuzzy Hash: 9A918034A002248FDB65DF68D584AADBBF2FF88314F148569E945EB365DB71EC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01020CD3 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8972e430931bd313d5fd6d9c3b192f61bf2671aca461480cc7b5b1edb2a1d32e
Instruction ID: 1369f39ce8ac6ff398c6b48615d619f72db660fa4b780f8e089645dbacde858c
Opcode Fuzzy Hash: 8972e430931bd313d5fd6d9c3b192f61bf2671aca461480cc7b5b1edb2a1d32e
Instruction Fuzzy Hash: E6513370D002688FDB14DFA9C885BADBBF1AF48300F15816AD855AB391D7759844CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01026CDD Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58967e97b01aa66451f27ee64b086904a8df0b85136b956b6cfcdb2b373292d7
Instruction ID: 07a149e4a25b0da8a9439bce94b45976a9fdbd43aaac5803987157de0e1abb7c
Opcode Fuzzy Hash: 58967e97b01aa66451f27ee64b086904a8df0b85136b956b6cfcdb2b373292d7
Instruction Fuzzy Hash: 8B512070D002288FDB18DFA9C885BDDBBF1BF48310F158169E859BB391DB75A880CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01026CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7183e1fe5a29419be2f5c0d8d9f35a592f08d3170cac44cee4f234e477447c
Instruction ID: 281726ec777cd5c85b23e1e5c446e4dab302f26c4c64d2d4949b1790efcddf07
Opcode Fuzzy Hash: 7b7183e1fe5a29419be2f5c0d8d9f35a592f08d3170cac44cee4f234e477447c
Instruction Fuzzy Hash: 07512270D002288FDB18DFA9C885B9DBBF1BF48310F158169E855BB395DB75A880CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01021128 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fdf408563d483dcc25ea3722222a5184721263b595b91ad117c025453060ed
Instruction ID: c0378a2cedf4d6a377896f990ee95180ffd3c00cdfa69655787f64ffffb1929b
Opcode Fuzzy Hash: c2fdf408563d483dcc25ea3722222a5184721263b595b91ad117c025453060ed
Instruction Fuzzy Hash: 9C51F87462526A8FCF16FB29FC90A593F71FB923053148969D0005B3BEDE75690BCB82

Uniqueness

Uniqueness Score: -1.00%

Function 01021138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70fe555459dd6e65129c1cd7a829f2433ceb92897e92229bb287a9ac5b22f8ce
Instruction ID: ecb805f558ea516cfc950a717ac9ba5cb50f30893c5901b67a47b7d0778809cd
Opcode Fuzzy Hash: 70fe555459dd6e65129c1cd7a829f2433ceb92897e92229bb287a9ac5b22f8ce
Instruction Fuzzy Hash: 1751E87562226A8FCF16FB29FC90A593F61F7923053148979D0005B3BEDE74690BCB82

Uniqueness

Uniqueness Score: -1.00%

Function 0102F298 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9b440bd1779618db7ba864f9ca4db8547cfae525b46ebc53c2a9f646c1136c
Instruction ID: 8eff35ef3d0e9bf8487106c64bdcc1af26e4db682053ee0eef046128aabc781f
Opcode Fuzzy Hash: de9b440bd1779618db7ba864f9ca4db8547cfae525b46ebc53c2a9f646c1136c
Instruction Fuzzy Hash: 4C317034E102169BCB19DF69D454AAEBBF2EF89300F10C559E856EB345DB70AC46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0102F2A8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e25e8beadac3ee6ff8bf42ecba6583954c41db81ca27bdfe1848580a8a9582
Instruction ID: be189a9ffb4079a6e9b8e1ada49c66ef3a22c8ef32527dd5f3a29abc0ad98707
Opcode Fuzzy Hash: e8e25e8beadac3ee6ff8bf42ecba6583954c41db81ca27bdfe1848580a8a9582
Instruction Fuzzy Hash: EB315E34E106169BCB19DF69D494AAEBBF2EF89300F10C55AE856EB345DF70AC46CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010226DE Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e205de530abfcb25e84b15c55698fa22b4479d73c885209ecc7349114e8458
Instruction ID: 151fbfe9123800e709f52a3f332855c54f39271eb340018b973e9d6c49a6dca9
Opcode Fuzzy Hash: f3e205de530abfcb25e84b15c55698fa22b4479d73c885209ecc7349114e8458
Instruction Fuzzy Hash: E04101B0D00309DFEB14DFA9C584ADEBBF5BF48310F148029E819AB250DB759946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010226E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc872459a8358992049e49740fb48af729124aeff91a7694d027677b03d2c6f4
Instruction ID: e49355dfe1ef31b014237c0a384be32165794c359ddb11d578e1e44d9e43f0e0
Opcode Fuzzy Hash: cc872459a8358992049e49740fb48af729124aeff91a7694d027677b03d2c6f4
Instruction Fuzzy Hash: 1541CDB0D013499FEB24DFA9C584A9EBBF5BF48310F148029E819AB254DB75A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01025097 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365b92a48187a00cb4071376555f5c454ac91612b61e7e15f090fff3b6b6a333
Instruction ID: 6945ba243b277a0a91786a57bfa09997a1c1d1fee0a29187b537747bbeb04445
Opcode Fuzzy Hash: 365b92a48187a00cb4071376555f5c454ac91612b61e7e15f090fff3b6b6a333
Instruction Fuzzy Hash: 44316D30600265CFDF29EB78C9546ED7BF2AF89204F2005A8D541AB394DF769C42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 010250A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0295ad64fef36436e501c32f331fb472b5e12bc522dcd019250fe8d86b588cd
Instruction ID: 114bdebcd15b0ea5a091c96cf502f79d5f99fd6e6a7cd7d74b392a00cf4d03be
Opcode Fuzzy Hash: f0295ad64fef36436e501c32f331fb472b5e12bc522dcd019250fe8d86b588cd
Instruction Fuzzy Hash: 65310D30700225CFDF59EB78C9546ED77F2AB89244F2005A8D941AB394DF76DC42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01029250 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24a97804e71bd6aaa5e3ac64a8e7b3a28fbfe542187a3b2920961733019d680
Instruction ID: 9a3d13bc727a129e5ce0328200c28edce1b978949f0a785a0148b6cbe1d29fde
Opcode Fuzzy Hash: a24a97804e71bd6aaa5e3ac64a8e7b3a28fbfe542187a3b2920961733019d680
Instruction Fuzzy Hash: 2B31A431E102259BCB06DFA8D4507EEFBB2FF8A304F14D559E845EB245DB709846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01021488 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156a727f07af736f8d400ffa81af06dc47892f099ca4238dbd146b81fca6fc51
Instruction ID: 06d293688c0d3a771ac5c37b1c62507ff8a63b4c4f5685d79af14d7882d0d4ee
Opcode Fuzzy Hash: 156a727f07af736f8d400ffa81af06dc47892f099ca4238dbd146b81fca6fc51
Instruction Fuzzy Hash: 55219234A002669FDF66EF7894506AD7BE1EF48254F1404BAE48ADB341DB35D9428B81

Uniqueness

Uniqueness Score: -1.00%

Function 0102169F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c37ee54a1e6ea5a985a772a4456bae0d50aeb2e8c17a44a19bee396f7411ce5
Instruction ID: ed69c3380492b07f238b58909464891ec5fc5a1816a30751a9a55f49b154cc7d
Opcode Fuzzy Hash: 6c37ee54a1e6ea5a985a772a4456bae0d50aeb2e8c17a44a19bee396f7411ce5
Instruction Fuzzy Hash: 9E21A9389142248FDF72A72CF88876D3BA5EB45315F1049A5D046CF2ABDA39DC478B92

Uniqueness

Uniqueness Score: -1.00%

Function 01029260 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31cdb4d2e0b869a0181af9993280b58d7c1bfa4b1016e2d02e4f5b6b9e0a011
Instruction ID: d8041b1f350934b63cc06f81109be7eb6e81e056586c147fe732c75bfb827b37
Opcode Fuzzy Hash: b31cdb4d2e0b869a0181af9993280b58d7c1bfa4b1016e2d02e4f5b6b9e0a011
Instruction Fuzzy Hash: 5F219631E102299BDB15DFA9D4406DEF7B2FF89304F50D55AE805EB245DB709C46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01029150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae923b3c995a2894752953b282c3e1a7af55ba8297df0355360a5a1ddf58fcec
Instruction ID: afda013464f35a11fdd22ac3b53986d8bd37bfd97e80cbe73ebc925a7fbb8d02
Opcode Fuzzy Hash: ae923b3c995a2894752953b282c3e1a7af55ba8297df0355360a5a1ddf58fcec
Instruction Fuzzy Hash: DF21A330E006259BCB19CFA9D4546DEBBB2AF89304F20855AE852BB351EB709D46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478091035.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ecd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d1ebc52399d748f67fcedd52f0905c61acf7d9ae0ebaa39002bdc459e5663f
Instruction ID: c39d771b0cd39a84c654da7438cd7ad84f1fb23a3d25bb29d976044a64a90515
Opcode Fuzzy Hash: c3d1ebc52399d748f67fcedd52f0905c61acf7d9ae0ebaa39002bdc459e5663f
Instruction Fuzzy Hash: D821CF756082009FDB14DF18DA85F16BBA6EB84328F20C5BDD84A5B286C337D847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01029A30 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1c410ecfd8e54e2cc41baec6465aeeb7bf4fc40026fbd3ad8c634a7bfec939
Instruction ID: dff973d59e86582e6024891585d516036ac4048218c1edfe091ecb3db6762fd7
Opcode Fuzzy Hash: 8f1c410ecfd8e54e2cc41baec6465aeeb7bf4fc40026fbd3ad8c634a7bfec939
Instruction Fuzzy Hash: 2521C331B102258FEB14DB69C954BAE7BF6FF88714F148069E505EB3A0DAB1DC00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01024F8A Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca8fe9a4e5a38b5138d33d3a54d39353c110e180debf2c391b65f6053ffb09e
Instruction ID: 119e8b3d09f301b2ce17845203c96bbd7828902f72dca5b7a79c375e18f22181
Opcode Fuzzy Hash: 2ca8fe9a4e5a38b5138d33d3a54d39353c110e180debf2c391b65f6053ffb09e
Instruction Fuzzy Hash: 59213734700215CFDB54DB38D998BAD77F1EF8D204B1044A9E446EB3A0DB359D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01029160 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe3c5b5147bbe8a2dc3136f2ae60c0a2e679b6e66dcb8a8f5d6d60844a1d090
Instruction ID: 64378bfb867d6cbc8cda0504cf6af7107bc9f57dd380b74a3729b23747e10575
Opcode Fuzzy Hash: 3fe3c5b5147bbe8a2dc3136f2ae60c0a2e679b6e66dcb8a8f5d6d60844a1d090
Instruction Fuzzy Hash: A0215030E006299BCB19CFA9D854ADEF7B2EF89304F20855AE855BB341DB70A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01021382 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064a0d3bcd0b641d2e8b05e32b01a5f14387c49969a255ba5a359ba9481c6d9f
Instruction ID: a9e39c9a8cb74a1ad592016e2ddd297ea8f98d619f7917c32c9d988113ea2c7a
Opcode Fuzzy Hash: 064a0d3bcd0b641d2e8b05e32b01a5f14387c49969a255ba5a359ba9481c6d9f
Instruction Fuzzy Hash: 48219378A401618FEF73572CD49876D3BE1EB42315F1048A9E58BCB6D2DA7988868783

Uniqueness

Uniqueness Score: -1.00%

Function 01021888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e361178f4c62fe8aeaacc780cbd15349335453ae6897e988ebc5eb03f5b2177
Instruction ID: 7f93b5b3e30407c7a0a100da1aa6393200971f950487a39bfc14508cfd66264b
Opcode Fuzzy Hash: 6e361178f4c62fe8aeaacc780cbd15349335453ae6897e988ebc5eb03f5b2177
Instruction Fuzzy Hash: 3A215930B00265CFEF64EB68C5547AE77F2AB89240F2004A8D146EB394DB769D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010216B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7085aeadcbe786c1b1e317b8f5ecfc71ed31ffaf8e5d7be1da2cf3edf7d32670
Instruction ID: b5e510e782553628ee61f8df84db125553d751a84f3ec7c94232fec9a770fdfb
Opcode Fuzzy Hash: 7085aeadcbe786c1b1e317b8f5ecfc71ed31ffaf8e5d7be1da2cf3edf7d32670
Instruction Fuzzy Hash: 45213638A102148FEF62F72CF88475E37A5FB85315F108965D046CB29BDA79EC478B91

Uniqueness

Uniqueness Score: -1.00%

Function 01021878 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b879c614015b1e3eb9130557e5c155ca8df47a62cba5c35288c3cf2b7a4cef3
Instruction ID: 622202c0e2e2a301e626948e531d3e2d12e20319862bd6617e9674d60206dda5
Opcode Fuzzy Hash: 6b879c614015b1e3eb9130557e5c155ca8df47a62cba5c35288c3cf2b7a4cef3
Instruction Fuzzy Hash: 26218E30B00265CFEF65EB68C5547AE7BF2AF49204F2404A8D146EB395DB758D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01024F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5d540b207b8f7a472b033067e828c6dad182944786ea131f189e93abdd2a73
Instruction ID: 85c2dc3759e0ada931510af4e9f7503b894653d53228ed098e75fb040af7e20d
Opcode Fuzzy Hash: 8c5d540b207b8f7a472b033067e828c6dad182944786ea131f189e93abdd2a73
Instruction Fuzzy Hash: FF212834B00214CFDB54EB79D998BAD77F1EB8D200F1044A9E506EB3A0DB769D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478091035.0000000000ECD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ECD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ecd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ac261e40ee6c76fe593f9e29be525de5d7872fb4038f24441f656e329e945c
Instruction ID: 86b265f00625e7081d0961bb5c330c974a53df9ba7581566e46c8adbb3552e42
Opcode Fuzzy Hash: 99ac261e40ee6c76fe593f9e29be525de5d7872fb4038f24441f656e329e945c
Instruction Fuzzy Hash: 532160755093808FD702CF24D990B15BF72EB46214F28C5EAD8498B6A7C33B980BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 01020838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30c6b92c267500f1688780e59d46500fab2204e880c90e3a71cb827b1abade1
Instruction ID: 16f3bfae0f6ba6e7f2ad72572f91947cfa9fe39c3302a6c39ce2223ad42b30ac
Opcode Fuzzy Hash: c30c6b92c267500f1688780e59d46500fab2204e880c90e3a71cb827b1abade1
Instruction Fuzzy Hash: 4A11E730B043258FEF66667DD85037F3791DB46214F1049BAE0C6CF28BD9A5C8468BC1

Uniqueness

Uniqueness Score: -1.00%

Function 01020848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b16546af5530a25153cd85f6e96e87273bf3388bc7139183a2d7574508f1f2
Instruction ID: dbcfd782cd7739c30dc9ab7379ae258a8cdd8d26def5d1a30a6c39a3f7801fe6
Opcode Fuzzy Hash: 21b16546af5530a25153cd85f6e96e87273bf3388bc7139183a2d7574508f1f2
Instruction Fuzzy Hash: 1611C434B003298FEFA56A7DD44472B32D5EB85214F1048BAF0C6CF28AD9A5CC868BC1

Uniqueness

Uniqueness Score: -1.00%

Function 010217C2 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b5a5bac105281137059fc017c1c60ed524ea3ff2ab73611c298738b13959e8
Instruction ID: 934b984db50538ecbc0aa4e4a32acec0cbfb43d921a9018f60241ca25a0500cf
Opcode Fuzzy Hash: c7b5a5bac105281137059fc017c1c60ed524ea3ff2ab73611c298738b13959e8
Instruction Fuzzy Hash: 1711CE75F003618FDF51AF78984866F7BE5EB89A50F100868E945D7344EA30C802C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 01021498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b605e31a86c3723205347731a8913875105f8cd3828c9e9eca6d3186a72d5b65
Instruction ID: 75827b5df327bb95376bb7c3410685795f9542ab4ee7e0a1fd69b67e40947811
Opcode Fuzzy Hash: b605e31a86c3723205347731a8913875105f8cd3828c9e9eca6d3186a72d5b65
Instruction Fuzzy Hash: D8014C31E013369FCF65EFBC84506AEBBF5EB48250B2404BAD849E7301EB35D9428B91

Uniqueness

Uniqueness Score: -1.00%

Function 010280F1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb52e162c250d29066b5f1acbe76383fbcc2152edbdc42d504e83ac6cb75c6a4
Instruction ID: 4e82bac4492adb5086225bf96cf838161850915b24d2b9ff18439a7c7d933b34
Opcode Fuzzy Hash: bb52e162c250d29066b5f1acbe76383fbcc2152edbdc42d504e83ac6cb75c6a4
Instruction Fuzzy Hash: 6A018434910218EFDF01FBB8E891ADD7FB1EF40300F5082A9C0059B29AEA347E06C791

Uniqueness

Uniqueness Score: -1.00%

Function 01021524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8486ac3813b4cc2ea8c1c4039dfbca8659d1ba20fa0806899c47bdacfdf466
Instruction ID: 3a0fb9cb120b0ef73fd6454e6270601ca53c5bbdba29d532f017a6f8b6fe2bd1
Opcode Fuzzy Hash: 5f8486ac3813b4cc2ea8c1c4039dfbca8659d1ba20fa0806899c47bdacfdf466
Instruction Fuzzy Hash: 6EF02477A04270DFDB228BA884902ACBFB0FEA922171C00D7D8CADB211D732E406CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01027090 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60368050e6aef64e6e6fa2ed60c2a8918bca3d70e7ca082868979cdd1dc80282
Instruction ID: cafe423d0b12dbc76e58d4c5e7aad213faa476fca73e34cfeaeea4b89bf0379b
Opcode Fuzzy Hash: 60368050e6aef64e6e6fa2ed60c2a8918bca3d70e7ca082868979cdd1dc80282
Instruction Fuzzy Hash: 2EF0E739B40218CFDB14DB78D598B6D77B2FF88326F1144A8E5069B3A4CB35AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01028100 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2478653424.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1020000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3177aa361d6ec4152c0f14080ed56a17e133c65b7168e4bbdfdd064dcac76807
Instruction ID: 07c1fdce58dc946d7935006f87f43c6021451bf0f83f7022b3c2cd8022b6509a
Opcode Fuzzy Hash: 3177aa361d6ec4152c0f14080ed56a17e133c65b7168e4bbdfdd064dcac76807
Instruction Fuzzy Hash: 74F01D34910218AFDF01FBA8F941ADDBBB1EF40300F5096A980049B259EA357E06CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.12561.19906.exe

Function 013ED7F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 0751C610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
threadCOMMON

Function 0751D356 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 0751D358 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 013EB55F Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre